{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,12,18]],"date-time":"2025-12-18T14:08:53Z","timestamp":1766066933953,"version":"3.28.0"},"reference-count":43,"publisher":"IEEE","content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2018,4]]},"DOI":"10.1109\/infocom.2018.8486426","type":"proceedings-article","created":{"date-parts":[[2018,10,18]],"date-time":"2018-10-18T18:45:36Z","timestamp":1539888336000},"page":"2069-2077","source":"Crossref","is-referenced-by-count":7,"title":["ONIS: Inferring TCP\/IP-based Trust Relationships Completely Off-Path"],"prefix":"10.1109","author":[{"given":"Xu","family":"Zhang","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Jeffrey","family":"Knockel","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Jedidiah R.","family":"Crandall","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"263","reference":[{"key":"ref39","first-page":"2","article-title":"Fragmentation considered vulnerable: blindly intercepting and discarding fragments","author":"gilad","year":"2011","journal-title":"Proceedings of the 5th USENIX Conference on Offensive Technologies USENIX Association"},{"key":"ref38","doi-asserted-by":"crossref","first-page":"100","DOI":"10.1007\/978-3-642-31680-7_6","article-title":"Spying in the dark: Tcp and tor traffic analysis","author":"gilad","year":"2012","journal-title":"International Symposium on Privacy Enhancing Technologies Symposium"},{"key":"ref33","doi-asserted-by":"crossref","first-page":"108","DOI":"10.1007\/978-3-540-31966-5_9","article-title":"Exploiting the IPID field to infer network path and end-system characteristics","author":"chen","year":"2005","journal-title":"Passive and Active Network Measurement"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1145\/2382196.2382258"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2012.29"},{"journal-title":"TCP Idle Scans in IPv6","year":"2013","author":"morbitzer","key":"ref30"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1145\/3078505.3078510"},{"key":"ref36","first-page":"209","article-title":"Off-path tcp exploits: Global rate limit considered dangerous","author":"cao","year":"0","journal-title":"25th USENIX Security Symposium (USENIX Security 16) USENIX Association"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2005.26"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1145\/637201.637243"},{"key":"ref10","first-page":"257","article-title":"Idle port scanning and non-interference analysis of network protocol stacks using model checking","author":"ensafi","year":"2010","journal-title":"USENIX Security Symposium"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1145\/2597173"},{"key":"ref11","doi-asserted-by":"crossref","first-page":"109","DOI":"10.1007\/978-3-319-04918-2_11","article-title":"Detecting intentional packet drops on the Internet via TCP\/IP side channels","author":"ensafi","year":"2014","journal-title":"Passive and Active Measurement"},{"key":"ref12","article-title":"Detecting intentional packet drops on the Internet via TCP\/IP side channels: Extended version","volume":"abs 1312 5739","author":"ensafi","year":"2013","journal-title":"CoRR"},{"journal-title":"FTP-bounce","year":"0","key":"ref13"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.3233\/JCS-2002-101-205"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1109\/ISCC.2006.142"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1109\/NOMS.2002.1015594"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1109\/TNET.2011.2109009"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1007\/11663812_14"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1109\/SECPRI.2004.1301325"},{"journal-title":"Zmap","year":"0","key":"ref28"},{"journal-title":"inetpeer get rid of ip_id_count","year":"2014","author":"dumazet","key":"ref4"},{"journal-title":"Unicorn Scan","year":"0","key":"ref27"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1109\/INFOCOM.2015.7218441"},{"journal-title":"ip make ip identifiers less predictable","year":"2014","author":"dumazet","key":"ref6"},{"journal-title":"MASSCAN Mass IP port scanner","year":"0","key":"ref29"},{"key":"ref5","article-title":"Counting packets sent between arbitrary internet hosts","author":"knockel","year":"2014","journal-title":"USENIX Workshop on Free and Open Communication on the Internet (FOCI)"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.17487\/rfc0793"},{"journal-title":"Counting packets sent between arbitrary internet hosts (slides)","year":"2014","author":"knockel","key":"ref7"},{"journal-title":"Detecting intentional packet drops on the Internet via TCP\/IP side channels","year":"0","author":"ensafi","key":"ref2"},{"journal-title":"RFC 791 Internet Protocol","year":"1981","author":"postel","key":"ref9"},{"journal-title":"Posted to the bugtraq mailing list","article-title":"new tcp scan method","year":"1998","key":"ref1"},{"key":"ref20","first-page":"646","article-title":"Detection of TCP SYN scanning using packet counts and neural network","author":"soniya","year":"2008","journal-title":"Signal Image Technology and Internet Based Systems 2008 SITIS'08 IEEE International Conference on"},{"key":"ref22","first-page":"3178","article-title":"The research and implementation of intelligent intrusion detection system based on artificial neural network","volume":"5","author":"li","year":"2004","journal-title":"Machine Learning and Cybernetics 2004 Proceedings of 2004 International Conference on"},{"key":"ref21","first-page":"368","article-title":"Artificial neural networks for misuse detection","author":"cannady","year":"1998","journal-title":"National Information Systems Security Conference"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1145\/2486001.2486036"},{"key":"ref24","article-title":"Coordinated Scan Detection","author":"gates","year":"2009","journal-title":"NDSS"},{"key":"ref41","first-page":"15","article-title":"Reverse traceroute","author":"katz-bassett","year":"2010","journal-title":"Proceedings of the 7th USENIX Conference on Networked Systems Design and Implementation Ser NSDI'10"},{"journal-title":"Co-ordinated port scans A model a detector and an evaluation methodology","year":"2006","author":"gates","key":"ref23"},{"journal-title":"Scanrand","year":"0","key":"ref26"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1145\/2398776.2398804"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-73614-1_10"}],"event":{"name":"IEEE INFOCOM 2018 - IEEE Conference on Computer Communications","start":{"date-parts":[[2018,4,16]]},"location":"Honolulu, HI","end":{"date-parts":[[2018,4,19]]}},"container-title":["IEEE INFOCOM 2018 - IEEE Conference on Computer Communications"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/8464035\/8485803\/08486426.pdf?arnumber=8486426","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2022,1,26]],"date-time":"2022-01-26T17:13:37Z","timestamp":1643217217000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/8486426\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2018,4]]},"references-count":43,"URL":"https:\/\/doi.org\/10.1109\/infocom.2018.8486426","relation":{},"subject":[],"published":{"date-parts":[[2018,4]]}}}