{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,12,22]],"date-time":"2025-12-22T22:27:28Z","timestamp":1766442448256,"version":"3.48.0"},"publisher-location":"New York, NY, USA","reference-count":69,"publisher":"ACM","funder":[{"name":"National Key R&D Program of China","award":["2022YFB3102902"],"award-info":[{"award-number":["2022YFB3102902"]}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62172251"],"award-info":[{"award-number":["62172251"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2025,11,19]]},"DOI":"10.1145\/3719027.3765053","type":"proceedings-article","created":{"date-parts":[[2025,11,22]],"date-time":"2025-11-22T23:37:25Z","timestamp":1763854645000},"page":"4604-4618","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":0,"title":["ScannerGrouper: A Generalizable and Effective Scanning Organization Identification System Toward the Open World"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0009-0008-2562-8124","authenticated-orcid":false,"given":"Xin","family":"He","sequence":"first","affiliation":[{"name":"Institute for Network Sciences and Cyberspace, Tsinghua University, Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2539-8241","authenticated-orcid":false,"given":"Enhuan","family":"Dong","sequence":"additional","affiliation":[{"name":"Institute for Network Sciences and Cyberspace, Tsinghua University, Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0004-5132-1696","authenticated-orcid":false,"given":"Jiyuan","family":"Han","sequence":"additional","affiliation":[{"name":"Institute for Network Sciences and Cyberspace, Tsinghua University, Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6587-820X","authenticated-orcid":false,"given":"Zhiliang","family":"Wang","sequence":"additional","affiliation":[{"name":"Institute for Network Sciences and Cyberspace, Tsinghua University, Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0000-0697-0778","authenticated-orcid":false,"given":"Hui","family":"Zhang","sequence":"additional","affiliation":[{"name":"Institute for Network Sciences and Cyberspace, Tsinghua University, Beijing, China and Quan Cheng Laboratory, Jinan, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0003-6302-5969","authenticated-orcid":false,"given":"Liang","family":"Liu","sequence":"additional","affiliation":[{"name":"Beihang University, Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0006-0898-1140","authenticated-orcid":false,"given":"Lianyi","family":"Sun","sequence":"additional","affiliation":[{"name":"Beijing Institute of Technology, Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0002-6930-5155","authenticated-orcid":false,"given":"Supei","family":"Zhang","sequence":"additional","affiliation":[{"name":"Institute for Network Sciences and Cyberspace, Tsinghua University, Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0001-8102-5239","authenticated-orcid":false,"given":"Pengfei","family":"Xue","sequence":"additional","affiliation":[{"name":"National University of Defense Technology, Hefei, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4736-6264","authenticated-orcid":false,"given":"Guanglei","family":"Song","sequence":"additional","affiliation":[{"name":"Institute for Network Sciences and Cyberspace, Tsinghua University, Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0006-2193-1578","authenticated-orcid":false,"given":"Han","family":"Li","sequence":"additional","affiliation":[{"name":"360 Technology Co., Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0006-5853-0559","authenticated-orcid":false,"given":"Xiaowen","family":"Quan","sequence":"additional","affiliation":[{"name":"WebRAY Tech (Beijing) Co., Ltd., Tsinghua University, Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6109-6737","authenticated-orcid":false,"given":"Jiahai","family":"Yang","sequence":"additional","affiliation":[{"name":"Institute for Network Sciences and Cyberspace, Tsinghua University, Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2025,11,22]]},"reference":[{"key":"e_1_3_2_2_1_1","unstructured":"AWS. 2025. AWS Cloud DNS service. https:\/\/aws.amazon.com\/cn\/route53\/."},{"key":"e_1_3_2_2_2_1","volume-title":"Homeland Security: Science and Technology","author":"Bailey Michael","year":"2012","unstructured":"Michael Bailey, Aaron Burstein, KC Claffy, and et al., 2012. The Menlo Report: Ethical Principles Guiding Information and Communication Technology Research. Homeland Security: Science and Technology (2012)."},{"key":"e_1_3_2_2_3_1","volume-title":"Practical Darknet Measurement. In 2006 40th Annual Conference on Information Sciences and Systems. IEEE, 1496-1501","author":"Bailey Michael","year":"2006","unstructured":"Michael Bailey, Evan Cooke, Farnam Jahanian, Andrew Myrick, and Sushant Sinha. 2006. Practical Darknet Measurement. In 2006 40th Annual Conference on Information Sciences and Systems. IEEE, 1496-1501."},{"key":"e_1_3_2_2_4_1","first-page":"1893","article-title":"Towards open world recognition","author":"Bendale Abhijit","year":"2015","unstructured":"Abhijit Bendale and Terrance Boult. 2015. Towards open world recognition. In IEEE CVPR. 1893-1902.","journal-title":"IEEE CVPR."},{"key":"e_1_3_2_2_5_1","unstructured":"CAIDA. 2025. The UCSD Network Telescope. http:\/\/www.caida.org\/projects\/network_telescope\/."},{"key":"e_1_3_2_2_6_1","volume-title":"Advances in Neural Information Processing Systems","volume":"13","author":"Cauwenberghs Gert","year":"2000","unstructured":"Gert Cauwenberghs and Tomaso Poggio. 2000. Incremental and decremental support vector machine learning. Advances in Neural Information Processing Systems, Vol. 13 (2000)."},{"key":"e_1_3_2_2_7_1","unstructured":"Censys. 2025. Censys Search Engine. https:\/\/search.censys.io."},{"key":"e_1_3_2_2_8_1","volume-title":"DANTE: A framework for mining and monitoring darknet traffic","author":"Cohen Dvir","year":"2020","unstructured":"Dvir Cohen, Yisroel Mirsky, Manuel Kamp, Tobias Martin, Yuval Elovici, Rami Puzis, and Asaf Shabtai. 2020. DANTE: A framework for mining and monitoring darknet traffic. In ESORICS. Springer, 88-109."},{"key":"e_1_3_2_2_9_1","first-page":"567","article-title":"Identifying and Differentiating Acknowledged Scanners in Network Traffic","author":"Collins M.","year":"2023","unstructured":"M. Collins, A. Hussain, and S. Schwab. 2023. Identifying and Differentiating Acknowledged Scanners in Network Traffic. In IEEE EuroS&PW. 567-574.","journal-title":"IEEE EuroS&PW."},{"key":"e_1_3_2_2_10_1","unstructured":"Connie-Wild. 2025. IP list of known scanners from Connie-Wild. https:\/\/github.com\/Connie-Wild\/scanner-ip-list."},{"key":"e_1_3_2_2_11_1","article-title":"Online passive-aggressive algorithms","volume":"7","author":"Crammer K.","year":"2006","unstructured":"K. Crammer, O. Dekel, J. Keshet, S. Shalev-Shwartz, and Y. Singer. 2006. Online passive-aggressive algorithms. Journal of Machine Learning Research, Vol. 7 (2006).","journal-title":"Journal of Machine Learning Research"},{"key":"e_1_3_2_2_12_1","first-page":"1156","article-title":"TMG-GAN: Generative Adversarial Networks-Based Imbalanced Learning for Network Intrusion Detection","volume":"19","author":"Ding H.","year":"2023","unstructured":"H. Ding, Y. Sun, N. Huang, Z. Shen, and X. Cui. 2023. TMG-GAN: Generative Adversarial Networks-Based Imbalanced Learning for Network Intrusion Detection. IEEE TIFS, Vol. 19 (2023), 1156-1167.","journal-title":"IEEE TIFS"},{"key":"e_1_3_2_2_13_1","unstructured":"Domain Tools. 2025. Farsight Security Information Exchange. https:\/\/www.domaintools.com\/resources\/user-guides\/security-information-exchange-sie-darknet-channel\/."},{"key":"e_1_3_2_2_14_1","doi-asserted-by":"crossref","unstructured":"Enhuan Dong Jiahai Yang Zhiliang Wang Xin He Jie Fang Shenao Li Supei Zhang Zeyuan Guo Hui Zhang Zimu Li et al. 2025. Internet Scan Source Identification: A Survey. IEEE Network (2025).","DOI":"10.1109\/MNET.2025.3574126"},{"key":"e_1_3_2_2_15_1","unstructured":"Driftnet. 2025. Driftnet Website. https:\/\/internet-measurement.com\/."},{"key":"e_1_3_2_2_16_1","first-page":"542","article-title":"A Search Engine backed by Internet-wide Scanning","author":"Durumeric Z.","year":"2015","unstructured":"Z. Durumeric, D. Adrian, A. Mirian, M. Bailey, and J. Halderman. 2015. A Search Engine backed by Internet-wide Scanning. In ACM CCS. 542-553.","journal-title":"ACM CCS."},{"key":"e_1_3_2_2_17_1","first-page":"139","article-title":"Ten Years of ZMap","author":"Durumeric Zakir","year":"2024","unstructured":"Zakir Durumeric, David Adrian, Phillip Stephens, Eric Wustrow, and J Alex Halderman. 2024. Ten Years of ZMap. In ACM IMC. 139-148.","journal-title":"ACM IMC."},{"key":"e_1_3_2_2_18_1","first-page":"65","article-title":"An Internet-Wide Wiew of Internet-Wide Scanning","author":"Durumeric Zakir","year":"2014","unstructured":"Zakir Durumeric, Michael Bailey, and J Alex Halderman. 2014. An Internet-Wide Wiew of Internet-Wide Scanning. In USENIX Security. 65-78.","journal-title":"USENIX Security."},{"key":"e_1_3_2_2_19_1","first-page":"605","article-title":"ZMap","author":"Durumeric Z.","year":"2013","unstructured":"Z. Durumeric, E. Wustrow, and J. Halderman. 2013. ZMap: Fast Internet-wide Scanning and Its Security Applications. In USENIX Security. 605-620.","journal-title":"Fast Internet-wide Scanning and Its Security Applications. In USENIX Security."},{"key":"e_1_3_2_2_20_1","unstructured":"He et al. 2025. Appendix of ScannerGrouper. https:\/\/github.com\/lemonhx25\/scannergrouper\/blob\/main\/docs\/scannergrouper_appendix.pdf."},{"key":"e_1_3_2_2_21_1","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2015.2497690"},{"key":"e_1_3_2_2_22_1","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSPW55150.2022.00037"},{"key":"e_1_3_2_2_23_1","unstructured":"FoFa. 2025. FoFa Search Engine. https:\/\/en.fofa.info."},{"key":"e_1_3_2_2_24_1","first-page":"231","article-title":"Who knocks at the ipv6 door? detecting ipv6 scanning","author":"Fukuda Kensuke","year":"2018","unstructured":"Kensuke Fukuda and John Heidemann. 2018. Who knocks at the ipv6 door? detecting ipv6 scanning. In ACM IMC. 231-237.","journal-title":"ACM IMC."},{"key":"e_1_3_2_2_25_1","first-page":"3614","volume-title":"IEEE TPAMI","volume":"43","author":"Geng Chuanxing","year":"2020","unstructured":"Chuanxing Geng, Sheng-jun Huang, and Songcan Chen. 2020. Recent advances in open set recognition: A survey. IEEE TPAMI, Vol. 43, 10 (2020), 3614-3631."},{"key":"e_1_3_2_2_26_1","volume-title":"Zied Ben Houidi, and Dario Rossi","author":"Gioacchini Luca","year":"2021","unstructured":"Luca Gioacchini, Luca Vassio, Marco Mellia, Idilio Drago, Zied Ben Houidi, and Dario Rossi. 2021. DarkVec: Automatic Analysis of Darknet Traffic with Word Embeddings. In ACM CoNEXT. 76-89."},{"key":"e_1_3_2_2_27_1","doi-asserted-by":"publisher","DOI":"10.1145\/3595378"},{"key":"e_1_3_2_2_28_1","volume-title":"MASSCAN: Mass IP Port Scanner. https:\/\/github.com\/robertdavidgraham\/masscan.","author":"Graham R.","year":"2021","unstructured":"R. Graham. 2021. MASSCAN: Mass IP Port Scanner. https:\/\/github.com\/robertdavidgraham\/masscan."},{"key":"e_1_3_2_2_29_1","doi-asserted-by":"crossref","unstructured":"H. Griffioen G. Koursiounis G. Smaragdakis and C. Doerr. 2024. Have you SYN me? Characterizing Ten Years of Internet Scanning. In ACM IMC.","DOI":"10.1145\/3646547.3688409"},{"key":"e_1_3_2_2_30_1","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2022.3233793"},{"key":"e_1_3_2_2_31_1","first-page":"431","article-title":"Spoki: Unveiling a New Wave of Scanners through a Reactive Network Telescope","author":"Hiesgen Raphael","year":"2022","unstructured":"Raphael Hiesgen, Marcin Nawrocki, Alistair King, Alberto Dainotti, Thomas C Schmidt, and Matthias W\u00e4hlisch. 2022. Spoki: Unveiling a New Wave of Scanners through a Reactive Network Telescope. In USENIX Security. 431-448.","journal-title":"USENIX Security."},{"volume-title":"USENIX Security.","author":"Huang Szu-Chun","key":"e_1_3_2_2_32_1","unstructured":"Szu-Chun Huang, Harm Griffoen, Max van der Horst, Georgios Smaragdakis, Michel van Eeten, and Yury Zhauniarovich. 2025. Trust but Verify: An Assessment of Vulnerability Tagging Services. In USENIX Security. Seattle, WA."},{"key":"e_1_3_2_2_33_1","unstructured":"Ipsniper. 2025. Ipsniper RDNS Dataset. https:\/\/ipsniper.info\/archive\/dns_data\/."},{"key":"e_1_3_2_2_34_1","first-page":"3111","article-title":"LZR","author":"Izhikevich L.","year":"2021","unstructured":"L. Izhikevich, R. Teixeira, and Z. Durumeric. 2021. LZR: Identifying Unexpected Internet Services. In USENIX Security. 3111-3128.","journal-title":"Identifying Unexpected Internet Services. In USENIX Security."},{"key":"e_1_3_2_2_35_1","first-page":"503","article-title":"Predicting IPv4 Services Across All Ports","author":"Izhikevich L.","year":"2022","unstructured":"L. Izhikevich, R. Teixeira, and Z. Durumeric. 2022. Predicting IPv4 Services Across All Ports. In ACM SIGCOMM. 503-515.","journal-title":"ACM SIGCOMM."},{"key":"e_1_3_2_2_36_1","doi-asserted-by":"crossref","unstructured":"Liz Izhikevich Manda Tran Katherine Izhikevich Gautam Akiwate and Zakir Durumeric. 2024. Democratizing LEO Satellite Network Measurement. In ACM SIGMETRICS.","DOI":"10.1145\/3652963.3655052"},{"key":"e_1_3_2_2_37_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-10578-9_26"},{"key":"e_1_3_2_2_38_1","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2022.3211644"},{"key":"e_1_3_2_2_39_1","first-page":"5145","article-title":"Ethical frameworks and computer security trolley problems: Foundations for conversations","author":"Kohno Tadayoshi","year":"2023","unstructured":"Tadayoshi Kohno, Yasemin Acar, and Wulf Loh. 2023. Ethical frameworks and computer security trolley problems: Foundations for conversations. In USENIX Security. 5145-5162.","journal-title":"USENIX Security."},{"key":"e_1_3_2_2_40_1","first-page":"15870","article-title":"IOMatch","author":"Li Zekun","year":"2023","unstructured":"Zekun Li, Lei Qi, Yinghuan Shi, and Yang Gao. 2023. IOMatch: Simplifying Open-set Semi-supervised Learning with Joint Inliers and Outliers Utilization. In IEEE\/CVF ICCV. 15870-15879.","journal-title":"In IEEE\/CVF ICCV."},{"key":"e_1_3_2_2_41_1","volume-title":"FARE: Enabling Fine-Grained Attack Categorization Under Low-Quality Labeled Data. In NDSS.","author":"Liang J.","year":"2021","unstructured":"J. Liang, W. Guo, T. Luo, H. Vasant, G. Wang, and X. Xing. 2021. FARE: Enabling Fine-Grained Attack Categorization Under Low-Quality Labeled Data. In NDSS."},{"key":"e_1_3_2_2_42_1","first-page":"279","article-title":"HoneyPLC","author":"L\u00f3pez-Morales E.","year":"2020","unstructured":"E. L\u00f3pez-Morales, C. Rubio-Medrano, A. Doup\u00e9, Y. Shoshitaishvili, R. Wang, T. Bao, and G. Ahn. 2020. HoneyPLC: A Next-Generation Honeypot for Industrial Control Systems. In ACM CCS. 279-291.","journal-title":"A Next-Generation Honeypot for Industrial Control Systems. In ACM CCS."},{"key":"e_1_3_2_2_43_1","volume-title":"IPREDS: Efficient Prediction System for Internet-wide Port and Service Scanning. In ACM CoNEXT.","author":"Luo Y.","year":"2024","unstructured":"Y. Luo, C. Li, Z. Wang, and J. Yang. 2024. IPREDS: Efficient Prediction System for Internet-wide Port and Service Scanning. In ACM CoNEXT."},{"key":"e_1_3_2_2_44_1","unstructured":"Gordon Fyodor Lyon. 2009. Nmap Network Scanning: The Official Nmap Project Guide to Network Discovery and Security Scanning. Insecure."},{"key":"e_1_3_2_2_45_1","volume-title":"Efficient estimation of word representations in vector space. arXiv preprint arXiv:1301.3781","author":"Mikolov Tomas","year":"2013","unstructured":"Tomas Mikolov. 2013. Efficient estimation of word representations in vector space. arXiv preprint arXiv:1301.3781, Vol. 3781 (2013)."},{"key":"e_1_3_2_2_46_1","volume-title":"Distributed representations of words and phrases and their compositionality. Advances in neural information processing systems","author":"Mikolov Tomas","year":"2013","unstructured":"Tomas Mikolov, Ilya Sutskever, Kai Chen, Greg S Corrado, and Jeff Dean. 2013. Distributed representations of words and phrases and their compositionality. Advances in neural information processing systems, Vol. 26 (2013)."},{"key":"e_1_3_2_2_47_1","volume-title":"Network Telescopes: Technical Report.","author":"Moore David","year":"2004","unstructured":"David Moore, Colleen Shannon, Geoffrey M Voelker, and Stefan Savage. 2004. Network Telescopes: Technical Report. (2004)."},{"key":"e_1_3_2_2_48_1","doi-asserted-by":"crossref","unstructured":"C. Munteanu S. Saidi O. Gasser G. Smaragdakis and A. Feldmann. 2023. Fifteen Months in the Life of a Honeyfarm. In ACM IMC.","DOI":"10.1145\/3618257.3624826"},{"key":"e_1_3_2_2_49_1","doi-asserted-by":"publisher","DOI":"10.1145\/2896816"},{"key":"e_1_3_2_2_50_1","first-page":"5989","article-title":"DScope: A Cloud-Native Internet Telescope","author":"Pauley Eric","year":"2023","unstructured":"Eric Pauley, Paul Barford, and Patrick McDaniel. 2023. DScope: A Cloud-Native Internet Telescope. In USENIX Security. 5989-6006.","journal-title":"USENIX Security."},{"key":"e_1_3_2_2_51_1","doi-asserted-by":"crossref","unstructured":"R. Pickren A. Chhotaray F. Li S. Zonouz and R. Beyah. 2024. Release the Hounds! Automated Inference and Empirical Security Evaluation of Field-Deployed PLCs Using Active Network Data. In ACM CCS.","DOI":"10.1145\/3658644.3690195"},{"key":"e_1_3_2_2_52_1","unstructured":"Rapid7. 2025. Rapid7 Website. https:\/\/opendata.rapid7.com."},{"key":"e_1_3_2_2_53_1","doi-asserted-by":"crossref","unstructured":"Philipp Richter and Arthur Berger. 2019. Scanning the Scanners: Sensing the Internet from a Massively Distributed Network Telescope. In ACM IMC.","DOI":"10.1145\/3355369.3355595"},{"key":"e_1_3_2_2_54_1","first-page":"410","article-title":"Illuminating Large-scale IPv6 Scanning in the Internet","author":"Richter Philipp","year":"2022","unstructured":"Philipp Richter, Oliver Gasser, and Arthur Berger. 2022. Illuminating Large-scale IPv6 Scanning in the Internet. In ACM IMC. 410-418.","journal-title":"ACM IMC."},{"key":"e_1_3_2_2_55_1","doi-asserted-by":"publisher","DOI":"10.1371\/journal.pone.0087357"},{"key":"e_1_3_2_2_56_1","first-page":"762","volume-title":"IEEE TPAMI","volume":"40","author":"Rudd Ethan M","year":"2017","unstructured":"Ethan M Rudd, Lalit P Jain, Walter J Scheirer, and Terrance E Boult. 2017. The extreme value machine. IEEE TPAMI, Vol. 40, 3 (2017), 762-768."},{"key":"e_1_3_2_2_57_1","doi-asserted-by":"crossref","unstructured":"Said Jawad Saidi Srdjan Matic Oliver Gasser Georgios Smaragdakis and Anja Feldmann. 2022. Deep dive into the IoT backend ecosystem. In ACM IMC.","DOI":"10.1145\/3517745.3561431"},{"key":"e_1_3_2_2_58_1","first-page":"1757","volume-title":"IEEE TPAMI","volume":"35","author":"Scheirer Walter J","year":"2012","unstructured":"Walter J Scheirer, Anderson de Rezende Rocha, Archana Sapkota, and Terrance E Boult. 2012. Toward open set recognition. IEEE TPAMI, Vol. 35, 7 (2012), 1757-1772."},{"key":"e_1_3_2_2_59_1","unstructured":"scikit learn. 2025. training of logistic regression model. https:\/\/scikit-learn.org\/stable\/modules\/linear_model.html#logistic-regression."},{"key":"e_1_3_2_2_60_1","volume-title":"USENIX Security '25 Ethics Guidelines. https:\/\/www.usenix.org\/conference\/usenixsecurity25\/ethics-guidelines.","author":"Security USENIX","year":"2025","unstructured":"USENIX Security. 2025. USENIX Security '25 Ethics Guidelines. https:\/\/www.usenix.org\/conference\/usenixsecurity25\/ethics-guidelines."},{"key":"e_1_3_2_2_61_1","volume-title":"Scanner-Hunter: An Effective ICS Scanning Group Identification System","author":"Sheng Chuan","year":"2024","unstructured":"Chuan Sheng, Yu Yao, Lianxiang Zhao, Peng Zeng, and Jianming Zhao. 2024. Scanner-Hunter: An Effective ICS Scanning Group Identification System. IEEE TIFS (2024)."},{"key":"e_1_3_2_2_62_1","unstructured":"Shodan. 2025. Shodan Search Engine. https:\/\/www.shodan.io."},{"key":"e_1_3_2_2_63_1","first-page":"6221","article-title":"Glowing in the Dark: Uncovering IPv6 Address Discovery and Scanning Strategies in the Wild","author":"Tanveer H.","year":"2023","unstructured":"H. Tanveer, R. Singh, P. Pearce, and R. Nithyanand. 2023. Glowing in the Dark: Uncovering IPv6 Address Discovery and Scanning Strategies in the Wild. In USENIX Security. 6221-6237.","journal-title":"USENIX Security."},{"key":"e_1_3_2_2_64_1","volume-title":"Ethics and Internet Measurements. In 2017 IEEE Security and Privacy Workshops (SPW). IEEE, 247-251","author":"Der Ham Jeroen Van","year":"2017","unstructured":"Jeroen Van Der Ham. 2017. Ethics and Internet Measurements. In 2017 IEEE Security and Privacy Workshops (SPW). IEEE, 247-251."},{"key":"e_1_3_2_2_65_1","first-page":"328","article-title":"How to Operate a Meta-Telescope in your Spare Time","author":"Wagner D.","year":"2023","unstructured":"D. Wagner, S. Ranadive, H. Griffioen, M. Kallitsis, A. Dainotti, G. Smaragdakis, and A. Feldmann. 2023. How to Operate a Meta-Telescope in your Spare Time. In ACM IMC. 328-343.","journal-title":"ACM IMC."},{"key":"e_1_3_2_2_66_1","unstructured":"Mengying Wu Geng Hong Jinsong Chen Qi Liu Shujun Tang Youhao Li Baojun Liu Haixin Duan and Min Yang. 2025. Revealing the Black Box of Device Search Engine: Scanning Assets Strategies and Ethical Consideration. In NDSS."},{"key":"e_1_3_2_2_67_1","unstructured":"ZGrab2. 2025. ZGrab 2.0. https:\/\/github.com\/zmap\/zgrab2."},{"key":"e_1_3_2_2_68_1","volume-title":"RFG-HELAD: A Robust Fine-Grained Network Traffic Anomaly Detection Model Based on Heterogeneous Ensemble Learning","author":"Zhong Ying","year":"2024","unstructured":"Ying Zhong, Zhiliang Wang, Xingang Shi, Jiahai Yang, and Keqin Li. 2024. RFG-HELAD: A Robust Fine-Grained Network Traffic Anomaly Detection Model Based on Heterogeneous Ensemble Learning. IEEE TIFS (2024)."},{"key":"e_1_3_2_2_69_1","unstructured":"ZoomEye. 2025. ZoomEye Search Engine. https:\/\/www.zoomeye.org."}],"event":{"name":"CCS '25: ACM SIGSAC Conference on Computer and Communications Security","sponsor":["SIGSAC ACM Special Interest Group on Security, Audit, and Control"],"location":"Taipei Taiwan","acronym":"CCS '25"},"container-title":["Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3719027.3765053","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,12,22]],"date-time":"2025-12-22T22:25:00Z","timestamp":1766442300000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3719027.3765053"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,11,19]]},"references-count":69,"alternative-id":["10.1145\/3719027.3765053","10.1145\/3719027"],"URL":"https:\/\/doi.org\/10.1145\/3719027.3765053","relation":{},"subject":[],"published":{"date-parts":[[2025,11,19]]},"assertion":[{"value":"2025-11-22","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}