Network scan device, network scan method, and network scan program

Abstract

Provided is a network scan device (10), wherein an acquisition unit (15a) acquires an operating address and a port operating on the address. A classification unit (15b) classifies the port operating on the acquired operating address into a cluster corresponding to the similarity pertaining to an address on which each port operates. A collection unit (15c) uses the representative port selected from each of the classified clusters to collect, as a seed, an address on which the representative port operates.

Description

Network scanning device, network scanning method, and network scanning program

[0001] The present invention relates to a network scanning device, a network scanning method, and a network scanning program.

[0002] Network scanning is a technique that contributes to various measurements on the Internet, such as protocol prevalence, network topology, and vulnerable host investigations, by sending packets appropriate for the investigation purpose and analyzing the responses. Specifically, it investigates ports operating on addresses where the existence of hosts is confirmed by performing scans specialized for each application.

[0003] Unlike IPv4, IPv6 does not allow for a brute force scan of the entire address space, so scan targets are prepared in advance within the upper limit of the number of scans (hereafter referred to as the budget) set under resource constraints. Specifically, a list of IPv6 addresses where the presence of hosts has been confirmed (hereafter referred to as the hit list) is analyzed as a seed, and addresses where hosts may exist are predicted to generate targets for the scan.

[0004] For example, the IPv6 Hitlist Service, a representative hitlist, collects IPv6 addresses whose existence has been confirmed as seeds from various sources such as DNS name resolution. An algorithm has also been proposed that uses the collected active addresses as seeds to generate scan targets (see Non-Patent Documents 1 and 2). This allows for efficient scanning in IPv6.

[0005] Pawel Foremski, David Plonka, and Arthur Berger, “Entropy / IP: Uncovering Structure in IPv6 Addresses”, Proceedings of the 2016 Internet Measurement Conference (IMC '16). Association for Computing Machinery, New York, NY, USA, 167-181. [online], 2016, [searched on September 11, 2023], Internet <URL: https: / / doi.org / 10.1145 / 2987443.<2987445> Austin Murdock, Frank Li, Paul Bramsen, Zakir Durumeric, and Vern Paxson, “Target Generation for Internet-wide IPv6 Scanning”, Proceedings of the 2017 Internet Measurement Conference (IMC '17). Association for Computing Machinery, New York, NY, USA, 242-253. [online], 2017, [searched on September 11, 2023], Internet <URL: https: / / doi.org / 10.1145 / 3131365.<3131405>

[0006] However, according to the prior art, it may be difficult to perform scans specialized for each application. For example, when conducting an investigation specialized for an application, it is first necessary to enumerate the addresses where the corresponding port is operating. In the IPv6 Internet, in the IPv6 Hitlist Service, for the confirmed addresses, the operating status of only a few ports such as those for the Web has been confirmed by scanning.

[0007] In conventional technologies, if a target generated using an address with an active web port as a seed is used, there is a possibility that inefficient scans will be performed on ports unrelated to the web. When scanning a variety of ports at confirmed addresses and collecting addresses where each port is active as a seed, the number of scans required to collect seeds becomes enormous in proportion to the number of ports, leaving significant limitations on scalability. In other words, these conventional technologies have the problem that they only consider the network connectivity status of the target and the operating status of a small number of ports, such as those for the web.

[0008] The present invention has been made in view of the above, and has as its object to efficiently perform scanning specialized for each application.

[0009] In order to solve the above-mentioned problems and achieve the objectives, the network scanning device of the present invention is characterized by having an acquisition unit that acquires operating addresses and ports operating on those addresses, a classification unit that classifies the acquired ports into clusters according to the similarity of the addresses on which each port operates, and a collection unit that uses ports selected from each classified cluster to collect the addresses on which the ports operate.

[0010] According to the present invention, it is possible to efficiently perform a scan specialized for each application.

[0011] FIG. 1 is a diagram for explaining an overview of a network scanning device of this embodiment. FIG. 2 is a schematic diagram illustrating a general configuration of a network scanning device of this embodiment. FIG. 3 is a diagram for explaining processing by a classification unit. FIG. 4 is a diagram for explaining processing by a collection unit. FIG. 5 is a diagram for explaining processing by a target scanning unit. FIG. 6 is a flowchart showing a network scanning processing procedure. FIG. 7 is a diagram showing an example of a computer that executes a network scanning program.

[0012] Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings. Note that the present invention is not limited to this embodiment. In addition, in the description of the drawings, the same parts are designated by the same reference numerals.

[0013] [Outline of Network Scanning Device] FIG. 1 is a diagram illustrating an overview of the network scanning device of this embodiment. The network scanning device of this embodiment efficiently collects seeds for generating scan targets specialized for each application, for example, in an IPv6 network. Specifically, different ports operate for each application. For example, as illustrated in FIG. 1 , in TCP (Transmission Control Protocol), port number 80 is used for web servers, port number 443 is used for TLS servers, and port number 143 is used for mail servers. Therefore, when performing a scan for each application, the network scanning device collects addresses where the ports corresponding to the application operate as seeds.

[0014] Here, a seed is represented by an IP address that is known to be active, i.e., in use as a host, and is used to generate addresses that will be scan targets.

[0015] To achieve this, the network scanning device analyzes port usage trends in the address space, groups similar ports, and shares seeds among similar ports to efficiently collect seeds. Specifically, the network scanning device performs clustering using inter-port distances to classify ports into those operating on the same address and those operating independently on a single address. Then, for each classified cluster, the network scanning device identifies addresses where ports are active and uses them as seeds.

[0016] In this case, for clusters where multiple ports are operating on the same address, the network scanning device selects a representative port and identifies the address where the representative port is active as a seed. This allows for efficient seed collection. Therefore, for example, in the IPv6 Internet, it is possible to efficiently generate targets at low cost by taking into account the operating ports, and it is possible to efficiently perform scans specialized for each application.

[0017] Furthermore, the network scanning device allocates a maximum number of scans (budget) for target scans due to system constraints, etc., to each port in proportion to the number of addresses that each port operates on, enabling more effective scanning of each port.

[0018] The target of the network scanning process by the network scanning device is not limited to an IPv6 network, but may also be an IPv4 network.

[0019] [Configuration of the Network Scanning Device] Fig. 2 is a schematic diagram illustrating the general configuration of the network scanning device of this embodiment. As illustrated in Fig. 2, the network scanning device 10 of this embodiment is realized by a general-purpose computer such as a personal computer, and includes an input unit 11, an output unit 12, a communication control unit 13, a storage unit 14, and a control unit 15.

[0020] The input unit 11 is realized using input devices such as a keyboard and a mouse, and inputs various instruction information such as a command to start processing to the control unit 15 in response to input operations by an operator. The output unit 12 is realized by a display device such as a liquid crystal display, a printing device such as a printer, etc. For example, the output unit 12 displays the results of the network scan processing described below.

[0021] The communication control unit 13 is realized by a NIC (Network Interface Card) or the like, and controls communication between the control unit 15 and external devices via telecommunication lines such as a LAN (Local Area Network) or the Internet. For example, the communication control unit 13 controls communication between the control unit 15 and a management device or the like that manages various types of information.

[0022] The storage unit 14 is realized by a semiconductor memory element such as RAM (Random Access Memory) or flash memory, or a storage device such as a hard disk or optical disk. The storage unit 14 stores in advance the processing programs that operate the network scanning device 10 and data used during the execution of the processing programs, or temporarily stores them each time processing is performed. The storage unit 14 may be configured to communicate with the control unit 15 via the communication control unit 13.

[0023] In this embodiment, the storage unit 14 stores existence-confirmed addresses 14a used in a network scan process described later, operation-confirmed port addresses 14b generated in the network scan process, port clusters 14c, and the like.

[0024] The existence-confirmed addresses 14a are a set of addresses whose existence has been confirmed and obtained, for example, using a Hitlist Service or an ICMP response address in an IPv6 network. Alternatively, the existence-confirmed addresses 14a may be a set of addresses whose existence has been confirmed using a search engine such as Shodan (https: / / www.shodan.io / io / ) in an IPv4 network. The existence-confirmed addresses 14a are obtained in advance and stored in the storage unit 14 prior to the network scan process described below.

[0025] The control unit 15 is implemented using a central processing unit (CPU), a network processor (NP), a field programmable gate array (FPGA), or the like, and executes a processing program stored in memory. As a result, the control unit 15 functions as an acquisition unit 15a, a classification unit 15b, a collection unit 15c, a generation unit 15d, and a target scanning unit 15e, as illustrated in FIG. 2 , to perform network scanning processing. Note that each of these functional units, or some of them, may be implemented on different hardware. For example, the generation unit 15d and the target scanning unit 15e may be implemented on hardware different from the other functional units. The control unit 15 may also include other functional units. Furthermore, each functional unit may perform processing in parallel.

[0026] The acquiring unit 15a acquires the operating addresses and the ports operating on the addresses. For example, the acquiring unit 15a acquires the operating addresses and the ports operating on the addresses by scanning each port of the addresses sampled from the existence-confirmed addresses 14a.

[0027] The acquiring unit 15a stores the acquired operating addresses and the ports operating on the addresses as port operation confirmed addresses 14b in the storage unit 14. The acquiring unit 15a may transfer this information to the subsequent classifying unit 15b or collecting unit 15c without storing it in the storage unit 14.

[0028] Specifically, the acquiring unit 15a acquires active addresses and ports active on the addresses within an address space range corresponding to the processing unit of the network scan processing described below. Here, the network scan processing can be performed in various processing units, such as the entire Internet, for each autonomous system (AS), or for each network prefix.

[0029] The acquiring unit 15a then acquires the sampled addresses from the address space to be processed and the ports operating on those addresses (hereinafter referred to as "port operation confirmed addresses"). For example, in an IPv4 network, the port operation confirmed addresses are acquired using Shodan or the like. In an IPv6 network, the port operation confirmed addresses are acquired by scanning each port of each address sampled from the Hitlist Service or ICMP response address.

[0030] For example, when the entire Internet is the processing unit, the acquiring unit 15a acquires port operation confirmed addresses for addresses sampled from the entire address space. Alternatively, when an AS is the processing unit, the acquiring unit 15a acquires port operation confirmed addresses for addresses sampled from the address space of a target AS. Alternatively, when a prefix is ​​the processing unit, the acquiring unit 15a acquires port operation confirmed addresses for addresses sampled from the address space of a target prefix.

[0031] The classification unit 15b classifies the ports operating on the acquired operating addresses into clusters according to the similarity of the addresses on which each port operates. For example, the classification unit 15b classifies the ports operating on the acquired operating addresses into clusters according to the similarity of the sets of addresses on which each port operates.

[0032] 3 is a diagram for explaining the processing of the classification unit. Specifically, the classification unit 15b classifies the port ｘ A set of addresses where ｘ , and the set similarity indexes Jaccard coefficient and Simpson coefficient are used to calculate the similarity between any two ports as shown in the following equation (1). ｉ , port ｊ Distance between ports K ｉｊ Calculate.

[0033]

[0034] Here, there are two address sets A ｉ , A ｊIf only a small number of addresses from one group are included in the other group, the Simpson coefficient will be excessively large, while the Jaccard coefficient will ignore the influence of the small number of common addresses. Therefore, the classification unit 15b calculates the similarity using the arithmetic mean of the Jaccard coefficient and the Simpson coefficient.

[0035] The classification unit 15b also uses a clustering algorithm, such as DBSCAN (https: / / file.biolab.si / papers / 1996 DBSCAN KDD.pdf), to classify the ports of the port operation confirmed addresses 14b into clusters as shown in Figure 3 (step S21). That is, the classification unit 15b classifies ports such that ports whose calculated similarity is within a predetermined threshold value belong to the same cluster. The classification unit 15b associates the clusters with the ports belonging to each cluster and stores them in the storage unit 14 as port clusters 14c.

[0036] This allows ports with similar port usage trends, such as those operating on the same address, to be classified into the same cluster. In this case, DBSCAN, which does not require the number of clusters to be specified, is suitable because the number of clusters depends on the port usage trends of each prefix. However, this is not limited to DBSCAN, and other clustering methods may also be used.

[0037] The clusters that are classified also include clusters that consist of independent ports, meaning that it is possible to identify independent operating ports that are not classified into any cluster.

[0038] Examples of clusters include web-related ports TCP / 80 (HTTP) and TCP / 443 (HTTPS), and email-related ports TCP / 110 (POP3), TCP / 143 (IMAP), TCP / 995 (POP3S), and TCP / 993 (IMAPS). Examples of independently operating ports include TCP / 23 (Telnet) and TCP / 179 (BGP).

[0039] Returning to the description of FIG. 2 , the collection unit 15c uses a representative port selected from each classified cluster to collect addresses at which the port is active as seeds. Here, FIG. 4 is a diagram for explaining the processing of the collection unit. For example, as illustrated in FIG. 4 , the collection unit 15c selects, for each port in each cluster, the port at which the port is active among the acquired port operation confirmed addresses 14b as the representative port (steps S31 to S32). That is, the collection unit 15c lists the addresses at which each port is active among the addresses in the port operation confirmed addresses 14b, counts the number of addresses, and selects the port with the largest number as the representative port. For an independently operating port, the port can be treated as the representative port.

[0040] The collection unit 15c also scans the selected representative port of the presence-confirmed addresses 14a, which is a set of presence-confirmed addresses in the address space or ICMP response addresses, and collects the address at which the port is active as a seed (steps S33 to S34). That is, the collection unit 15c sets an address that has responded to the scan and is found to be active as a seed.

[0041] At this time, the collection unit 15c scans the ports of the existence-confirmed addresses 14a in descending order of the number of addresses for which each representative port is active among the port operation-confirmed addresses 14b (step S33). Alternatively, if the number of addresses for which each representative port is active among the port operation-confirmed addresses 14b is less than a predetermined threshold, the collection unit 15c may exclude the ports of the existence-confirmed addresses 14a from the targets of the scan.

[0042] Furthermore, the collection unit 15c collects addresses at which each port operates as seeds, up to a predetermined number of times or a predetermined number. That is, the collection unit 15c repeats scanning of each representative port of the existence-confirmed addresses 14a within a predetermined budget based on system constraints (steps S34 to S36). Alternatively, the collection unit 15c may repeat scanning of each representative port of the existence-confirmed addresses 14a until a predetermined number of seeds are collected. In this case, the seed collection process may be terminated when the budget range or the number of collected seeds is reached, whichever comes first.

[0043] The budget, which is the upper limit of the number of scans, is determined by system constraints, etc. This budget for the entire system is divided into a scan budget for acquiring port operation confirmed addresses by the acquiring unit 15a, a scan budget for seed collection by the collecting unit 15c, and a scan budget for the target scanning unit 15e, which will be described later.

[0044] That is, the budget for scanning for seed collection by the collecting unit 15c may be determined by subtracting the budget for scanning by the target scanning unit 15e and the number of scans consumed by the acquiring unit 15a from the budget for the entire system. Furthermore, if there is a surplus in the budget for scanning for seed collection by the collecting unit 15c, it may be used for scanning by the target scanning unit 15e.

[0045] The collection unit 15c may store the collected seed group in the storage unit 14, or may present the collected seed group to the output unit 12 as a network scan processing result (seed collection processing result).

[0046] Returning to the description of FIG. 2, the generation unit 15d generates scan targets using the collected seeds. For example, the generation unit 15d generates scan targets from the seeds using a target generation algorithm such as Entropy / IP (see Non-Patent Document 1), 6Gen (see Non-Patent Document 2), or 6Tree (https: / / www.sciencedirect.com / science / article / abs / pii / S1389128618312003).

[0047] The target scanning unit 15e scans the generated target and analyzes the response packet. For example, the target scanning unit 15e scans the target using a packet transmission / reception program implemented in the Python Scapy library (https: / / scapy.net) or a high-speed scanning tool such as ZMap (https: / / www.usenix.org / conference / usenixsecurity13 / technical sessions / paper / durumeric).

[0048] 5 is a diagram illustrating the processing of the target scanning unit. As illustrated in FIG. 5, when allocating a budget for scanning a target to each port, the target scanning unit 15e determines the scanning budget for each port according to the ratio of the number of addresses corresponding to each port in the port operation confirmed address 14b (step S41). This allows for efficient port-by-port scanning with priority given to effective ports, thereby enabling more efficient target scanning.

[0049] For example, if a previous scan of another port of the same address returns data indicating that the address is active or a rejection message, the target scanning unit 15e may prioritize that address and select it as the target of the scan. Furthermore, for example, the target scanning unit 15e may not prioritize an address that returned an error or no response in a previous scan of another port of the same address.

[0050] Furthermore, the target scanning unit 15e may store the analysis results in the storage unit 14, or may present the results to the output unit 12 as target scanning processing results.

[0051] In this way, the target scanning unit 15e of the network scanning device 10 can perform a scan of a target that is specific to an application and takes into account ports, thereby enabling efficient scanning.

[0052] [Network Scanning Process] Next, the network scanning process performed by the network scanning device 10 according to this embodiment will be described with reference to Fig. 6. Fig. 6 is a flowchart showing the network scanning process procedure. The flowchart in Fig. 6 starts, for example, when the user performs an operation input to instruct the start of the process.

[0053] First, the acquiring unit 15a acquires the operating addresses and the ports operating on the addresses (step S1). For example, the acquiring unit 15a acquires the operating addresses and the ports operating on the addresses by scanning each port of the addresses sampled from the existence confirmed addresses 14a.

[0054] Next, the classification unit 15b classifies the ports operating on the acquired operating addresses into clusters according to the similarity of the addresses on which each port operates (step S2). For example, the classification unit 15b classifies the ports operating on the acquired operating addresses into clusters according to the similarity of the sets of addresses on which each port operates.

[0055] Specifically, the classification unit 15b classifies the port ｘ A set of addresses where ｘ , and the set similarity index Jaccard coefficient, Simpson coefficient, and ｉ , port ｊ Distance between ports K ｉｊThe classification unit 15b also classifies the ports of the port operation confirmed addresses 14b into clusters according to the calculated similarities, using, for example, DBSCAN as a clustering algorithm.

[0056] Next, the collection unit 15c uses a representative port selected from each of the classified clusters to collect addresses at which the port operates as seeds (step S3).

[0057] At this time, the collection unit 15c collects, as seeds, the addresses at which the acquired ports are active in descending order of the number of addresses at which the acquired ports are active.

[0058] The generation unit 15d then generates scan targets using the collected seeds (step S4). The target scanning unit 15e then scans the generated targets (step S5). At this time, the target scanning unit 15e determines a budget for scanning the targets based on the ratio of the acquired number of addresses at each active port. For example, when allocating the budget for scanning the targets to each port, the target scanning unit 15e determines the scan budget for each port based on the ratio of the number of addresses corresponding to each port in the port operation confirmed address 14b. This completes the series of network scanning processes.

[0059] [Effects] As described above, in the network scanning device 10 of this embodiment, the acquisition unit 15a acquires operating addresses and ports operating on those addresses. The classification unit 15b classifies the ports operating on the acquired operating addresses into clusters according to the similarity of the addresses on which each port operates. The collection unit 15c uses a representative port selected from each classified cluster to collect the addresses on which the representative port operates as seeds.

[0060] Specifically, the classification unit 15b classifies the ports operating on the acquired operating addresses into clusters according to the similarity of the set of addresses on which each port operates.

[0061] Furthermore, for each port in each cluster, the collection unit 15c selects, as a representative port from each cluster, the port for which the port has the largest number of addresses in the acquired port operation confirmed addresses 14b at which the port operates.

[0062] The collection unit 15c also collects addresses at which each port operates as seeds by scanning the representative ports selected for the presence-confirmed addresses in the address space or the presence-confirmed addresses 14a, which are ICMP response addresses.

[0063] This allows the network scanning device 10 to group ports that operate on the same address and have similar usage trends and share seeds between similar ports, thereby enabling efficient and cost-effective seed collection for generating scan targets. Therefore, it is possible to efficiently perform scans specialized for each application, taking into account the ports on which they operate. For example, it is possible to efficiently discover hosts that use vulnerable applications or hosts that use compromised encryption keys, and to conduct actual surveys such as the prevalence of protocols.

[0064] Furthermore, the collection unit 15c collects addresses at which each port operates as seeds up to a predetermined number of times or a predetermined number as an upper limit, thereby enabling efficient seed collection within the scope of system constraints, etc.

[0065] The generation unit 15d also generates targets using seeds, which are addresses at which the collected ports are active. The target scanning unit 15e performs a scan on the generated targets. At this time, the target scanning unit 15e determines a budget, which is an upper limit on the number of target scans, in accordance with the ratio of the number of addresses at which each acquired port is active. This allows the network scanning device 10 to prioritize effective ports and perform target scans efficiently, thereby enabling even more efficient target scans.

[0066] [Program] A program written in a computer-executable language may be created to execute the processes performed by the network scanning device 10 according to the above embodiment. In one embodiment, the network scanning device 10 can be implemented by installing a network scanning program that executes the above network scanning process as package software or online software on a desired computer. For example, by executing the above network scanning program on an information processing device, the information processing device can function as the network scanning device 10. The information processing device referred to here includes desktop and notebook personal computers. Other examples of information processing devices include mobile communication terminals such as smartphones, mobile phones, and PHS (Personal Handyphone System) phones, as well as slate terminals such as PDAs (Personal Digital Assistants). The functions of the network scanning device 10 may also be implemented on a cloud server.

[0067] 7 is a diagram showing an example of a computer that executes a network scan program. The computer 1000 includes, for example, a memory 1010, a CPU 1020, a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. These components are connected by a bus 1080.

[0068] The memory 1010 includes a ROM (Read Only Memory) 1011 and a RAM 1012. The ROM 1011 stores a boot program such as a BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to a hard disk drive 1031. The disk drive interface 1040 is connected to a disk drive 1041. A removable storage medium such as a magnetic disk or optical disk is inserted into the disk drive 1041. The serial port interface 1050 is connected to a mouse 1051 and a keyboard 1052, for example. The video adapter 1060 is connected to a display 1061, for example.

[0069] Here, the hard disk drive 1031 stores, for example, an OS (Operating System) 1091, an application program 1092, a program module 1093, and program data 1094. The various pieces of information described in the above embodiments are stored in the hard disk drive 1031 or the memory 1010, for example.

[0070] The network scanning program is stored in the hard disk drive 1031 as a program module 1093 in which instructions to be executed by the computer 1000 are written. Specifically, the program module 1093 in which each process executed by the network scanning device 10 described in the above embodiment is written is stored in the hard disk drive 1031.

[0071] Data used for information processing by the network scan program is stored as program data 1094, for example, in the hard disk drive 1031. Then, the CPU 1020 reads the program module 1093 and program data 1094 stored in the hard disk drive 1031 into the RAM 1012 as necessary, and executes each of the above-described procedures.

[0072] The program module 1093 and program data 1094 related to the network scan program are not limited to being stored in the hard disk drive 1031, but may be stored in a removable storage medium, for example, and read by the CPU 1020 via the disk drive 1041. Alternatively, the program module 1093 and program data 1094 related to the network scan program may be stored in another computer connected via a network such as a LAN or a WAN (Wide Area Network), and read by the CPU 1020 via the network interface 1070.

[0073] Although the present invention has been described above as an embodiment, the present invention is not limited to the description and drawings that form part of the disclosure of the present invention. In other words, other embodiments, examples, and operational techniques that can be made by those skilled in the art based on the present invention are all included in the scope of the present invention.

[0074] REFERENCE SIGNS LIST 10 Network scanning device 11 Input unit 12 Output unit 13 Communication control unit 14 Storage unit 14a Existence confirmed address 14b Port operation confirmed address 14c Port cluster 15 Control unit 15a Acquisition unit 15b Classification unit 15c Collection unit 15d Generation unit 15e Target scanning unit

Claims

1. A network scanning device comprising: an acquisition unit that acquires operating addresses and ports operating on those addresses; a classification unit that classifies the acquired ports into clusters according to the similarity of the addresses on which each port operates; and a collection unit that collects the addresses on which the ports operate by using ports selected from each classified cluster.

2. A network scanning device according to claim 1, characterized in that the classification unit classifies the acquired ports into clusters according to the similarity of the set of addresses on which each port operates.

3. The network scanning device according to claim 1, wherein the collection unit selects, for each port in each cluster, the port that has the largest number of addresses on which the acquired port operates.

4. A network scanning device according to claim 1, characterized in that the collection unit collects the addresses by scanning the selected port of an address space whose existence has been confirmed or an ICMP response address.

5. The network scanning device according to claim 4, wherein the collection unit collects the addresses a predetermined number of times or up to a predetermined number.

6. A network scanning device as described in claim 1, further comprising: a generation unit that generates targets using the addresses on which the collected ports are operating; and a target scanning unit that performs a scan on the generated targets, wherein the target scanning unit determines an upper limit on the number of scans in accordance with the ratio of the number of addresses on which each of the acquired ports is operating.

7. A network scanning method executed by a network scanning device, comprising: an acquisition step of acquiring operating addresses and ports operating on the addresses; a classification step of classifying the acquired ports into clusters according to the similarity of the addresses on which each port operates; and a collection step of collecting the addresses on which the ports operate, using ports selected from each classified cluster.

8. A network scan program for causing a computer to execute the following steps: an acquisition step of acquiring operating addresses and ports operating on the addresses; a classification step of classifying the acquired ports into clusters according to the similarity of the addresses on which each port operates; and a collection step of collecting addresses on which the ports operate, using ports selected from each classified cluster.

Images