识别和表征ZMap扫描：密码分析方法
Identifying and characterizing ZMap scans: a cryptanalytic approach
摘要：
网络扫描工具在互联网安全中发挥着重要作用。它们被网络安全研究人员和恶意行为者用来识别暴露在互联网上的易受攻击的机器。ZMap是用于高速互联网范围扫描的最常见的探测工具之一。我们提出了新的识别方法的IPv4迭代过程的ZMap的基础上。这些方法可用于识别ZMap扫描，并从扫描中提取少量地址。我们对这些检测方法在合成、网络望远镜和骨干流量上进行了实验评估。我们能够识别出现实世界流量中28.5%的ZMap扫描。然后，我们对这些扫描进行深入的表征，例如，目标前缀和探测速度。
英文摘要：
Network scanning tools play a major role in Internet security. They are used by both network security researchers and malicious actors to identify vulnerable machines exposed on the Internet. ZMap is one of the most common probing tools for high-speed Internet-wide scanning. We present novel identification methods based on the IPv4 iteration process of ZMap. These methods can be used to identify ZMap scans with a small number of addresses extracted from the scan. We conduct an experimental evaluation of these detection methods on synthetic, network telescope, and backbone traffic. We manage to identify 28.5% of the ZMap scans in real-world traffic. We then perform an in-depth characterization of these scans regarding, for example, targeted prefix and probing speed.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
