An Area-Aware Efficient Internet-Wide Port Scan Approach for IoT

Internet of Things (IoT) devices usually face some difficulty in supporting complex security protocols or intrusion-prevention mechanisms, due to their limited system resources. As a result, IoT devices are fraught with significant security vulnerabilities and are vulnerable to cyberattacks. Correspondingly, the Internet-wide port scan (IWPS) technique has garnered significant attention for its ability to discover and probe Internet-wide connected IoT devices. However, the existing scanners for IWPSs are often not satisfactory in terms of scan efficiency. Improving the scan rate is an important avenue in IWPS research. In this paper, we found, through experimental analysis, that the regional characteristics of scanners greatly affect the scan rate. Based on this, we then proposed an area-aware IWPS approach, to improve scan efficiency. Firstly, we clustered the scanners according to the region, and we built an average delay table for each cluster. The average delay table records the average time delay for scanners in the cluster to detect IP addresses in different regions. Secondly, to avoid wasting resources, we also designed a two-layer balancing mechanism, to ensure the workload balance of the system. Finally, we performed extensive experiments on a real platform to demonstrate the effectiveness of our algorithm. The scan rate of our proposed approach improved compared to that of the most popular open scan tool, Nmap, by 3–4 times, and the detection accuracy increased by 8%.