Abstract: Network scanning is a common technique for discovering hosts and devices connected to the Internet. When a new vulnerability is found, both benign and malicious actors begin Internet-wide scans to determine how many hosts are affected. While IPv4 network scans are pretty straightforward and have been extensively studied with honeypot and darknet, detecting network-wide scans in IPv6 remains challenging due to its enormous address space (2^128). In this talk, we will introduce our recent efforts to detect and characterize Internet-wide scans in both IPv4 and IPv6 networks.
