A Search Engine Backed by Internet-Wide Scanning

By Zakir Durumeric, David Adrian, Ariana Mirian, Michael Bailey, J. Alex Halderman. Conference on Computer and Communications Security, 2015

513 citations recorded by the source corpus.

Fast Internet-wide scanning has opened new avenues for security research, ranging from uncovering widespread vulnerabilities in random number generators to tracking the evolving impact of Heartbleed. However, this technique still requires significant effort: even simple questions, such as, "What models of embedded devices prefer CBC ciphers?", require developing an application scanner, manually identifying and tagging devices, negotiating with network administrators, and responding to abuse complaints. In this paper, we introduce Censys, a public search engine and data processing facility backed by data collected from ongoing Internet-wide scans. Designed to help researchers answer security-related questions, Censys supports full-text searches on protocol banners and querying a wide range of derived fields (e.g., 443.https.cipher). It can identify specific vulnerable devices and networks and generate statistical reports on broad usage patterns and trends. Censys returns these results in sub-second time, dramatically reducing the effort of understanding the hosts that comprise the Internet. We present the search engine architecture and experimentally evaluate its performance. We also explore Censys's applications and show how questions asked in recent studies become simple to answer.

Subfields: Computer Networks and Communications, Information Systems, Signal Processing

View Paper: https://www.semanticscholar.org/paper/a13a8c91a83fd5c994e9f77aeb4eadab51a98640

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Computer Networks and Communications

In Information Systems

In Signal Processing

Citations in the corpus

IoT Privacy and Security Challenges for Smart Home Environments (2016, background): “As who have 19], sensors, many devices are suddenly known and visible.”
Understanding the Mirai Botnet (2017, methodology): “We caution that devices with open services that are not closed by Mirai (e.g., HTTPS and FTP) can appear repeatedly in Censys banner scans during our measurement window (due to churn) and thus lead to over counting when compared across protocols.”
Demystifying IoT Security: An Exhaustive Survey on IoT Vulnerabilities and a First Empirical Look on Internet-Scale IoT Exploitations (2019, methodology): “In a similar manner, the search engine Censys [144] collects data (including IoT information) through executing horizontal scans of the public IPv4 address space and provides public”
SoK: Security Evaluation of Home-Based IoT Deployments (2019, background): “The Censys Project [79] is a valuable source of data that can allow researchers to historically analyze IoT infrastructure.”