在黑暗中发光揭示IPv6地址发现和扫描策略
Glowing in the Dark Uncovering IPv6 Address Discovery and Scanning Strategies in the Wild
摘要：
在这项工作中，我们确定在互联网上的IPv6扫描器的扫描策略。我们提供了一个独特的角度对IPv6扫描仪的行为进行控制实验，利用一个大的和未使用的/56 IPv6子网。我们通过托管与Internet上支持IPv6的服务器直接或间接联系的应用程序，有选择地使部分子网对扫描器可见。通过仔细的实验设计，我们减轻了隐变量对发送到我们的/56子网的扫描的影响，并建立了IPv6主机活动类型和它们引起的扫描仪注意之间的因果关系。我们表明，IPv6主机活动，例如，网络浏览、NTP池和Tor网络中的成员身份，导致扫描程序向我们的子网发送比以前更多的未经请求的IP扫描和反向DNS查询。DNS扫描器将其扫描集中在我们的应用程序托管的地址空间的狭窄区域，而IP扫描器则广泛扫描整个子网。即使在我们的子网中的主机活动消退之后，我们也会观察到对以前托管应用程序的地址空间部分的持续残留扫描
英文摘要：
In this work we identify scanning strategies of IPv6 scanners on the Internet. We offer a unique perspective on the behavior of IPv6 scanners by conducting controlled experiments leveraging a large and unused /56 IPv6 subnet. We selectively make parts of the subnet visible to scanners by hosting applications that make direct or indirect contact with IPv6- capable servers on the Internet. By careful experiment design, we mitigate the effects of hidden variables on scans sent to our /56 subnet and establish causal relationships between IPv6 host activity types and the scanner attention they evoke. We show that IPv6 host activities e.g., Web browsing, membership in the NTP pool and Tor network, cause scanners to send a magnitude higher number of unsolicited IP scans and reverse DNS queries to our subnet than before. DNS scanners focus their scans in narrow regions of the address space where our applications are hosted whereas IP scanners broadly scan the entire subnet. Even after the host activity from our subnet subsides, we observe persistent residual scanning to portions of the address space that previously hosted applications
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
