E. Bou-harb, M. Debbabi, and C. Assi, Cyber Scanning: a Comprehensive Survey, vol.16, p.14961519, 2014.

T. M. Chen and S. Abu-nimeh, Lessons from Stuxnet, Computer, vol.44, issue.4, p.9193, 2011.

C. Kaspersky and . Apt, The Great Robbery, pp.2016-2017, 2015.

E. Raftopoulos, E. Glatz, X. Dimitropoulos, and A. Dainotti, How Dangerous is Internet Scanning? in International Workshop on Trac Monitoring and Analysis, p.158172, 2015.

Z. Durumeric, M. Bailey, and J. A. Halderman, An Internet-Wide View of Internet-Wide Scanning, 23rd USENIX Security Symposium (USENIX Security), p.6578, 2014.

S. Panjwani, S. Tan, K. M. Jarrin, and M. Cukier, An Experimental Evaluation to Determine if Port Scans are Precursors to an Attack, Proceedings of the International Conference on Dependable Systems and Networks (DSN), p.602611, 2005.

A. K. Kaushik, E. S. Pilli, and R. Joshi, Network Forensic System for Port Scanning Attack, Advance Computing Conference (IACC), p.310315, 2010.

E. Bou-harb, M. Debbabi, and C. Assi, A Time Series Approach for Inferring Orchestrated Probing Campaigns by Analyzing Darknet Trac, 10th International Conference on Availability, Reliability and Security, p.180185, 2015.

V. Ghiette, N. Blenn, and C. Doerr, Remote Identication of Port Scan Toolchains, 8th IFIP International Conference on New Technologies, Mobility and Security (NTMS)

, IEEE, p.15, 2016.

P. Chen, L. Desmet, and C. Huygens, A Study on Advanced Persistent Threats, in Communications and Multimedia Security, ser. Lecture Notes in Computer Science, vol.8735, 2014.


S. Lagraa and J. François, Knowledge Discovery of Port Scans from Darknet, Symposium on Integrated Network and Service Management, p.935940, 2017.
URL : https://hal.archives-ouvertes.fr/hal-01636215

R. J. Barnett and B. Irwin, Towards a Taxonomy of Network Scanning Techniques, Proceedings of the 2008 annual research conference of the South African Institute of Computer Scientists and Information Technologists on IT research in developing countries: riding the wave of technology, p.17, 2008.

E. Bou-harb, M. Debbabi, and C. Assi, On Fingerprinting Probing Activities, vol.43, p.3548, 2014.

J. Mazel, R. Fontugne, and K. Fukuda, Proling Internet Scanners: Spatial and Temporal Structures, 2016.

M. D. Vivo, E. Carrasco, G. Isern, and G. O. De-vivo, ACM SIGCOMM Computer Communication Review, vol.29, issue.2, p.4148, 1999.

M. Allman, V. Paxson, and J. Terrell, A Brief History of Scanning, Proceedings of the 7th ACM SIGCOMM conference on Internet measurement, p.7782, 2007.

D. Leonard and D. Loguinov, Demystifying Internet-Wide Service Discovery, IEEE/ACM Transactions on Networking, vol.21, issue.6, p.17601773, 2013.

C. Gates, Coordinated Scan Detection, NDSS, 2009.

P. K. Manna, S. Chen, and S. Ranka, Exact Modeling of Propagation for PermutationScanning Worms, INFOCOM 2008. The 27th Conference on Computer Communications, p.16961704, 2008.

Z. Durumeric, E. Wustrow, and J. A. Halderman, ZMap: Fast Internet-Wide Scanning and its Security Applications. in Usenix Security, 2013.

G. F. Lyon, NMap Network Scanning: The Ocial NMap Project Guide to Network Discovery and Security Scanning. Insecure, 2009.

, Nmap In The Movies, pp.2018-2027

. Nmap, , pp.2018-2027

. Shodan, , pp.2018-2027

R. Bodenheim, J. Butts, S. Dunlap, and B. Mullins, Evaluation of the Ability of the Shodan Search Engine to Identify Internet-Facing Industrial Control Devices, International Journal of Critical Infrastructure Protection, vol.7, issue.2, p.114123, 2014.

R. O'harrow, Cyber Search Engine Shodan Exposes Industrial Control Systems to new Risks, The Washington Post, 2012.

D. Goldman and S. , The Scariest Search Engine on the Internet, CNN Tech, 2013.

S. Staniford-chen, S. Cheung, R. Crawford, M. Dilger, J. Frank et al., GrIDS -A Graph Based Intrusion Detection System for Large Networks, Proceedings of the 19th national information systems security conference, vol.1, p.361370, 1996.

M. H. Bhuyan, D. Bhattacharyya, and J. K. Kalita, Surveying Port Scans and their Detection Methodologies, The Computer Journal, vol.54, issue.10, p.15651581, 2011.

N. Kato, H. Nitou, K. Ohta, G. Manseld, and Y. Nemoto, A Real-Time Intrusion Detection System (IDS) for Large Scale Networks and its Evaluations, IEICE Transactions on Ccommunications, vol.82, issue.11, p.18171825, 1999.

P. A. Porras and A. Valdes, Live Trac Analysis of TCP/IP Gateways, NDSS, 1998.

C. Leckie and R. Kotagiri, A Probabilistic Approach to Detecting Network Scans, Network Operations and Management Symposium, p.359372, 2002.

S. Robertson, E. V. Siegel, M. Miller, and S. J. Stolfo, Surveillance Detection in High Bandwidth Environments, DARPA Information Survivability Conference and Exposition, 2003. Proceedings, vol.1, p.130138, 2003.

L. Ertoz, E. Eilertson, A. Lazarevic, P. Tan, P. Dokas et al., Detection of Novel Network Attacks using Data Mining, Proc. of Workshop on Data Mining for Computer Security. Citeseer, 2003.

H. Kim, S. Kim, M. A. Kouritzin, and W. Sun, Detecting Network Portscans through Anomoly Detection, Sensor Fusion, and Target Recognition XIII, vol.5429, p.254264, 2004.

G. K. Haan, Detection of Portscans Using IP Header Data, Proceedings of TBRC'05, 2005.

C. Gates, J. J. Mcnutt, J. B. Kadane, and M. I. Kellner, Scan Detection on very Large Networks using Logistic Regression Modeling, 11th IEEE Symposium on Computers and Communications, p.402408, 2006.

G. J. Simon, H. Xiong, E. Eilertson, and V. Kumar, Scan Detection: A Data Mining Approach, Proceedings of the 2006 SIAM International Conference on Data Mining

, , p.118129, 2006.

M. Roesch, Snort: Lightweight Intrusion Detection for Networks, Lisa, vol.99, issue.1, p.229238, 1999.

J. Udhayan, A. Krishnan, and R. Anitha, Reconnaissance Scan Detection Heuristics to Disrupt the Pre-Attack Information Gathering, International Conference on Network and Service Security, N2S, p.15, 2009.

L. T. Heberlein, G. V. Dias, K. N. Levitt, B. Mukherjee, J. Wood et al., A Network Security Monitor, Computer Society Symposium on Research in Security and Privacy, p.296304, 1990.

V. Paxson and . Bro, A System for Detecting Network Intruders in Real-Time, Computer Networks, vol.31, issue.23-24, p.24352463, 1999.

M. Fullmer and S. Romig, The OSU Flowtools Package and CISCO NetFlow Logs, Proceedings of the 2000 USENIX LISA Conference, 2000.

J. Jung, V. Paxson, A. W. Berger, and H. Balakrishnan, Fast Portscan Detection Using Sequential Hypothesis Testing, Symposium on Security and Privacy, p.211225, 2004.

S. Kong, T. He, X. Shao, C. An, and X. Li, Scalable Double Filter Structure for Port Scan Detection, International Conference on Communications, ICC, vol.5, p.21772182, 2006.

Y. Zhang and B. Fang, A Novel Approach to Scan Detection on the Backbone, Sixth International Conference on Information Technology: New Generations, ITNG, p.1621, 2009.

A. Sridharan, T. Ye, and S. Bhattacharyya, Connectionless Port Scan Detection on the Backbone, 25th IEEE International Performance, Computing, and Communications Conference, p.10, 2006.

R. Basu, R. K. Cunningham, S. E. Webster, and P. Lippmann, Detecting Low-Prole Probes and Novel Denial-of-Service Attacks, Proceedings of the 2001 IEEE Workshop on Information Assurance, 2001.

W. W. Streilein, R. K. Cunningham, and S. E. Webster, Improved Detection of Low-Prole Probe and Denial-of-Service Attacks, Proceedings of the 2001 Workshop on Statistical and Machine Learning Techniques in Computer Intrusion Detection, 2001.

W. El-hajj, F. Aloul, Z. Trabelsi, and N. Zaki, On Detecting Port Scanning Using Fuzzy Based Intrusion Detection System, International Wireless Communications and Mobile Computing Conference, IWCMC, p.105110, 2008.
DOI : 10.1109/iwcmc.2008.19

URL : http://www.aloul.net/Papers/faloul_iwcmc08.pdf

D. Liu, M. Zhang, and T. Li, Network Trac Analysis Using Rened Bayesian Reasoning to Detect Flooding and Port Scan Attacks, International Conference on Advanced Computer Theory and Engineering, p.10001004, 2008.
DOI : 10.1109/icacte.2008.44

M. Z. Shaq, M. Farooq, and S. A. Khayam, A Comparative Study of Fuzzy Inference Systems, Neural Networks and Adaptive Neuro Fuzzy Inference Systems for Portscan Detection, Workshops on Applications of Evolutionary Computation, p.5261, 2008.

M. V. Mahoney and P. K. Chan, PHAD: Ppacket Header Anomaly Detection for Identifying Hostile Network Trac, 2001.

J. Kim and J. Lee, A Slow Port Scan Attack Detection Mechanism Based on Fuzzy Logic and a Stepwise Policy, 2008.

G. Conti and K. Abdullah, Passive Visual Fingerprinting of Network Attack Tools, Proceedings of the 2004 ACM workshop on Visualization and data mining for computer security, p.4554, 2004.

K. Lakkaraju, W. Yurcik, and A. J. Lee, NVisionIP: Netow Visualizations of System State for Security Situational Awareness, Proceedings of the 2004 ACM workshop on Visualization and data mining for computer security, p.6572, 2004.

K. Abdullah, C. Lee, G. Conti, and J. A. Copeland, Visualizing Network Data for Intrusion Detection, Information Assurance Workshop, 2005. IAW'05. Proceedings from the Sixth Annual IEEE SMC, p.100108, 2005.
DOI : 10.1109/iaw.2005.1495940

URL : http://www.rumint.org/gregconti/publications/20050423_IAW_Abdullah(final).pdf

A. J. Lee, G. A. Koenig, X. Meng, and W. Yurcik, Searching for Open Windows and Unlocked Doors: Port Scanning in Large-Scale Commodity Clusters, Cluster Computing and the Grid, vol.1, p.146151, 2005.

J. Mcpherson, K. Ma, P. Krystosk, T. Bartoletti, and M. Christensen, Portvis: a Tool for Port-Based Detection of Security Events, Proceedings of the 2004 ACM workshop on Visualization and data mining for computer security, p.7381, 2004.

C. Muelder, K. Ma, and T. Bartoletti, Interactive Visualization for Network and Port Scan Detection, International Workshop on Recent Advances in Intrusion Detection
DOI : 10.1007/11663812_14

S. Musa and D. J. Parish, Visualising Communication Network Security Aattacks, Information Visualization, 2007. IV'07. 11th International Conference, p.726733, 2007.
DOI : 10.1109/iv.2007.149

Z. Jiawan, L. Liang, L. Liangfu, and Z. Ning, A Novel Visualization Approach for Ecient Network Scans Detection, Security Technology, 2008. SECTECH'08. International Conference on, p.2326, 2008.
DOI : 10.1109/sectech.2008.47

C. Gates, Co-ordinated Port Scans: a Model, a Detector and an Evaluation Methodology, 2006.

D. L. Whyte, Network Scanning Detection Strategies for Enterprise Networks, 2008.
DOI : 10.22215/etd/2008-06485

URL : https://curve.carleton.ca/system/files/etd/eb3268a2-7f48-4f9b-bd52-55de936ebf09/etd_pdf/2c19c9a4946fc5fe45f9a61c59569b4a/whyte-networkscanningdetectionstrategiesforenterprise.pdf

S. Staniford, J. A. Hoagland, and J. M. Mcalerney, Practical Automated Detection of Stealthy Portscans, Journal of Computer Security, vol.10, issue.1-2, p.105136, 2002.
DOI : 10.3233/jcs-2002-101-205

V. Yegneswaran, P. Barford, and J. Ullrich, Internet Intrusions: Global Characteristics and Prevalence, ACM SIGMETRICS Performance Evaluation Review, vol.31, issue.1, p.138147, 2003.

C. Carver, J. Hill, J. R. Surdu, and U. W. Pooch, A Methodology for Using Intelligent Agents to Provide Automated Intrusion Response, Proceedings of the IEEE Systems, Man, and Cybernetics Information Assurance and Security Workshop, p.110116, 2000.

W. Zhang, S. Teng, and X. Fu, Scan attack detection based on distributed cooperative model, Computer Supported Cooperative Work in Design, p.743748, 2008.

L. R. Rabiner, A Tutorial on Hidden Markov Models and Selected Applications in Speech Recognition, Proceedings of the IEEE, vol.77, issue.2, p.257286, 1989.

L. Rabiner and B. Juang, An Introduction to Hidden Markov Models, Acoustic, Speech and Signal Processing, vol.3, issue.1, p.416, 1986.

W. Zucchini and I. L. Macdonald, Hidden Markov Models for Time Series: an Introduction using R, ser. Monographs on statistics and applied probability, 2009.

M. A. Figueiredo and A. K. Jain, Unsupervised Learning of Finite Mixture Models, IEEE Transactions on pattern analysis and machine intelligence, vol.24, issue.3, p.381396, 2002.

H. Akaike, A New Look at the Statistical Model Identication, IEEE transactions on automatic control, vol.19, issue.6, p.716723, 1974.

G. E. Schwarz, Estimating the Dimension of a Model, The annals of statistics, vol.6, issue.2, p.461464, 1978.

D. Ramage, Hidden Markov Models Fundamentals, Lecture Notes, 2007.

L. R. Welch, Hidden Markov Models and the Baum-Welch Algorithm, Newsletter of the IEEE Information Theory Society, vol.53, issue.4, 2003.

C. Fachkha and M. Debbabi, Darknet as a Source of Ccyber Intelligence: Survey, Taxonomy, and Characterization, vol.18, p.11971227, 2016.

S. Choi, J. Song, S. Kim, and S. Kim, A Model of Analyzing Cyber Threats Trend and Tracing Potential Attackers Based on Darknet Trac, Security and Communication Networks, vol.7, p.16121621, 2014.

G. De-santis, A. Lahmadi, J. Francois, and O. Festor, Modeling of IP Scanning Activities with Hidden Markov Models: Darknet Case Study, 8th IFIP International Conference on New Technologies, Mobility and Security (NTMS), p.15, 2016.
URL : https://hal.archives-ouvertes.fr/hal-01404127

Z. Li, A. Goyal, and Y. Chen, Honeynet-Based Botnet Scan Trac Analysis, in Botnet Detection, p.2544, 2008.

G. De-santis, A. Lahmadi, J. Francois, and O. Festor, Internet-Wide Scanners Classication using Gaussian Mixture and Hidden Markov Models, New Technologies, Mobility and Security (NTMS), p.15, 2018.

A. C. Berry, The Accuracy of the Gaussian Approximation to the Sum of Independent Variates, Transactions of the American Mathematical Society, vol.49, issue.1, p.122136, 1941.

M. Ester, H. Kriegel, J. Sander, and X. Xu, A Density-Based Algorithm for Discovering Clusters in Large Spatial Databases with Noise, Kdd, vol.96, issue.34, p.226231, 1996.

J. Mazel, R. Fontugne, and K. Fukuda, Identifying Coordination of Network Scans Using Probed Address Structure, 8th International Workshop on Trac Monitoring and Analysis, TMA 2016, 2016.