LZR：识别意外的Internet服务
LZR: Identifying Unexpected Internet Services
摘要：
互联网范围内的扫描是一种常用的研究技术，有助于发现现实世界的攻击，发现加密弱点，并了解操作员和不法行为。采用扫描的研究在很大程度上假设服务托管在IANA分配的端口上，忽略了对不寻常端口上服务的研究。在这项工作中，我们调查在实践中部署的互联网服务，并评估意外端口上的服务的安全态势。我们发现协议部署比以前认为的更分散，协议运行在许多额外的端口上，超出了他们的主要IANA分配的端口。例如，只有3%的HTTP和6%的TLS服务分别在端口80和443上运行。非标准端口上的服务更有可能是不安全的，这导致研究大大低估了互联网主机的安全态势。基于我们的观察，我们引入了LZR（“激光”），这是一种在五次握手中识别99%可识别的意外服务的系统，并大大减少了对具有很少响应的预期服务（例如，在27017/MongoDB上加速5500%）。最后，我们对未来的研究提出了建议。
英文摘要：
Internet-wide scanning is a commonly used research technique that has helped uncover real-world attacks, find cryptographic weaknesses, and understand both operator and miscreant behavior. Studies that employ scanning have largely assumed that services are hosted on their IANA-assigned ports, overlooking the study of services on unusual ports. In this work, we investigate where Internet services are deployed in practice and evaluate the security posture of services on unexpected ports. We show protocol deployment is more diffuse than previously believed and that protocols run on many additional ports beyond their primary IANA-assigned port. For example, only 3% of HTTP and 6% of TLS services run on ports 80 and 443, respectively. Services on non-standard ports are more likely to be insecure, which results in studies dramatically underestimating the security posture of Internet hosts. Building on our observations, we introduce LZR ("Laser"), a system that identifies 99% of identifiable unexpected services in five handshakes and dramatically reduces the time needed to perform application-layer scans on ports with few responsive expected services (e.g., 5500% speedup on 27017/MongoDB). We conclude with recommendations for future studies.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
