{"id":"https://openalex.org/W4312739050","doi":"https://doi.org/10.1109/tifs.2022.3211644","title":"Detecting and Interpreting Changes in Scanning Behavior in Large Network Telescopes","display_name":"Detecting and Interpreting Changes in Scanning Behavior in Large Network Telescopes","publication_year":2022,"publication_date":"2022-01-01","ids":{"openalex":"https://openalex.org/W4312739050","doi":"https://doi.org/10.1109/tifs.2022.3211644"},"language":"en","primary_location":{"id":"doi:10.1109/tifs.2022.3211644","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tifs.2022.3211644","pdf_url":null,"source":{"id":"https://openalex.org/S61310614","display_name":"IEEE Transactions on Information Forensics and Security","issn_l":"1556-6013","issn":["1556-6013","1556-6021"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Information Forensics and Security","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5019169583","display_name":"Michalis Kallitsis","orcid":"https://orcid.org/0000-0001-8086-499X"},"institutions":[{"id":"https://openalex.org/I2801191597","display_name":"Merit Network","ror":"https://ror.org/01sgg2e20","country_code":"US","type":"nonprofit","lineage":["https://openalex.org/I2801191597"]}],"countries":["US"],"is_corresponding":true,"raw_author_name":"Michalis Kallitsis","raw_affiliation_strings":["Merit Network, Inc., Ann Arbor, MI, USA","Merit Network, Inc. in Ann Arbor, Michigan, USA"],"affiliations":[{"raw_affiliation_string":"Merit Network, Inc., Ann Arbor, MI, USA","institution_ids":["https://openalex.org/I2801191597"]},{"raw_affiliation_string":"Merit Network, Inc. in Ann Arbor, Michigan, USA","institution_ids":["https://openalex.org/I2801191597"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5084820319","display_name":"Rupesh Prajapati","orcid":null},"institutions":[{"id":"https://openalex.org/I130769515","display_name":"Pennsylvania State University","ror":"https://ror.org/04p491231","country_code":"US","type":"education","lineage":["https://openalex.org/I130769515"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Rupesh Prajapati","raw_affiliation_strings":["Pennsylvania State University, University Park, PA, USA","Pennsylvania State University, University Park, Pennsylvania, U.S.A"],"affiliations":[{"raw_affiliation_string":"Pennsylvania State University, University Park, PA, USA","institution_ids":["https://openalex.org/I130769515"]},{"raw_affiliation_string":"Pennsylvania State University, University Park, Pennsylvania, U.S.A","institution_ids":["https://openalex.org/I130769515"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5004737962","display_name":"Vasant Honavar","orcid":"https://orcid.org/0000-0001-5399-3489"},"institutions":[{"id":"https://openalex.org/I130769515","display_name":"Pennsylvania State University","ror":"https://ror.org/04p491231","country_code":"US","type":"education","lineage":["https://openalex.org/I130769515"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Vasant Honavar","raw_affiliation_strings":["Pennsylvania State University, University Park, PA, USA","Pennsylvania State University, University Park, Pennsylvania, U.S.A"],"affiliations":[{"raw_affiliation_string":"Pennsylvania State University, University Park, PA, USA","institution_ids":["https://openalex.org/I130769515"]},{"raw_affiliation_string":"Pennsylvania State University, University Park, Pennsylvania, U.S.A","institution_ids":["https://openalex.org/I130769515"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5060047261","display_name":"Dinghao Wu","orcid":null},"institutions":[{"id":"https://openalex.org/I130769515","display_name":"Pennsylvania State University","ror":"https://ror.org/04p491231","country_code":"US","type":"education","lineage":["https://openalex.org/I130769515"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Dinghao Wu","raw_affiliation_strings":["Pennsylvania State University, University Park, PA, USA","Pennsylvania State University, University Park, Pennsylvania, U.S.A"],"affiliations":[{"raw_affiliation_string":"Pennsylvania State University, University Park, PA, USA","institution_ids":["https://openalex.org/I130769515"]},{"raw_affiliation_string":"Pennsylvania State University, University Park, Pennsylvania, U.S.A","institution_ids":["https://openalex.org/I130769515"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5109056901","display_name":"John Yen","orcid":null},"institutions":[{"id":"https://openalex.org/I130769515","display_name":"Pennsylvania State University","ror":"https://ror.org/04p491231","country_code":"US","type":"education","lineage":["https://openalex.org/I130769515"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"John Yen","raw_affiliation_strings":["Pennsylvania State University, University Park, PA, USA"],"affiliations":[{"raw_affiliation_string":"Pennsylvania State University, University Park, PA, USA","institution_ids":["https://openalex.org/I130769515"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":5,"corresponding_author_ids":["https://openalex.org/A5019169583"],"corresponding_institution_ids":["https://openalex.org/I2801191597"],"apc_list":null,"apc_paid":null,"fwci":2.8388,"has_fulltext":false,"cited_by_count":21,"citation_normalized_percentile":{"value":0.91052731,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":96,"max":99},"biblio":{"volume":"17","issue":null,"first_page":"3611","last_page":"3625"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9980999827384949,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9980999827384949,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9980999827384949,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9301999807357788,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7300828099250793},{"id":"https://openalex.org/keywords/the-internet","display_name":"The Internet","score":0.5333601832389832},{"id":"https://openalex.org/keywords/cluster-analysis","display_name":"Cluster analysis","score":0.5225152969360352},{"id":"https://openalex.org/keywords/representation","display_name":"Representation (politics)","score":0.509259819984436},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.4607776999473572},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.38645949959754944},{"id":"https://openalex.org/keywords/information-retrieval","display_name":"Information retrieval","score":0.3535284698009491},{"id":"https://openalex.org/keywords/world-wide-web","display_name":"World Wide Web","score":0.17817074060440063}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7300828099250793},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.5333601832389832},{"id":"https://openalex.org/C73555534","wikidata":"https://www.wikidata.org/wiki/Q622825","display_name":"Cluster analysis","level":2,"score":0.5225152969360352},{"id":"https://openalex.org/C2776359362","wikidata":"https://www.wikidata.org/wiki/Q2145286","display_name":"Representation (politics)","level":3,"score":0.509259819984436},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.4607776999473572},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.38645949959754944},{"id":"https://openalex.org/C23123220","wikidata":"https://www.wikidata.org/wiki/Q816826","display_name":"Information retrieval","level":1,"score":0.3535284698009491},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.17817074060440063},{"id":"https://openalex.org/C94625758","wikidata":"https://www.wikidata.org/wiki/Q7163","display_name":"Politics","level":2,"score":0.0},{"id":"https://openalex.org/C17744445","wikidata":"https://www.wikidata.org/wiki/Q36442","display_name":"Political science","level":0,"score":0.0},{"id":"https://openalex.org/C199539241","wikidata":"https://www.wikidata.org/wiki/Q7748","display_name":"Law","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/tifs.2022.3211644","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tifs.2022.3211644","pdf_url":null,"source":{"id":"https://openalex.org/S61310614","display_name":"IEEE Transactions on Information Forensics and Security","issn_l":"1556-6013","issn":["1556-6013","1556-6021"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Information Forensics and Security","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[{"display_name":"Peace, Justice and strong institutions","score":0.5899999737739563,"id":"https://metadata.un.org/sdg/16"}],"awards":[{"id":"https://openalex.org/G3423443657","display_name":null,"funder_award_id":"CNS-1823192","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G7588534821","display_name":null,"funder_award_id":"CNS-2120400","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G8566771859","display_name":null,"funder_award_id":"17STQAC00001-05-00","funder_id":"https://openalex.org/F4320306110","funder_display_name":"U.S. Department of Homeland Security"}],"funders":[{"id":"https://openalex.org/F4320306076","display_name":"National Science Foundation","ror":"https://ror.org/021nxhr62"},{"id":"https://openalex.org/F4320306110","display_name":"U.S. Department of Homeland Security","ror":"https://ror.org/00jyr0d86"}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":62,"referenced_works":["https://openalex.org/W148447563","https://openalex.org/W1465790424","https://openalex.org/W1479215706","https://openalex.org/W1485062015","https://openalex.org/W1522301498","https://openalex.org/W1677182931","https://openalex.org/W1959608418","https://openalex.org/W1987971958","https://openalex.org/W1989454965","https://openalex.org/W1989714227","https://openalex.org/W1990882054","https://openalex.org/W2000497232","https://openalex.org/W2031801461","https://openalex.org/W2061133001","https://openalex.org/W2081357650","https://openalex.org/W2100495367","https://openalex.org/W2122410182","https://openalex.org/W2125101937","https://openalex.org/W2129066856","https://openalex.org/W2144762303","https://openalex.org/W2152436591","https://openalex.org/W2156531792","https://openalex.org/W2158060559","https://openalex.org/W2163922914","https://openalex.org/W2165533158","https://openalex.org/W2187089797","https://openalex.org/W2276275567","https://openalex.org/W2295124130","https://openalex.org/W2402560368","https://openalex.org/W2574467796","https://openalex.org/W2726785551","https://openalex.org/W2733765803","https://openalex.org/W2735418187","https://openalex.org/W2768883253","https://openalex.org/W2771641736","https://openalex.org/W2848278845","https://openalex.org/W2884826434","https://openalex.org/W2888853207","https://openalex.org/W2892416982","https://openalex.org/W2899670782","https://openalex.org/W2902827568","https://openalex.org/W2925226405","https://openalex.org/W2947969447","https://openalex.org/W2948694540","https://openalex.org/W2948791798","https://openalex.org/W2962688977","https://openalex.org/W2963962535","https://openalex.org/W2981181114","https://openalex.org/W3044135054","https://openalex.org/W3087697243","https://openalex.org/W3203063668","https://openalex.org/W3215290469","https://openalex.org/W4251747050","https://openalex.org/W6610362903","https://openalex.org/W6630780968","https://openalex.org/W6631190155","https://openalex.org/W6640963894","https://openalex.org/W6677217071","https://openalex.org/W6701629550","https://openalex.org/W6728550200","https://openalex.org/W6753041022","https://openalex.org/W6794840795"],"related_works":["https://openalex.org/W2804364458","https://openalex.org/W2065457896","https://openalex.org/W4298130764","https://openalex.org/W3173234801","https://openalex.org/W2132641928","https://openalex.org/W2090259340","https://openalex.org/W4310225030","https://openalex.org/W2167984027","https://openalex.org/W3021302227","https://openalex.org/W2083665254"],"abstract_inverted_index":{"Network":[0],"telescopes":[1],"or":[2,49],"\u201cDarknets\u201d":[3],"received":[4],"unsolicited":[5],"Internet-wide":[6],"traffic,":[7],"thus":[8],"providing":[9],"a":[10,63,85,111],"unique":[11],"window":[12],"into":[13,74],"macroscopic":[14],"Internet":[15],"activities":[16,61],"associated":[17],"with":[18,246,257],"malware":[19],"propagation,":[20],"denial":[21],"of":[22,32,58,70,95,115,121,139,159,220,253,268],"service":[23],"attacks,":[24],"network":[25,29,53,100,125],"reconnaissance,":[26],"misconfigurations":[27],"and":[28,92,173,202,227],"outages.":[30],"Analysis":[31],"the":[33,68,71,90,160,164,195,218,221,251,254,258],"resulting":[34,165],"data":[35,201],"can":[36,44],"provide":[37],"actionable":[38],"insights":[39],"to":[40,47,152,210,264],"security":[41],"analysts":[42],"that":[43,149,250],"be":[45],"used":[46],"prevent":[48],"mitigate":[50],"cyber-threats.":[51],"Large":[52],"telescopes,":[54],"however,":[55],"observe":[56],"millions":[57],"nefarious":[59],"scanning":[60,96,141,181],"on":[62,169],"daily":[64,170],"basis":[65],"which":[66],"makes":[67],"transformation":[69],"captured":[72],"information":[73],"meaningful":[75],"threat":[76],"intelligence":[77],"challenging.":[78],"To":[79],"address":[80],"this":[81],"challenge,":[82],"we":[83],"present":[84],"novel":[86],"framework":[87,104],"for":[88],"characterizing":[89],"structure":[91],"temporal":[93,178],"evolution":[94],"behaviors":[97,142],"observed":[98],"in":[99,130,163,180,224,232],"telescopes.":[101],"The":[102],"proposed":[103,196,255],"includes":[105],"four":[106],"components.":[107],"It":[108],"(i)":[109],"extracts":[110],"rich,":[112],"high-dimensional":[113],"representation":[114,147,167,260],"<italic":[116,135,144,156,175,186],"xmlns:mml=\"http://www.w3.org/1998/Math/MathML\"":[117,136,145,157,176,187],"xmlns:xlink=\"http://www.w3.org/1999/xlink\">scanning":[118],"profiles</i>":[119],"composed":[120],"features":[122,256],"distilled":[123],"from":[124,185],"telescope":[126],"data;":[127],"(ii)":[128],"learns,":[129],"an":[131],"unsupervised":[132],"fashion,":[133],"information-preserving":[134],"xmlns:xlink=\"http://www.w3.org/1999/xlink\">succinct":[137],"representations</i>":[138],"these":[140],"using":[143,183,198],"xmlns:xlink=\"http://www.w3.org/1999/xlink\">deep":[146],"learning</i>":[148],"is":[150],"amenable":[151],"clustering;":[153],"(iii)":[154],"performs":[155],"xmlns:xlink=\"http://www.w3.org/1999/xlink\">clustering</i>":[158],"scanner":[161],"profiles":[162],"latent":[166],"space":[168],"Darknet":[171,204,241,269],"data,":[172],"(iv)":[174],"xmlns:xlink=\"http://www.w3.org/1999/xlink\">detects":[177],"changes</i>":[179],"behavior":[182],"techniques":[184],"xmlns:xlink=\"http://www.w3.org/1999/xlink\">optimal":[188],"mass":[189],"transport</i>":[190],".":[191],"We":[192,206],"robustly":[193],"evaluate":[194],"system":[197],"both":[199],"synthetic":[200],"real-world":[203],"data.":[205],"demonstrate":[207],"its":[208],"ability":[209],"detect":[211],"real-world,":[212],"high-impact":[213],"cybersecurity":[214],"incidents":[215],"such":[216],"as":[217],"onset":[219],"Mirai":[222,239],"botnet":[223],"late":[225],"2016":[226],"several":[228],"interesting":[229],"cluster":[230],"formations":[231],"early":[233],"2022":[234],"(e.g.,":[235],"heavy":[236],"scanners,":[237],"evolved":[238],"variants,":[240],"\u201cbackscatter\u201d":[242],"activities,":[243],"etc.).":[244],"Comparisons":[245],"state-of-the-art":[247],"methods":[248],"showcase":[249],"integration":[252],"deep":[259],"learning":[261],"scheme":[262],"leads":[263],"better":[265],"classification":[266],"performance":[267],"scanners.":[270]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2025,"cited_by_count":9},{"year":2024,"cited_by_count":6},{"year":2023,"cited_by_count":5}],"updated_date":"2026-03-27T05:58:40.876381","created_date":"2025-10-10T00:00:00"}