Internet Scan Source Identification: A Survey

Recently, Internet scanning activities have increased significantly, while the purposes and impacts of these scans have grown increasingly complex. Organizations dedicated to enhancing Internet security, as well as malicious ones, both conduct frequent and systematic scans across the entire IPv4 address space and partial IPv6 address space. In this context, the scan source identification, on which scan intelligence relies, is crucial as it supports in-depth analysis of the scanning behavior of organizations and helps uncover the real identity and size of potential attack organizations. In this article, we provide an extensive survey on Internet scan source identification. We summarize the common methodology and propose a taxonomy for classification. Based on this taxonomy, we outline the current state of Internet scan source identification research. Furthermore, we identify existing challenges and suggest future directions in this field.