@InProceedings{Fukuda18a,
        author =        "Kensuke Fukuda and John Heidemann",
        title =         "Who Knocks at the IPv6 Door? Detecting IPv6 Scanning",
        booktitle =     "Proceedings of the " # "ACM Internet Measurement Conference",
        year =          2018,
	sortdate = "2018-10-31",
	project = "ant, divoice, lacanic, nipet, researchroot, pinest",
	jsubject = "dns",
	jlocation = 	"johnh: pafile",
        xpages =      "to appear",
        month =      oct,
        address =    2018,
        publisher =  "ACM",
	url =		"https://ant.isi.edu/%7ejohnh/PAPERS/Fukuda18a.html",
	pdfurl =	"https://ant.isi.edu/%7ejohnh/PAPERS/Fukuda18a.pdf",
	dataurl =	"https://ant.isi.edu/datasets/dns_backscatter/#Fukuda18a_data",
	blogurl = "https://ant.isi.edu/blog/?p=1284",
	myorganization =	"USC/Information Sciences Institute",
	copyrightholder = "authors",
        jlocation =   "johnh: pafile",
	keywords = 	"dns, backscatter",
        doi =        "https://doi.org/10.1145/3278532.3278553",
	abstract = "DNS backscatter detects internet-wide activity by looking for common
reverse DNS lookups at authoritative DNS servers that are high in the
DNS hierarchy.  Both DNS backscatter and monitoring unused address
space (darknets or network telescopes) can detect scanning in IPv4,
but with IPv6's vastly larger address space, darknets become much less
effective.  This paper shows how to adapt DNS backscatter to IPv6.
IPv6 requires new classification rules, but these reveal large network
services, from cloud providers and CDNs to specific services such as
NTP and mail.  DNS backscatter also identifies router interfaces
suggesting traceroute-based topology studies.  We identify 16 scanners
per week from DNS backscatter using observations from the B-root DNS
server, with confirmation from backbone traffic observations or
blacklists.  After eliminating benign services, we classify another 95
originators in DNS backscatter as potential abuse.  Our work also
confirms that IPv6 appears to be less carefully monitored than IPv4.",
}

{"_id":"5TehPSRkN5p7wQzfh","bibbaseid":"fukuda-heidemann-whoknocksattheipv6doordetectingipv6scanning-2018","author_short":["Fukuda, K.","Heidemann, J."],"bibdata":{"bibtype":"inproceedings","type":"inproceedings","author":[{"firstnames":["Kensuke"],"propositions":[],"lastnames":["Fukuda"],"suffixes":[]},{"firstnames":["John"],"propositions":[],"lastnames":["Heidemann"],"suffixes":[]}],"title":"Who Knocks at the IPv6 Door? Detecting IPv6 Scanning","booktitle":"Proceedings of the ACM Internet Measurement Conference","year":"2018","sortdate":"2018-10-31","project":"ant, divoice, lacanic, nipet, researchroot, pinest","jsubject":"dns","jlocation":"johnh: pafile","xpages":"to appear","month":"October","address":"2018","publisher":"ACM","url":"https://ant.isi.edu/%7ejohnh/PAPERS/Fukuda18a.html","pdfurl":"https://ant.isi.edu/%7ejohnh/PAPERS/Fukuda18a.pdf","dataurl":"https://ant.isi.edu/datasets/dns_backscatter/#Fukuda18a_data","blogurl":"https://ant.isi.edu/blog/?p=1284","myorganization":"USC/Information Sciences Institute","copyrightholder":"authors","keywords":"dns, backscatter","doi":"https://doi.org/10.1145/3278532.3278553","abstract":"DNS backscatter detects internet-wide activity by looking for common reverse DNS lookups at authoritative DNS servers that are high in the DNS hierarchy. Both DNS backscatter and monitoring unused address space (darknets or network telescopes) can detect scanning in IPv4, but with IPv6's vastly larger address space, darknets become much less effective. This paper shows how to adapt DNS backscatter to IPv6. IPv6 requires new classification rules, but these reveal large network services, from cloud providers and CDNs to specific services such as NTP and mail. DNS backscatter also identifies router interfaces suggesting traceroute-based topology studies. We identify 16 scanners per week from DNS backscatter using observations from the B-root DNS server, with confirmation from backbone traffic observations or blacklists. After eliminating benign services, we classify another 95 originators in DNS backscatter as potential abuse. Our work also confirms that IPv6 appears to be less carefully monitored than IPv4.","bibtex":"@InProceedings{Fukuda18a,\n author = \"Kensuke Fukuda and John Heidemann\",\n title = \"Who Knocks at the IPv6 Door? Detecting IPv6 Scanning\",\n booktitle = \"Proceedings of the \" # \"ACM Internet Measurement Conference\",\n year = 2018,\n\tsortdate = \"2018-10-31\",\n\tproject = \"ant, divoice, lacanic, nipet, researchroot, pinest\",\n\tjsubject = \"dns\",\n\tjlocation = \t\"johnh: pafile\",\n xpages = \"to appear\",\n month = oct,\n address = 2018,\n publisher = \"ACM\",\n\turl =\t\t\"https://ant.isi.edu/%7ejohnh/PAPERS/Fukuda18a.html\",\n\tpdfurl =\t\"https://ant.isi.edu/%7ejohnh/PAPERS/Fukuda18a.pdf\",\n\tdataurl =\t\"https://ant.isi.edu/datasets/dns_backscatter/#Fukuda18a_data\",\n\tblogurl = \"https://ant.isi.edu/blog/?p=1284\",\n\tmyorganization =\t\"USC/Information Sciences Institute\",\n\tcopyrightholder = \"authors\",\n jlocation = \"johnh: pafile\",\n\tkeywords = \t\"dns, backscatter\",\n doi = \"https://doi.org/10.1145/3278532.3278553\",\n\tabstract = \"DNS backscatter detects internet-wide activity by looking for common\nreverse DNS lookups at authoritative DNS servers that are high in the\nDNS hierarchy. Both DNS backscatter and monitoring unused address\nspace (darknets or network telescopes) can detect scanning in IPv4,\nbut with IPv6's vastly larger address space, darknets become much less\neffective. This paper shows how to adapt DNS backscatter to IPv6.\nIPv6 requires new classification rules, but these reveal large network\nservices, from cloud providers and CDNs to specific services such as\nNTP and mail. DNS backscatter also identifies router interfaces\nsuggesting traceroute-based topology studies. We identify 16 scanners\nper week from DNS backscatter using observations from the B-root DNS\nserver, with confirmation from backbone traffic observations or\nblacklists. After eliminating benign services, we classify another 95\noriginators in DNS backscatter as potential abuse. Our work also\nconfirms that IPv6 appears to be less carefully monitored than IPv4.\",\n}\n\n","author_short":["Fukuda, K.","Heidemann, J."],"bibbaseid":"fukuda-heidemann-whoknocksattheipv6doordetectingipv6scanning-2018","role":"author","urls":{"Paper":"https://ant.isi.edu/%7ejohnh/PAPERS/Fukuda18a.html"},"keyword":["dns","backscatter"],"metadata":{"authorlinks":{}}},"bibtype":"inproceedings","biburl":"https://bibbase.org/f/dHevizJoWEhWowz8q/johnh-2023-2.bib","dataSources":["YLyu3mj3xsBeoqiHK","fLZcDgNSoSuatv6aX","fxEParwu2ZfurScPY","7nuQvtHTqKrLmgu99"],"keywords":["dns","backscatter"],"search_terms":["knocks","ipv6","door","detecting","ipv6","scanning","fukuda","heidemann"],"title":"Who Knocks at the IPv6 Door? Detecting IPv6 Scanning","year":2018}