Attack or Noise?: Tracking and Evaluating the Impact of Internet-Wide Survey Scanners
summary
A darknet of ~300,000 unused IPv4 addresses collects packets and a real‑time methodology classifies survey‑scanner traffic, links it to organizations, and validates via banner, DNS and honeypot correlation. Results show 75+ active scanning organizations, 221.5 billion packets in 90 days, scanners produce ~32% of firewall logs and ~40% of IDS alerts (≈100 GB/day), and three vendors account for ~70% of scanner alerts. A quarterly GitHub list and SIEM lookup tables reduce false investigations.
AI-written summary · about
chapters (15)
- 0:00Internet-wide scanner impact
- 1:32Scanner problems
- 6:20Scanner intelligence from darknet
- 10:45Detecting and analyzing scanners
- 14:19Scanning organizations by activity
- 16:46Major scanning organizations analyzed
- 21:25Port coverage patterns
- 24:37Cloud infrastructure by scanners
- 26:26Unknown scanners with honeypots
- 28:38Scanner data in SOC workflows
- 30:46Scanner impact on firewall/IDS logs
- 34:02Scanner timing and filtering
- 36:33Scanner attribution challenges
- 38:43Recommendations for operators and defenders
- 40:08Key takeaways and future work
related talks
26mInternet Scanning - Current State and Lessons Learned
41mInternet Spelunking: IPv6 Scanning and Device Fingerprinting
24mImproving Internet-Wide Scanning with Dynamic Scanning
51mHelpful Hackers
29mThe Ever-Changing Labyrinth: A Large-Scale Analysis of Wildcard DNS Powered...
32mSomething’s Phishy: See the Hook Before the Bait
52mInvestigating DDOS - Architecture Actors and Attribution
18mSchrödinger’s RAT: Profiling Stakeholders in the Remote Access Trojan Ecosystem