Scanning the Scanners: Sensing the Internet from a Distributed Network Telescope [pdf]

Pretty interesting analysis in here. Kudos to Akamai for sharing content to support this type of work. Would be nice to tokenize the same source data (just for privacy reasons) and share it as a public dataset.

Would love to see the analysis itself move into actor modeling to look for ways to correlate and attribute scan activity. Would also be interesting to monitor the effectiveness of various blacklists against the empirically observed scanning/malicious activity.