<?xml version="1.0" encoding="utf-8"?>
<TEI xmlns="http://www.tei-c.org/ns/1.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:hal="http://hal.archives-ouvertes.fr/" xmlns:gml="http://www.opengis.net/gml/3.3/" xmlns:gmlce="http://www.opengis.net/gml/3.3/ce" version="1.1" xsi:schemaLocation="http://www.tei-c.org/ns/1.0 http://api.archives-ouvertes.fr/documents/aofr-sword.xsd">
  <teiHeader>
    <fileDesc>
      <titleStmt>
        <title>HAL TEI export of hal-01411192</title>
      </titleStmt>
      <publicationStmt>
        <distributor>CCSD</distributor>
        <availability status="restricted">
          <licence target="https://creativecommons.org/publicdomain/zero/1.0/">CC0 1.0 - Universal</licence>
        </availability>
        <date when="2026-05-16T19:05:00+02:00"/>
      </publicationStmt>
      <sourceDesc>
        <p part="N">HAL API Platform</p>
      </sourceDesc>
    </fileDesc>
  </teiHeader>
  <text>
    <body>
      <listBibl>
        <biblFull>
          <titleStmt>
            <title xml:lang="en">How Dangerous Is Internet Scanning?</title>
            <author role="aut">
              <persName>
                <forename type="first">Elias</forename>
                <surname>Raftopoulos</surname>
              </persName>
              <email type="md5">cff930358630daa0850d98f3a38fbac3</email>
              <email type="domain">tik.ee.ethz.ch</email>
              <idno type="idhal" notation="numeric">995525</idno>
              <idno type="halauthorid" notation="string">1090341-995525</idno>
              <affiliation ref="#struct-180925"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Eduard</forename>
                <surname>Glatz</surname>
              </persName>
              <idno type="halauthorid">1090342-0</idno>
              <affiliation ref="#struct-180925"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Xenofontas</forename>
                <surname>Dimitropoulos</surname>
              </persName>
              <idno type="halauthorid">497958-0</idno>
              <affiliation ref="#struct-180925"/>
              <affiliation ref="#struct-49023"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Alberto</forename>
                <surname>Dainotti</surname>
              </persName>
              <idno type="halauthorid">913941-0</idno>
              <affiliation ref="#struct-300717"/>
            </author>
            <editor role="depositor">
              <persName>
                <forename>Hal</forename>
                <surname>Ifip</surname>
              </persName>
              <email type="md5">2073ac78024b6e13f2714db96e9b1e63</email>
              <email type="domain">inria.fr</email>
            </editor>
          </titleStmt>
          <editionStmt>
            <edition n="v1" type="current">
              <date type="whenSubmitted">2016-12-07 10:55:11</date>
              <date type="whenModified">2024-11-19 14:04:09</date>
              <date type="whenReleased">2016-12-07 11:00:28</date>
              <date type="whenProduced">2015-04-21</date>
              <date type="whenEndEmbargoed">2018-01-01</date>
              <ref type="file" target="https://hal.science/hal-01411192v1/document">
                <date notBefore="2018-01-01"/>
              </ref>
              <ref type="file" subtype="author" n="1" target="https://hal.science/hal-01411192v1/file/336978_1_En_11_Chapter.pdf" id="file-1411192-1497008">
                <date notBefore="2018-01-01"/>
              </ref>
              <ref type="externalLink" target="https://hal.archives-ouvertes.fr/hal-01411192/file/336978_1_En_11_Chapter.pdf"/>
            </edition>
            <respStmt>
              <resp>contributor</resp>
              <name key="200187">
                <persName>
                  <forename>Hal</forename>
                  <surname>Ifip</surname>
                </persName>
                <email type="md5">2073ac78024b6e13f2714db96e9b1e63</email>
                <email type="domain">inria.fr</email>
              </name>
            </respStmt>
          </editionStmt>
          <publicationStmt>
            <distributor>CCSD</distributor>
            <idno type="halId">hal-01411192</idno>
            <idno type="halUri">https://hal.science/hal-01411192</idno>
            <idno type="halBibtex">raftopoulos:hal-01411192</idno>
            <idno type="halRefHtml">&lt;i&gt;7th Workshop on Traffic Monitoring and Analysis (TMA)&lt;/i&gt;, Apr 2015, Barcelona, Spain. pp.158-172, &lt;a target="_blank" href="https://dx.doi.org/10.1007/978-3-319-17172-2_11"&gt;&amp;#x27E8;10.1007/978-3-319-17172-2_11&amp;#x27E9;&lt;/a&gt;</idno>
            <idno type="halRef">7th Workshop on Traffic Monitoring and Analysis (TMA), Apr 2015, Barcelona, Spain. pp.158-172, &amp;#x27E8;10.1007/978-3-319-17172-2_11&amp;#x27E9;</idno>
            <availability status="restricted">
              <licence target="https://creativecommons.org/licenses/by/4.0/">CC BY 4.0 - Attribution<ref corresp="#file-1411192-1497008"/></licence>
            </availability>
          </publicationStmt>
          <seriesStmt>
            <idno type="stamp" n="IFIP-LNCS" corresp="IFIP">IFIP - Lecture Notes in Computer Science</idno>
            <idno type="stamp" n="IFIP">IFIP - International Federation for Information Processing</idno>
            <idno type="stamp" n="IFIP-TC" corresp="IFIP">IFIP Technical Committees </idno>
            <idno type="stamp" n="IFIP-TC6" corresp="IFIP-TC">TC 6: Communication Systems</idno>
            <idno type="stamp" n="IFIP-TMA">IFIP-TMA</idno>
            <idno type="stamp" n="IFIP-WG6-6">Management of Networks and Distributed Systems</idno>
            <idno type="stamp" n="IFIP-LNCS-9053" corresp="IFIP-LNCS">Traffic Monitoring and Analysis</idno>
          </seriesStmt>
          <notesStmt>
            <note type="commentary">Part 4: Security</note>
            <note type="audience" n="2">International</note>
            <note type="invited" n="0">No</note>
            <note type="popular" n="0">No</note>
            <note type="peer" n="1">Yes</note>
            <note type="proceedings" n="1">Yes</note>
          </notesStmt>
          <sourceDesc>
            <biblStruct>
              <analytic>
                <title xml:lang="en">How Dangerous Is Internet Scanning?</title>
                <author role="aut">
                  <persName>
                    <forename type="first">Elias</forename>
                    <surname>Raftopoulos</surname>
                  </persName>
                  <email type="md5">cff930358630daa0850d98f3a38fbac3</email>
                  <email type="domain">tik.ee.ethz.ch</email>
                  <idno type="idhal" notation="numeric">995525</idno>
                  <idno type="halauthorid" notation="string">1090341-995525</idno>
                  <affiliation ref="#struct-180925"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Eduard</forename>
                    <surname>Glatz</surname>
                  </persName>
                  <idno type="halauthorid">1090342-0</idno>
                  <affiliation ref="#struct-180925"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Xenofontas</forename>
                    <surname>Dimitropoulos</surname>
                  </persName>
                  <idno type="halauthorid">497958-0</idno>
                  <affiliation ref="#struct-180925"/>
                  <affiliation ref="#struct-49023"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Alberto</forename>
                    <surname>Dainotti</surname>
                  </persName>
                  <idno type="halauthorid">913941-0</idno>
                  <affiliation ref="#struct-300717"/>
                </author>
              </analytic>
              <monogr>
                <title level="m">Lecture Notes in Computer Science</title>
                <meeting>
                  <title>7th Workshop on Traffic Monitoring and Analysis (TMA)</title>
                  <date type="start">2015-04-21</date>
                  <date type="end">2015-04-24</date>
                  <settlement>Barcelona</settlement>
                  <country key="ES">Spain</country>
                </meeting>
                <editor>Moritz Steiner</editor>
                <editor>Pere Barlet-Ros</editor>
                <editor>Olivier Bonaventure</editor>
                <imprint>
                  <biblScope unit="serie">Traffic Monitoring and Analysis</biblScope>
                  <biblScope unit="volume">LNCS-9053</biblScope>
                  <biblScope unit="pp">158-172</biblScope>
                  <date type="datePub">2015</date>
                </imprint>
              </monogr>
              <idno type="doi">10.1007/978-3-319-17172-2_11</idno>
            </biblStruct>
          </sourceDesc>
          <profileDesc>
            <langUsage>
              <language ident="en">English</language>
            </langUsage>
            <textClass>
              <keywords scheme="author">
                <term xml:lang="en">Netflow</term>
                <term xml:lang="en">IDS</term>
                <term xml:lang="en">Network scanning</term>
                <term xml:lang="en">Botnet characterization</term>
              </keywords>
              <classCode scheme="halDomain" n="info">Computer Science [cs]</classCode>
              <classCode scheme="halDomain" n="info.info-ni">Computer Science [cs]/Networking and Internet Architecture [cs.NI]</classCode>
              <classCode scheme="halTypology" n="COMM">Conference papers</classCode>
              <classCode scheme="halOldTypology" n="COMM">Conference papers</classCode>
              <classCode scheme="halTreeTypology" n="COMM">Conference papers</classCode>
            </textClass>
            <abstract xml:lang="en">
              <p>Internet scanning is a de facto background traffic noise that is not clear if it poses a dangerous threat, i.e., what happens to scanned hosts? what is the success rate of scanning? and whether the problem is worth investing significant effort and money on mitigating it, e.g., by filtering unwanted traffic? In this work we take a first look into Internet scanning from the point of view of scan repliers using a unique combination of data sets which allows us to estimate how many hosts replied to scanners and whether they were subsequently attacked in an actual network. To contain our analysis, we focus on a specific interesting scanning event that was orchestrated by the Sality botnet during February 2011 which scanned the entire IPv4 address space. By analyzing unsampled NetFlow records, we show that 2 % of the scanned hosts actually replied to the scanners. Moreover, by correlating scan replies with IDS alerts from the same network, we show that significant exploitation activity followed towards the repliers, which eventually led to an estimated 8 % of compromised repliers. These observations suggest that Internet scanning is dangerous: in our university network, at least 142 scanned hosts were eventually compromised. World-wide, the number of hosts that were compromised in response to the studied event is likely much larger.</p>
            </abstract>
            <particDesc>
              <org type="consortium">TC 6</org>
              <org type="consortium">WG 6.6</org>
            </particDesc>
          </profileDesc>
        </biblFull>
      </listBibl>
    </body>
    <back>
      <listOrg type="structures">
        <org type="institution" xml:id="struct-180925" status="VALID">
          <idno type="ROR">https://ror.org/05a28rw58</idno>
          <orgName>Eidgenössische Technische Hochschule - Swiss Federal Institute of Technology  [Zürich]</orgName>
          <orgName type="acronym">ETH Zürich</orgName>
          <desc>
            <address>
              <addrLine>Hauptgebäude, Rämistrasse 101, 8092 Zürich</addrLine>
              <country key="CH"/>
            </address>
            <ref type="url">https://www.ethz.ch/</ref>
          </desc>
        </org>
        <org type="laboratory" xml:id="struct-49023" status="VALID">
          <orgName>Institute of Computer Science [FORTH, Heraklion]</orgName>
          <orgName type="acronym">ICS-FORTH</orgName>
          <date type="start">1983-01-01</date>
          <desc>
            <address>
              <addrLine>Foundation for Research and Technology - Hellas (FORTH)Institute of Computer Science N. Plastira 100, Vassilika Vouton, GR-700 13 Heraklion, Crete</addrLine>
              <country key="GR"/>
            </address>
            <ref type="url">https://www.ics.forth.gr/</ref>
          </desc>
          <listRelation>
            <relation active="#struct-307779" type="direct"/>
          </listRelation>
        </org>
        <org type="institution" xml:id="struct-300717" status="VALID">
          <idno type="IdRef">035478462</idno>
          <idno type="ROR">https://ror.org/0168r3w48</idno>
          <orgName>University of California [San Diego]</orgName>
          <orgName type="acronym">UC San Diego</orgName>
          <desc>
            <address>
              <addrLine>UCSD, 9500 Gilman Dr., La Jolla, CA 92093 USA</addrLine>
              <country key="US"/>
            </address>
            <ref type="url">https://ucsd.edu/</ref>
          </desc>
          <listRelation>
            <relation active="#struct-471291" type="direct"/>
          </listRelation>
        </org>
        <org type="institution" xml:id="struct-307779" status="VALID">
          <idno type="ROR">https://ror.org/052rphn09</idno>
          <orgName>Foundation for Research and Technology - Hellas</orgName>
          <orgName type="acronym">FORTH</orgName>
          <date type="start">1987</date>
          <desc>
            <address>
              <addrLine>100 Nikolaou Plastira str., Vassilika Vouton, Heraklion, Crete GR  700 13</addrLine>
              <country key="GR"/>
            </address>
            <ref type="url">http://www.forth.gr/</ref>
          </desc>
        </org>
        <org type="regroupinstitution" xml:id="struct-471291" status="VALID">
          <idno type="ROR">https://ror.org/00pjdza24</idno>
          <orgName>University of California</orgName>
          <orgName type="acronym">UC</orgName>
          <date type="start">1869-01-01</date>
          <desc>
            <address>
              <country key="US"/>
            </address>
            <ref type="url">https://www.universityofcalifornia.edu/</ref>
          </desc>
        </org>
      </listOrg>
    </back>
  </text>
</TEI>