{"id":"https://openalex.org/W3012425390","doi":"https://doi.org/10.1109/tdsc.2020.2979183","title":"Inferring and Investigating IoT-Generated Scanning Campaigns Targeting a Large Network Telescope","display_name":"Inferring and Investigating IoT-Generated Scanning Campaigns Targeting a Large Network Telescope","publication_year":2020,"publication_date":"2020-03-10","ids":{"openalex":"https://openalex.org/W3012425390","doi":"https://doi.org/10.1109/tdsc.2020.2979183","mag":"3012425390"},"language":"en","primary_location":{"id":"doi:10.1109/tdsc.2020.2979183","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tdsc.2020.2979183","pdf_url":null,"source":{"id":"https://openalex.org/S133795288","display_name":"IEEE Transactions on Dependable and Secure Computing","issn_l":"1545-5971","issn":["1545-5971","1941-0018","2160-9209"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320439","host_organization_name":"IEEE Computer Society","host_organization_lineage":["https://openalex.org/P4310320439","https://openalex.org/P4310319808"],"host_organization_lineage_names":["IEEE Computer Society","Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Dependable and Secure Computing","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5048698954","display_name":"Sadegh Torabi","orcid":"https://orcid.org/0000-0003-2811-3536"},"institutions":[{"id":"https://openalex.org/I60158472","display_name":"Concordia University","ror":"https://ror.org/0420zvk78","country_code":"CA","type":"education","lineage":["https://openalex.org/I60158472"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Sadegh Torabi","raw_affiliation_strings":["Security Research Centre, Concordia Institute for Information Systems Engineering, Montreal, QC, Canada"],"raw_orcid":"https://orcid.org/0000-0003-2811-3536","affiliations":[{"raw_affiliation_string":"Security Research Centre, Concordia Institute for Information Systems Engineering, Montreal, QC, Canada","institution_ids":["https://openalex.org/I60158472"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5039079298","display_name":"Elias Bou\u2010Harb","orcid":"https://orcid.org/0000-0001-8040-4635"},"institutions":[{"id":"https://openalex.org/I45438204","display_name":"The University of Texas at San Antonio","ror":"https://ror.org/01kd65564","country_code":"US","type":"education","lineage":["https://openalex.org/I45438204"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Elias Bou-Harb","raw_affiliation_strings":["Cyber Center for Security and Analytics, University of Texas at San Antonio, San Antonio, TX, USA"],"raw_orcid":"https://orcid.org/0000-0001-8040-4635","affiliations":[{"raw_affiliation_string":"Cyber Center for Security and Analytics, University of Texas at San Antonio, San Antonio, TX, USA","institution_ids":["https://openalex.org/I45438204"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5072393948","display_name":"Chadi Assi","orcid":"https://orcid.org/0000-0002-3161-1846"},"institutions":[{"id":"https://openalex.org/I60158472","display_name":"Concordia University","ror":"https://ror.org/0420zvk78","country_code":"CA","type":"education","lineage":["https://openalex.org/I60158472"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Chadi Assi","raw_affiliation_strings":["Security Research Centre, Concordia Institute for Information Systems Engineering, Montreal, QC, Canada"],"raw_orcid":"https://orcid.org/0000-0002-3161-1846","affiliations":[{"raw_affiliation_string":"Security Research Centre, Concordia Institute for Information Systems Engineering, Montreal, QC, Canada","institution_ids":["https://openalex.org/I60158472"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5064834866","display_name":"ElMouatez Billah Karbab","orcid":null},"institutions":[{"id":"https://openalex.org/I60158472","display_name":"Concordia University","ror":"https://ror.org/0420zvk78","country_code":"CA","type":"education","lineage":["https://openalex.org/I60158472"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"ElMouatez Billah Karbab","raw_affiliation_strings":["Security Research Centre, Concordia Institute for Information Systems Engineering, Montreal, QC, Canada"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Security Research Centre, Concordia Institute for Information Systems Engineering, Montreal, QC, Canada","institution_ids":["https://openalex.org/I60158472"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5019385842","display_name":"Amine Boukhtouta","orcid":"https://orcid.org/0000-0002-0261-815X"},"institutions":[{"id":"https://openalex.org/I4210094041","display_name":"Ericsson (Canada)","ror":"https://ror.org/00nas2c56","country_code":"CA","type":"company","lineage":["https://openalex.org/I1306339040","https://openalex.org/I4210094041"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Amine Boukhtouta","raw_affiliation_strings":["Ericsson Research Group, Montreal, QC, Canada"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Ericsson Research Group, Montreal, QC, Canada","institution_ids":["https://openalex.org/I4210094041"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5028605138","display_name":"Mourad Debbabi","orcid":"https://orcid.org/0000-0003-3015-3043"},"institutions":[{"id":"https://openalex.org/I60158472","display_name":"Concordia University","ror":"https://ror.org/0420zvk78","country_code":"CA","type":"education","lineage":["https://openalex.org/I60158472"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Mourad Debbabi","raw_affiliation_strings":["Security Research Centre, Concordia Institute for Information Systems Engineering, Montreal, QC, Canada"],"raw_orcid":"https://orcid.org/0000-0003-3015-3043","affiliations":[{"raw_affiliation_string":"Security Research Centre, Concordia Institute for Information Systems Engineering, Montreal, QC, Canada","institution_ids":["https://openalex.org/I60158472"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":4.0184,"has_fulltext":false,"cited_by_count":42,"citation_normalized_percentile":{"value":0.94041403,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":96,"max":99},"biblio":{"volume":"19","issue":"1","first_page":"402","last_page":"418"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.9976999759674072,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/botnet","display_name":"Botnet","score":0.9783090353012085},{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.9425326585769653},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7797517776489258},{"id":"https://openalex.org/keywords/exploit","display_name":"Exploit","score":0.6648967266082764},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.6456074714660645},{"id":"https://openalex.org/keywords/internet-of-things","display_name":"Internet of Things","score":0.5786476731300354},{"id":"https://openalex.org/keywords/the-internet","display_name":"The Internet","score":0.5391616225242615},{"id":"https://openalex.org/keywords/honeypot","display_name":"Honeypot","score":0.4987928867340088},{"id":"https://openalex.org/keywords/leverage","display_name":"Leverage (statistics)","score":0.4665391743183136},{"id":"https://openalex.org/keywords/computer-network","display_name":"Computer network","score":0.3574409484863281},{"id":"https://openalex.org/keywords/world-wide-web","display_name":"World Wide Web","score":0.16645920276641846},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.11281299591064453}],"concepts":[{"id":"https://openalex.org/C22735295","wikidata":"https://www.wikidata.org/wiki/Q317671","display_name":"Botnet","level":3,"score":0.9783090353012085},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.9425326585769653},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7797517776489258},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.6648967266082764},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.6456074714660645},{"id":"https://openalex.org/C81860439","wikidata":"https://www.wikidata.org/wiki/Q251212","display_name":"Internet of Things","level":2,"score":0.5786476731300354},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.5391616225242615},{"id":"https://openalex.org/C191267431","wikidata":"https://www.wikidata.org/wiki/Q911932","display_name":"Honeypot","level":2,"score":0.4987928867340088},{"id":"https://openalex.org/C153083717","wikidata":"https://www.wikidata.org/wiki/Q6535263","display_name":"Leverage (statistics)","level":2,"score":0.4665391743183136},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.3574409484863281},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.16645920276641846},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.11281299591064453}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/tdsc.2020.2979183","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tdsc.2020.2979183","pdf_url":null,"source":{"id":"https://openalex.org/S133795288","display_name":"IEEE Transactions on Dependable and Secure Computing","issn_l":"1545-5971","issn":["1545-5971","1941-0018","2160-9209"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320439","host_organization_name":"IEEE Computer Society","host_organization_lineage":["https://openalex.org/P4310320439","https://openalex.org/P4310319808"],"host_organization_lineage_names":["IEEE Computer Society","Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Dependable and Secure Computing","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G2540086661","display_name":null,"funder_award_id":"#1907821","funder_id":"https://openalex.org/F4320337377","funder_display_name":"Office of Advanced Cyberinfrastructure"}],"funders":[{"id":"https://openalex.org/F4320306076","display_name":"National Science Foundation","ror":"https://ror.org/021nxhr62"},{"id":"https://openalex.org/F4320321588","display_name":"Concordia University","ror":"https://ror.org/0420zvk78"},{"id":"https://openalex.org/F4320334593","display_name":"Natural Sciences and Engineering Research Council of Canada","ror":"https://ror.org/01h531d29"},{"id":"https://openalex.org/F4320337377","display_name":"Office of Advanced Cyberinfrastructure","ror":"https://ror.org/04nh1dc89"}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":45,"referenced_works":["https://openalex.org/W89605767","https://openalex.org/W284347760","https://openalex.org/W1673310716","https://openalex.org/W1775772884","https://openalex.org/W2019768127","https://openalex.org/W2024902563","https://openalex.org/W2032451229","https://openalex.org/W2073148641","https://openalex.org/W2095343582","https://openalex.org/W2116227232","https://openalex.org/W2119812052","https://openalex.org/W2123070675","https://openalex.org/W2146608034","https://openalex.org/W2152436591","https://openalex.org/W2170196582","https://openalex.org/W2293605433","https://openalex.org/W2295884465","https://openalex.org/W2328654303","https://openalex.org/W2343978497","https://openalex.org/W2354520588","https://openalex.org/W2360903897","https://openalex.org/W2474516640","https://openalex.org/W2481715940","https://openalex.org/W2514644783","https://openalex.org/W2576376563","https://openalex.org/W2579739707","https://openalex.org/W2598947300","https://openalex.org/W2613352518","https://openalex.org/W2613843087","https://openalex.org/W2748868501","https://openalex.org/W2750815311","https://openalex.org/W2809104090","https://openalex.org/W2884826434","https://openalex.org/W2890859663","https://openalex.org/W2962773292","https://openalex.org/W2969468102","https://openalex.org/W2998574808","https://openalex.org/W6610362903","https://openalex.org/W6638021444","https://openalex.org/W6678042037","https://openalex.org/W6681789864","https://openalex.org/W6697684716","https://openalex.org/W6706876442","https://openalex.org/W6721194330","https://openalex.org/W6743621839"],"related_works":["https://openalex.org/W2789663798","https://openalex.org/W2375896275","https://openalex.org/W4230913293","https://openalex.org/W2166943775","https://openalex.org/W2775236000","https://openalex.org/W2073762068","https://openalex.org/W2151915331","https://openalex.org/W2071426633","https://openalex.org/W2929621094","https://openalex.org/W1996006176"],"abstract_inverted_index":{"The":[0,97],"analysis":[1,113],"of":[2,11,25,76,103,145,156],"recent":[3],"large-scale":[4],"cyber":[5],"attacks,":[6],"which":[7,135,163],"leveraged":[8],"insecure":[9],"Internet":[10,34],"Things":[12],"(IoT)":[13],"devices":[14,39,90],"to":[15,56,86],"perform":[16],"malicious":[17,46],"activities":[18,60],"on":[19],"the":[20,23,33,68,93,108,112,152],"Internet,":[21],"highlighted":[22],"rise":[24],"IoT-tailored":[26],"malware/botnets.":[27],"These":[28],"malware":[29],"propagate":[30],"by":[31,62,107,141],"scanning":[32,95,148],"for":[35,44],"vulnerable,":[36],"exploitable":[37],"IoT":[38,64,70,89,104,124,138,157],"that":[40],"could":[41],"be":[42],"utilized":[43],"further":[45],"activities.":[47],"In":[48],"this":[49],"article,":[50],"we":[51,130,150],"devise":[52],"a":[53,81,100],"multi-level":[54],"methodology":[55],"investigate":[57],"Internet-scale":[58],"reconnaissance":[59],"generated":[61,94],"infected":[63],"devices.":[65],"We":[66],"leverage":[67],"<monospace>Shodan</monospace>":[69],"search":[71],"engine":[72],"and":[73,91,128,154,161,166],"over":[74,111],"6TB":[75],"passive":[77],"network":[78,83],"traffic":[79],"from":[80],"large":[82],"telescope":[84],"(darknet)":[85],"infer":[87],"compromised":[88],"characterize":[92],"campaigns.":[96],"results":[98],"highlight":[99,151],"distinctive":[101],"characteristic":[102],"malware/botnets,":[105],"represented":[106],"targeted":[109,133],"ports/services":[110,118],"interval.":[114],"Furthermore,":[115],"while":[116],"these":[117],"are":[119],"mainly":[120],"associated":[121],"with":[122],"well-known":[123],"malware/botnets":[125,158],"(e.g.,":[126,159],"<monospace>Mirai</monospace>":[127],"<monospace>Satori</monospace>),":[129],"uncovered":[131],"newly":[132],"ports,":[134],"indicate":[136],"emerging":[137],"malware/botnet.":[139],"Finally,":[140],"comparing":[142],"two":[143],"instances":[144],"analyzed":[146],"IoT-generated":[147],"campaigns,":[149],"persistence":[153],"evolution":[155],"<monospace>ADB.Miner</monospace>":[160],"<monospace>Fbot</monospace>),":[162],"exploit":[164],"existing,":[165],"in":[167],"some":[168],"cases,":[169],"possibly":[170],"new":[171],"vulnerabilities.":[172]},"counts_by_year":[{"year":2026,"cited_by_count":2},{"year":2025,"cited_by_count":4},{"year":2024,"cited_by_count":10},{"year":2023,"cited_by_count":8},{"year":2022,"cited_by_count":10},{"year":2021,"cited_by_count":5},{"year":2020,"cited_by_count":3}],"updated_date":"2025-11-06T03:46:38.306776","created_date":"2025-10-10T00:00:00"}