{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,10,17]],"date-time":"2025-10-17T12:40:58Z","timestamp":1760704858545,"version":"build-2065373602"},"reference-count":29,"publisher":"MDPI AG","issue":"10","license":[{"start":{"date-parts":[[2025,10,15]],"date-time":"2025-10-15T00:00:00Z","timestamp":1760486400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"DOI":"10.13039\/501100012166","name":"National Key Research and Development Program of China","doi-asserted-by":"publisher","award":["2022YFB3102902"],"award-info":[{"award-number":["2022YFB3102902"]}],"id":[{"id":"10.13039\/501100012166","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Information"],"abstract":"<jats:p>With the quick development of network technology, the number of active IoT devices is growing rapidly. Numerous network scanning organizations have emerged to scan and detect network assets around the clock. This greatly facilitates illegal cyberattacks and adversely affects cybersecurity. Therefore, it is important to discover and identify network scanning organizations on the Internet. Motivated by this, we propose a network scanning organization discovery method based on a graph convolutional neural network, which can effectively cluster out network scanning organizations. First, we constructed a network scanning attribute graph to represent the topological relationship between network scanning behaviors and targets. Then, we extract the deep feature relationships in the attribute graph via graph convolutional neural network and perform clustering to get network scanning organizations. Finally, the effectiveness of the method proposed in this paper is experimentally verified with an accuracy of 83.41% for the identification of network scanning organizations.<\/jats:p>","DOI":"10.3390\/info16100899","type":"journal-article","created":{"date-parts":[[2025,10,17]],"date-time":"2025-10-17T11:39:34Z","timestamp":1760701174000},"page":"899","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["A Network Scanning Organization Discovery Method Based on Graph Convolutional Neural Network"],"prefix":"10.3390","volume":"16","author":[{"ORCID":"https:\/\/orcid.org\/0009-0001-8102-5239","authenticated-orcid":false,"given":"Pengfei","family":"Xue","sequence":"first","affiliation":[{"name":"College of Electronic Engineering, National University of Defense Technology, Hefei 230031, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Luhan","family":"Dong","sequence":"additional","affiliation":[{"name":"School of Cybersecurity, Northwestern Polytechnical University, Xi\u2019an 710072, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Chenyang","family":"Wang","sequence":"additional","affiliation":[{"name":"College of Electronic Engineering, National University of Defense Technology, Hefei 230031, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Cheng","family":"Huang","sequence":"additional","affiliation":[{"name":"School of Cyber Science and Engineering, Sichuan University, Chengdu 610207, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Jie","family":"Wang","sequence":"additional","affiliation":[{"name":"College of Electronic Engineering, National University of Defense Technology, Hefei 230031, China"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"1968","published-online":{"date-parts":[[2025,10,15]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"8649","DOI":"10.1109\/TMC.2024.3350078","article-title":"Joint task offloading, resource allocation, and trajectory design for multi-uav cooperative edge computing with task priority","volume":"23","author":"Hao","year":"2024","journal-title":"IEEE Trans. Mob. Comput."},{"key":"ref_2","doi-asserted-by":"crossref","first-page":"8114","DOI":"10.1109\/TWC.2025.3564356","article-title":"Task-Driven Priority-Aware Computation Offloading Using Deep Reinforcement Learning","volume":"24","author":"Hao","year":"2025","journal-title":"IEEE Trans. Wirel. Commun."},{"key":"ref_3","doi-asserted-by":"crossref","first-page":"5044","DOI":"10.1109\/TNSM.2021.3130382","article-title":"A General Approach for Traffic Classification in Wireless Networks Using Deep Learning","volume":"19","author":"Camelo","year":"2022","journal-title":"IEEE Trans. Netw. Serv. Manag."},{"key":"ref_4","doi-asserted-by":"crossref","unstructured":"Jenefa, A., Sam, S., Nair, V., Thomas, B.G., George, A.S., Thomas, R., and Sunil, A.D. (2023, January 23\u201324). A Robust Deep Learning-based Approach for Network Traffic Classification using CNNs and RNNs. Proceedings of the 2023 4th International Conference on Signal Processing and Communication (ICSPC), Coimbatore, India.","DOI":"10.1109\/ICSPC57692.2023.10125858"},{"key":"ref_5","doi-asserted-by":"crossref","unstructured":"Marchetta, P., and Pescap\u00e9, A. (2013, January 14\u201319). DRAGO: Detecting, quantifying and locating hidden routers in Traceroute IP paths. Proceedings of the 2013 Proceedings IEEE INFOCOM, Turin, Italy.","DOI":"10.1109\/INFCOM.2013.6567144"},{"key":"ref_6","doi-asserted-by":"crossref","unstructured":"Sherry, J., Katz-Bassett, E., Pimenova, M., Madhyastha, H.V., Anderson, T., and Krishnamurthy, A. (2010, January 1\u20133). Resolving IP aliases with prespecified timestamps. Proceedings of the 10th ACM SIGCOMM Conference on Internet Measurement, Melbourne, Australia. IMC \u201910.","DOI":"10.1145\/1879141.1879163"},{"key":"ref_7","doi-asserted-by":"crossref","unstructured":"Marchetta, P., Persico, V., and Pescap\u00e8, A. (2013, January 9\u201312). Pythia: Yet another active probing technique for alias resolution. Proceedings of the Ninth ACM Conference on Emerging Networking Experiments and Technologies, Santa Barbara, CA, USA. CoNEXT \u201913.","DOI":"10.1145\/2535372.2535413"},{"key":"ref_8","doi-asserted-by":"crossref","first-page":"320","DOI":"10.1016\/j.neucom.2018.12.016","article-title":"Traffic flow prediction using LSTM with feature enhancement","volume":"332","author":"Yang","year":"2019","journal-title":"Neurocomputing"},{"key":"ref_9","doi-asserted-by":"crossref","unstructured":"Vikram, A. (2020, January 10\u201312). Anomaly detection in Network Traffic Using Unsupervised Machine learning Approach. Proceedings of the 2020 5th International Conference on Communication and Electronics Systems (ICCES), Coimbatore, India.","DOI":"10.1109\/ICCES48766.2020.9137987"},{"key":"ref_10","doi-asserted-by":"crossref","unstructured":"Marwah, M., and Arlitt, M. (2022, January 14\u201318). Deep Learning for Network Traffic Data. Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, Washington, DC, USA. KDD \u201922.","DOI":"10.1145\/3534678.3542618"},{"key":"ref_11","unstructured":"Elsheikh, M., Shalaby, M., Sobh, M.A., and Bahaa-Eldin, A.M. (2023, January 27\u201328). Deep Learning Techniques for Intrusion Detection Systems: A Survey and Comparative Study. Proceedings of the 2023 International Mobile, Intelligent, and Ubiquitous Computing Conference (MIUCC), Cairo, Egypt."},{"key":"ref_12","doi-asserted-by":"crossref","unstructured":"Liu, H., and Lang, B. (2019). Machine Learning and Deep Learning Methods for Intrusion Detection Systems: A Survey. Appl. Sci., 9.","DOI":"10.3390\/app9204396"},{"key":"ref_13","doi-asserted-by":"crossref","unstructured":"Kurnala, V., Naik, S.A., Surapaneni, D.C., and Reddy, C.B. (2023, January 7\u20138). Hybrid Detection: Enhancing Network & Server Intrusion Detection Using Deep Learning. Proceedings of the 2023 IEEE 5th International Conference on Cybernetics, Cognition and Machine Learning Applications (ICCCMLA), Hamburg, Germany.","DOI":"10.1109\/ICCCMLA58983.2023.10346699"},{"key":"ref_14","doi-asserted-by":"crossref","first-page":"239","DOI":"10.1016\/j.procs.2021.05.025","article-title":"Network Intrusion Detection System using Deep Learning","volume":"185","author":"Ashiku","year":"2021","journal-title":"Procedia Comput. Sci."},{"key":"ref_15","doi-asserted-by":"crossref","first-page":"931","DOI":"10.1109\/TDSC.2017.2762673","article-title":"Towards Automated Log Parsing for Large-Scale Log Data Analysis","volume":"15","author":"He","year":"2018","journal-title":"IEEE Trans. Dependable Secur. Comput."},{"key":"ref_16","doi-asserted-by":"crossref","first-page":"101739","DOI":"10.1016\/j.cose.2020.101739","article-title":"System Log Clustering Approaches for Cyber Security Applications: A Survey","volume":"92","author":"Landauer","year":"2020","journal-title":"Comput. Secur."},{"key":"ref_17","first-page":"5542543","article-title":"A Security Log Analysis Scheme Using Deep Learning Algorithm for IDSs in Social Network","volume":"2021","author":"Zhong","year":"2021","journal-title":"Secur. Commun. Networks"},{"key":"ref_18","doi-asserted-by":"crossref","first-page":"1722","DOI":"10.1016\/j.procs.2023.01.150","article-title":"Automated Log Classification Using Deep Learning","volume":"218","author":"Ramachandran","year":"2023","journal-title":"Procedia Comput. Sci."},{"key":"ref_19","doi-asserted-by":"crossref","first-page":"1565","DOI":"10.1093\/comjnl\/bxr035","article-title":"Surveying Port Scans and Their Detection Methodologies","volume":"54","author":"Bhuyan","year":"2011","journal-title":"Comput. J."},{"key":"ref_20","doi-asserted-by":"crossref","unstructured":"Mirza, A. (engrXiv, 2023). Port Scanning: Techniques, Tools and Detection, engrXiv, preprint.","DOI":"10.31224\/3053"},{"key":"ref_21","unstructured":"Qiao, J., Zhao, X., Pan, L., Zuo, X., Zhang, X., Zhang, Q., and Huang, S. (2018, January 2\u20134). DeepPort: Detect Low Speed Port Scan Using Convolutional Neural Network. Proceedings of the International Conference on Bio-Inspired Computing: Theories and Applications, Beijing, China."},{"key":"ref_22","doi-asserted-by":"crossref","unstructured":"Algaolahi, A.Q.M., Hasan, A.A., Sallam, A., Sharaf, A.M., Abdu, A.A., and Alqadi, A.A. (2021, January 10\u201312). Port-Scanning Attack Detection Using Supervised Machine Learning Classifiers. Proceedings of the 2021 1st International Conference on Emerging Smart Technologies and Applications (eSmarTA), Sana\u2019a, Yemen.","DOI":"10.1109\/eSmarTA52612.2021.9515743"},{"key":"ref_23","doi-asserted-by":"crossref","unstructured":"Aksu, D., and Ali Aydin, M. (2018, January 3\u20134). Detecting Port Scan Attempts with Comparative Analysis of Deep Learning and Support Vector Machine Algorithms. Proceedings of the 2018 International Congress on Big Data, Deep Learning and Fighting Cyber Terrorism (IBIGDELFT), Ankara, Turkey.","DOI":"10.1109\/IBIGDELFT.2018.8625370"},{"key":"ref_24","first-page":"1","article-title":"Network Embedding for Community Detection in Attributed Networks","volume":"14","author":"Sun","year":"2020","journal-title":"ACM Trans. Knowl. Discov. Data"},{"key":"ref_25","doi-asserted-by":"crossref","unstructured":"Calders, T., Esposito, F., H\u00fcllermeier, E., and Meo, R. (2014, January 15\u201319). Density-Based Subspace Clustering in Heterogeneous Networks. Proceedings of the Joint European Conference on Machine Learning and Knowledge Discovery in Databases Machine Learning and Knowledge Discovery in Databases, Nancy, France.","DOI":"10.1007\/978-3-662-44848-9"},{"key":"ref_26","doi-asserted-by":"crossref","unstructured":"Cui, G., Zhou, J., Yang, C., and Liu, Z. (2020, January 6\u201310). Adaptive Graph Encoder for Attributed Graph Embedding. Proceedings of the 26th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, Virtual. KDD \u201920.","DOI":"10.1145\/3394486.3403140"},{"key":"ref_27","doi-asserted-by":"crossref","unstructured":"Richter, P., and Berger, A. (2019, January 21\u201323). Scanning the Scanners: Sensing the Internet from a Massively Distributed Network Telescope. Proceedings of the Internet Measurement Conference, Amsterdam, The Netherlands. IMC \u201919.","DOI":"10.1145\/3355369.3355595"},{"key":"ref_28","doi-asserted-by":"crossref","unstructured":"Li, X., Azad, B.A., Rahmati, A., and Nikiforakis, N. (2021, January 24\u201327). Good Bot, Bad Bot: Characterizing Automated Browsing Activity. Proceedings of the 2021 IEEE Symposium on Security and Privacy (SP), San Francisco, CA, USA.","DOI":"10.1109\/SP40001.2021.00079"},{"key":"ref_29","unstructured":"Mazel, J., and Strullu, R. (2019). Identifying and characterizing ZMap scans: A cryptanalytic approach. arXiv."}],"container-title":["Information"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/2078-2489\/16\/10\/899\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,17]],"date-time":"2025-10-17T12:07:10Z","timestamp":1760702830000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/2078-2489\/16\/10\/899"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,10,15]]},"references-count":29,"journal-issue":{"issue":"10","published-online":{"date-parts":[[2025,10]]}},"alternative-id":["info16100899"],"URL":"https:\/\/doi.org\/10.3390\/info16100899","relation":{},"ISSN":["2078-2489"],"issn-type":[{"value":"2078-2489","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,10,15]]}}}