{"id":"https://openalex.org/W3093603548","doi":"https://doi.org/10.1145/3419394.3424214","title":"On the Origin of Scanning","display_name":"On the Origin of Scanning","publication_year":2020,"publication_date":"2020-10-22","ids":{"openalex":"https://openalex.org/W3093603548","doi":"https://doi.org/10.1145/3419394.3424214","mag":"3093603548"},"language":"en","primary_location":{"id":"doi:10.1145/3419394.3424214","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3419394.3424214","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the ACM Internet Measurement Conference","raw_type":"proceedings-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://research.utwente.nl/en/publications/0a7379ea-ff87-4ae9-8dd1-b9fd44ad87c6","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5073108885","display_name":"Gerry Wan","orcid":null},"institutions":[{"id":"https://openalex.org/I97018004","display_name":"Stanford University","ror":"https://ror.org/00f54p054","country_code":"US","type":"education","lineage":["https://openalex.org/I97018004"]}],"countries":["US"],"is_corresponding":true,"raw_author_name":"Gerry Wan","raw_affiliation_strings":["Stanford University"],"affiliations":[{"raw_affiliation_string":"Stanford University","institution_ids":["https://openalex.org/I97018004"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5045773507","display_name":"Liz Izhikevich","orcid":"https://orcid.org/0009-0004-3336-0958"},"institutions":[{"id":"https://openalex.org/I97018004","display_name":"Stanford University","ror":"https://ror.org/00f54p054","country_code":"US","type":"education","lineage":["https://openalex.org/I97018004"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Liz Izhikevich","raw_affiliation_strings":["Stanford University"],"affiliations":[{"raw_affiliation_string":"Stanford University","institution_ids":["https://openalex.org/I97018004"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5081866789","display_name":"David Adrian","orcid":"https://orcid.org/0009-0003-3265-8632"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"David Adrian","raw_affiliation_strings":["Censys, Inc"],"affiliations":[{"raw_affiliation_string":"Censys, Inc","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5028367744","display_name":"Katsunari Yoshioka","orcid":"https://orcid.org/0000-0003-0964-8631"},"institutions":[{"id":"https://openalex.org/I180203408","display_name":"Yokohama National University","ror":"https://ror.org/03zyp6p76","country_code":"JP","type":"education","lineage":["https://openalex.org/I180203408"]}],"countries":["JP"],"is_corresponding":false,"raw_author_name":"Katsunari Yoshioka","raw_affiliation_strings":["Yokohama National University"],"affiliations":[{"raw_affiliation_string":"Yokohama National University","institution_ids":["https://openalex.org/I180203408"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5005480813","display_name":"Ralph Holz","orcid":"https://orcid.org/0000-0001-9614-2377"},"institutions":[{"id":"https://openalex.org/I94624287","display_name":"University of Twente","ror":"https://ror.org/006hf6230","country_code":"NL","type":"education","lineage":["https://openalex.org/I94624287"]},{"id":"https://openalex.org/I129604602","display_name":"University of Sydney","ror":"https://ror.org/0384j8v12","country_code":"AU","type":"education","lineage":["https://openalex.org/I129604602"]}],"countries":["AU","NL"],"is_corresponding":false,"raw_author_name":"Ralph Holz","raw_affiliation_strings":["University of Twente, University of Sydney"],"affiliations":[{"raw_affiliation_string":"University of Twente, University of Sydney","institution_ids":["https://openalex.org/I94624287","https://openalex.org/I129604602"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5033589837","display_name":"Christian Rossow","orcid":"https://orcid.org/0000-0003-2470-8444"},"institutions":[{"id":"https://openalex.org/I4210128801","display_name":"Helmholtz Center for Information Security","ror":"https://ror.org/02njgxr09","country_code":"DE","type":"facility","lineage":["https://openalex.org/I1305996414","https://openalex.org/I4210128801"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Christian Rossow","raw_affiliation_strings":["CISPA Helmholtz Center for Information Security"],"affiliations":[{"raw_affiliation_string":"CISPA Helmholtz Center for Information Security","institution_ids":["https://openalex.org/I4210128801"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5069939742","display_name":"Zakir Durumeric","orcid":"https://orcid.org/0000-0002-9647-4192"},"institutions":[{"id":"https://openalex.org/I97018004","display_name":"Stanford University","ror":"https://ror.org/00f54p054","country_code":"US","type":"education","lineage":["https://openalex.org/I97018004"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Zakir Durumeric","raw_affiliation_strings":["Stanford University"],"affiliations":[{"raw_affiliation_string":"Stanford University","institution_ids":["https://openalex.org/I97018004"]}]}],"institutions":[],"countries_distinct_count":5,"institutions_distinct_count":7,"corresponding_author_ids":["https://openalex.org/A5073108885"],"corresponding_institution_ids":["https://openalex.org/I97018004"],"apc_list":null,"apc_paid":null,"fwci":4.2141,"has_fulltext":false,"cited_by_count":53,"citation_normalized_percentile":{"value":0.95190587,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":96,"max":99},"biblio":{"volume":null,"issue":null,"first_page":"662","last_page":"679"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.9994000196456909,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.9994000196456909,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9987000226974487,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10651","display_name":"IPv6, Mobility, Handover, Networks, Security","score":0.993399977684021,"subfield":{"id":"https://openalex.org/subfields/2208","display_name":"Electrical and Electronic Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.6407339572906494},{"id":"https://openalex.org/keywords/the-internet","display_name":"The Internet","score":0.5646340250968933},{"id":"https://openalex.org/keywords/network-packet","display_name":"Network packet","score":0.5195667743682861},{"id":"https://openalex.org/keywords/ipv4","display_name":"IPv4","score":0.5145570635795593},{"id":"https://openalex.org/keywords/transient","display_name":"Transient (computer programming)","score":0.49384385347366333},{"id":"https://openalex.org/keywords/affect","display_name":"Affect (linguistics)","score":0.47018730640411377},{"id":"https://openalex.org/keywords/blocking","display_name":"Blocking (statistics)","score":0.4352785646915436},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.33825749158859253},{"id":"https://openalex.org/keywords/world-wide-web","display_name":"World Wide Web","score":0.24361082911491394},{"id":"https://openalex.org/keywords/computer-network","display_name":"Computer network","score":0.19206562638282776},{"id":"https://openalex.org/keywords/ipv6","display_name":"IPv6","score":0.16052237153053284},{"id":"https://openalex.org/keywords/psychology","display_name":"Psychology","score":0.1166849434375763},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.08156976103782654}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6407339572906494},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.5646340250968933},{"id":"https://openalex.org/C158379750","wikidata":"https://www.wikidata.org/wiki/Q214111","display_name":"Network packet","level":2,"score":0.5195667743682861},{"id":"https://openalex.org/C2779233093","wikidata":"https://www.wikidata.org/wiki/Q11103","display_name":"IPv4","level":4,"score":0.5145570635795593},{"id":"https://openalex.org/C2780799671","wikidata":"https://www.wikidata.org/wiki/Q17087362","display_name":"Transient (computer programming)","level":2,"score":0.49384385347366333},{"id":"https://openalex.org/C2776035688","wikidata":"https://www.wikidata.org/wiki/Q1606558","display_name":"Affect (linguistics)","level":2,"score":0.47018730640411377},{"id":"https://openalex.org/C144745244","wikidata":"https://www.wikidata.org/wiki/Q4927286","display_name":"Blocking (statistics)","level":2,"score":0.4352785646915436},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.33825749158859253},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.24361082911491394},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.19206562638282776},{"id":"https://openalex.org/C84555802","wikidata":"https://www.wikidata.org/wiki/Q2551624","display_name":"IPv6","level":3,"score":0.16052237153053284},{"id":"https://openalex.org/C15744967","wikidata":"https://www.wikidata.org/wiki/Q9418","display_name":"Psychology","level":0,"score":0.1166849434375763},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.08156976103782654},{"id":"https://openalex.org/C46312422","wikidata":"https://www.wikidata.org/wiki/Q11024","display_name":"Communication","level":1,"score":0.0}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1145/3419394.3424214","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3419394.3424214","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the ACM Internet Measurement Conference","raw_type":"proceedings-article"},{"id":"pmh:oai:ris.utwente.nl:openaire/0a7379ea-ff87-4ae9-8dd1-b9fd44ad87c6","is_oa":true,"landing_page_url":"https://research.utwente.nl/en/publications/0a7379ea-ff87-4ae9-8dd1-b9fd44ad87c6","pdf_url":null,"source":{"id":"https://openalex.org/S4406922991","display_name":"University of Twente Research Information","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"other-oa","license_id":"https://openalex.org/licenses/other-oa","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Wan, G, Izhikevich, L, Adrian, D, Yoshioka, K, Holz, R, Rossow, C & Durumeric, Z 2020, On the origin of scanning: the impact of location on Internet-wide scans. in IMC '20 : Proceedings of the ACM Internet Measurement Conference. ACM SIGCOMM, pp. 662-679, ACM Internet Measurement Conference, IMC 2020, 27/10/20. https://doi.org/10.1145/3419394.3424214","raw_type":"info:eu-repo/semantics/publishedVersion"}],"best_oa_location":{"id":"pmh:oai:ris.utwente.nl:openaire/0a7379ea-ff87-4ae9-8dd1-b9fd44ad87c6","is_oa":true,"landing_page_url":"https://research.utwente.nl/en/publications/0a7379ea-ff87-4ae9-8dd1-b9fd44ad87c6","pdf_url":null,"source":{"id":"https://openalex.org/S4406922991","display_name":"University of Twente Research Information","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"other-oa","license_id":"https://openalex.org/licenses/other-oa","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Wan, G, Izhikevich, L, Adrian, D, Yoshioka, K, Holz, R, Rossow, C & Durumeric, Z 2020, On the origin of scanning: the impact of location on Internet-wide scans. in IMC '20 : Proceedings of the ACM Internet Measurement Conference. ACM SIGCOMM, pp. 662-679, ACM Internet Measurement Conference, IMC 2020, 27/10/20. https://doi.org/10.1145/3419394.3424214","raw_type":"info:eu-repo/semantics/publishedVersion"},"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G1108669985","display_name":"CRI: II-New: ORION: Observatory for Cyber-Risk Insights and Outages of Networks","funder_award_id":"1823192","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G1493769651","display_name":null,"funder_award_id":"180104","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G2499887605","display_name":null,"funder_award_id":"DGE-1656518","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G29779124","display_name":"MEETING: Phys-Fest 2, Holden Arboretum, Kansas State University, July 15-19, 2018","funder_award_id":"1801040","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G320138474","display_name":null,"funder_award_id":"-1656518","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G3423443657","display_name":null,"funder_award_id":"CNS-1823192","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G3552377899","display_name":"Asymptotic Properties of 3-Manifolds and Their Fundamental Groups","funder_award_id":"0104030","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G4938905501","display_name":null,"funder_award_id":"180104030","funder_id":"https://openalex.org/F4320334704","funder_display_name":"Australian Research Council"},{"id":"https://openalex.org/G5267932457","display_name":null,"funder_award_id":"1656518","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G5714184577","display_name":null,"funder_award_id":"Fellowship","funder_id":"https://openalex.org/F4320334704","funder_display_name":"Australian Research Council"},{"id":"https://openalex.org/G6894402473","display_name":null,"funder_award_id":"Fellowship","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G7356467175","display_name":null,"funder_award_id":"DP180104030","funder_id":"https://openalex.org/F4320334704","funder_display_name":"Australian Research Council"},{"id":"https://openalex.org/G848032724","display_name":null,"funder_award_id":"Science","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"}],"funders":[{"id":"https://openalex.org/F4320306076","display_name":"National Science Foundation","ror":"https://ror.org/021nxhr62"},{"id":"https://openalex.org/F4320307791","display_name":"Cisco Systems","ror":"https://ror.org/03yt1ez60"},{"id":"https://openalex.org/F4320315885","display_name":"Australian Government","ror":"https://ror.org/0314h5y94"},{"id":"https://openalex.org/F4320334704","display_name":"Australian Research Council","ror":"https://ror.org/05mmh0f86"}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":62,"referenced_works":["https://openalex.org/W16232568","https://openalex.org/W162139023","https://openalex.org/W797440412","https://openalex.org/W1415990210","https://openalex.org/W1495444061","https://openalex.org/W1873601359","https://openalex.org/W1976919795","https://openalex.org/W1989454965","https://openalex.org/W2001637908","https://openalex.org/W2009250465","https://openalex.org/W2021327598","https://openalex.org/W2028060714","https://openalex.org/W2042923641","https://openalex.org/W2047381835","https://openalex.org/W2079973150","https://openalex.org/W2081108821","https://openalex.org/W2110691314","https://openalex.org/W2114398364","https://openalex.org/W2114839095","https://openalex.org/W2119812052","https://openalex.org/W2124472784","https://openalex.org/W2134101189","https://openalex.org/W2139524463","https://openalex.org/W2144489971","https://openalex.org/W2152112690","https://openalex.org/W2182467309","https://openalex.org/W2184387311","https://openalex.org/W2342606171","https://openalex.org/W2350778671","https://openalex.org/W2403688454","https://openalex.org/W2469403219","https://openalex.org/W2505207162","https://openalex.org/W2528061934","https://openalex.org/W2578326422","https://openalex.org/W2608113618","https://openalex.org/W2706122055","https://openalex.org/W2735564808","https://openalex.org/W2748868501","https://openalex.org/W2752929869","https://openalex.org/W2769047723","https://openalex.org/W2793909627","https://openalex.org/W2968383486","https://openalex.org/W2968701173","https://openalex.org/W3029213048","https://openalex.org/W3103282588","https://openalex.org/W3105355360","https://openalex.org/W4289259217","https://openalex.org/W4300093772","https://openalex.org/W6610362903","https://openalex.org/W6659819945","https://openalex.org/W6667086194","https://openalex.org/W6675887650","https://openalex.org/W6678279822","https://openalex.org/W6678359333","https://openalex.org/W6681019726","https://openalex.org/W6728469316","https://openalex.org/W6743493502","https://openalex.org/W6744137356","https://openalex.org/W6745955158","https://openalex.org/W6749657079","https://openalex.org/W6750399828","https://openalex.org/W6904607719"],"related_works":["https://openalex.org/W2392835431","https://openalex.org/W2560936962","https://openalex.org/W2788727012","https://openalex.org/W2126932387","https://openalex.org/W1965371215","https://openalex.org/W2353762239","https://openalex.org/W66314852","https://openalex.org/W4388203630","https://openalex.org/W2185938410","https://openalex.org/W2484966135"],"abstract_inverted_index":{"Fast":[0],"IPv4":[1],"scanning":[2,113],"has":[3,20],"enabled":[4],"researchers":[5],"to":[6],"answer":[7],"a":[8,30],"wealth":[9],"of":[10,24,47,74,77,81],"security":[11],"and":[12,55,61,79,91,95,102,114],"networking":[13],"questions.":[14],"Yet,":[15],"despite":[16],"widespread":[17],"use,":[18],"there":[19],"been":[21],"little":[22],"validation":[23],"the":[25,45,110],"methodology's":[26],"accuracy,":[27],"including":[28],"whether":[29],"single":[31],"scan":[32,42,106],"provides":[33],"sufficient":[34],"coverage.":[35],"In":[36],"this":[37],"paper,":[38],"we":[39],"analyze":[40,85],"how":[41,93],"origin":[43],"affects":[44],"results":[46],"Internet-wide":[48],"scans":[49,57],"by":[50],"completing":[51],"three":[52],"HTTP,":[53,75],"HTTPS,":[54,78],"SSH":[56,82],"from":[58],"seven":[59],"geographically":[60],"topologically":[62],"diverse":[63],"networks.":[64],"We":[65,84,108],"find":[66],"that":[67],"individual":[68],"origins":[69,87],"miss":[70],"an":[71],"average":[72],"1.6-8.4%":[73],"1.5-4.6%":[76],"8.3-18.2%":[80],"hosts.":[83],"why":[86],"see":[88],"different":[89],"hosts,":[90],"show":[92],"permanent":[94],"temporary":[96],"blocking,":[97],"packet":[98],"loss,":[99],"geographic":[100],"biases,":[101],"transient":[103],"outages":[104],"affect":[105],"results.":[107],"discuss":[109],"implications":[111],"for":[112,117],"provide":[115],"recommendations":[116],"future":[118],"studies.":[119]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2025,"cited_by_count":12},{"year":2024,"cited_by_count":9},{"year":2023,"cited_by_count":13},{"year":2022,"cited_by_count":9},{"year":2021,"cited_by_count":9}],"updated_date":"2026-04-10T15:06:20.359241","created_date":"2025-10-10T00:00:00"}