Search arXiv⌕ Search
Home/Archive/arXiv

arXiv · 2009.12754

Addressless: A New Internet Server Model to Prevent Network Scanning

Shanshan Hao·Renjie Liu·Zhe Weng·Deliang Chang·Congxiao Bao·Xing Li
View original source ↗Read source document ↗Export metadata ↓

Abstract

Eliminating unnecessary exposure is a principle of server security. The huge IPv6 address space enhances security by making scanning infeasible, however, with recent advances of IPv6 scanning technologies, network scanning is again threatening server security. In this paper, we propose a new model named addressless server, which separates the server into an entrance module and a main service module, and assigns an IPv6 prefix instead of an IPv6 address to the main service module. The entrance module generates a legitimate IPv6 address under this prefix by encrypting the client address, so that the client can access the main server on a destination address that is different in each connection. In this way, the model provides isolation to the main server, prevents network scanning, and minimizes exposure. Moreover it provides a novel framework that supports flexible load balancing, high-availability, and other desirable features. The model is simple and does not require any modification to the client or the network. We implement a prototype and experiments show that our model can prevent the main server from being scanned at a slight performance cost.

Explore related subjects

cs.NI

Keep this discovery

Explore connections, maps & timelines

BibTeXRIS

Shanshan Hao, Renjie Liu, Zhe Weng, Deliang Chang, Congxiao Bao, Xing Li. 2020-09-27. Addressless: A New Internet Server Model to Prevent Network Scanning. https://doi.org/10.1371/journal.pone.0246293

Cite the original work for its findings. Save a collection to share your selection of sources.

KEEP EXPLORING

Related papers

arXiv2026

Where Have All the Firewalls Gone? Security Consequences of Residential IPv6 Transition

IPv4 NAT has limited the spread of IoT botnets considerably by default-denying bots' incoming connection requests to in-home devices unless the owner has explicitly allowed them. As the Internet transitions to majority IPv6, however, residential connections no longer require the use of NAT. This paper therefore asks: has the transition from IPv4 to IPv6 ultimately made residential networks more vulnerable to attack, thereby empowering the next generation of IPv6-based IoT botnets? To answer this question, we introduce a large-scale IPv6 scanning methodology that, unlike those that rely on computationally intensive algorithms, can be run on low-resource devices common in IoT botnets. We use this methodology to perform the largest-scale measurement of IPv6 residential networks to date, and compare which devices are publicly accessible to comparable IPv4 networks. We received responses from 93,832,220 distinct IPv6 addresses, 14,901,892 of which are inside of residential networks (i.e., not the external-facing gateway IP). These residential network internal addresses span 4,412 ASes across 144 countries. These responses come from protocols commonly exploited by IoT botnets (including telnet and FTP), as well as protocols typically associated with end-user devices (including iPhone-Sync and IPP). Compared with IPv4, we reach 11x more HP printers over IPv6 than Shodan finds across the entire IPv4 Internet, and thousands of iPhones and smart lights whose services IPv4 NAT made unreachable by default. Collectively, our results show that NAT has indeed acted as the de facto firewall of the Internet, and the IPv4-to-IPv6 transition of residential networks is opening up new devices to attack. Finally, we discuss potential mitigations to prevent in-home network reachability as IPv6 adoption continues to grow.

cs.NI↗
arXiv2026

Burst-mode timing recovery based on fourth-power phase detector for passive optical networks

Driven by the ever-increasing capacity demands, 50G passive optical network (50G-PON) is ready for practical application. It is highly challenging to realize 50GHz burst-mode analog components; therefore, based on 25GHz burst-mode analog devices, burst-mode digital signal processing (DSP) is introduced to achieve the reception and processing of 50Gb/s on-off keying burst signals. To optimize the power consumption and area of the DSP chip, a one-sample-per-symbol (1-SPS) analog-to-digital converter has been applied in 50G-PON. One of the main challenges is implementing burst-mode timing recovery (BM-TR) for the 1-SPS burst signal in 50G-PON. In this paper, we first propose a BM-TR based on the fourth-power phase detector (4PPD) for 50G-PON. We mathematically verify that 4PPD can directly compute the timing phase offset (TPO) from the 1-SPS signal without using training sequences, allowing for immediate BM-TR initialization within 20 cycles to prevent long convergence times. After the initialization, the feedback loop structure tracks the TPO changes based on the sign of 4PPD, the loop filter, and the numerically controlled oscillator. In conclusion, training-sequence-free 4PPD-based BM-TR achieves low burst overhead via fast convergence and is particularly effective for handling burst signals in 50G-PON.

cs.NI↗
arXiv2026

AI-Native Open RAN: A Roadmap from xApps and rApps to Autonomous Network Agents

Open Radio Access Networks (O-RAN) have emerged as a transformative paradigm for future wireless systems by introducing openness, virtualization, disaggregation, and programmable intelligence through the RAN Intelligent Controller (RIC). The availability of standardized interfaces and near-real-time control loops has created unprecedented opportunities for integrating artificial intelligence (AI) into radio access network management and optimization. Over the past several years, a broad range of AI techniques have been proposed to address key O-RAN challenges such as radio resource management, network slicing, traffic prediction, mobility management, interference mitigation, and spectrum sharing. Despite significant progress, existing solutions often remain task-specific, require extensive retraining, and exhibit limited generalization across deployment environments and network conditions. This paper presents a comprehensive review of AI-enabled O-RAN systems and provides a unifying perspective on the evolution of intelligence in wireless networks. We first examine the O-RAN architecture and the role of intelligence within near-real-time and non-real-time RIC frameworks. We then develop a taxonomy of AI approaches for O-RAN, covering machine learning, deep reinforcement learning (DRL), digital-twin-assisted optimization, and emerging foundation-model-based architectures.

cs.NI↗