Liang Zhao

Tokyo, Japan

I received my Ph.D. in Informatics from the Graduate Institute for Advanced Studies, SOKENDAI (National Institute of Informatics, Tokyo, Japan) in September 2026, advised by Prof. Kensuke Fukuda. Before that, I received my bachelor’s and master’s degrees from the University of Tokyo.

My doctoral research characterized global IPv6 scanning activities via proactive network telescopes. I designed and operated an IPv6-native hybrid telescope — a passive darknet paired with a responsive honeynet — continuously for nearly three years, and used controlled exposure (DNS, NTP Pool) to study how Internet scanners discover fresh IPv6 prefixes and how their behavior differs across exposure mechanisms and protocol versions (IPv4 vs. IPv6). Before that, I also worked on Age of Information in IoT systems, Named Data Networking, video streaming and data caching.

My research interests include:

Network threat defense: deception technology (honeypots, darknets), proactive threat hunting
Network measurement: IPv6/IPv4 scanning, Internet-scale traffic analysis
High-performance networking: programmable data planes (P4), RDMA, eBPF, congestion control
Systems for AI: in-network gradient aggregation, KV-cache transport for LLM inference

news

Sep 17, 2026	I have officially received my Ph.D. in Informatics from SOKENDAI (National Institute of Informatics). My dissertation is titled “Characterizing Global IPv6 Scanning Activities via Proactive Network Telescopes.” Many thanks to my advisor Prof. Kensuke Fukuda and to Prof. Satoru Kobayashi for their guidance and support!
Aug 27, 2026	Our research, ‘Comparing IPv4 and IPv6 Scanning Activities in the Wild: A Cross-Protocol and Cross-Exposure Study,’ has been accepted at CNSM 2026.
Nov 1, 2025	Our research, ‘Exposed in the Pool: An Analysis of IPv6 NTP Server Scanning Activities,’ is going to be published at Globecom 2025.
Aug 5, 2025	Our research, ‘Insights into the IPv6 Scanning Landscape: An Extended Study Using Passive Darknets and Responsive Honeynets with Prefix Exposing Techniques,’ has been published on the IEICE Transactions on Communications.
Jul 10, 2025	I have been awarded an ACM SIGCOMM 2025 Student Travel Grant. Looking forward to attending SIGCOMM 2025!

latest posts

selected publications

Exploring the Discovery Process of Fresh IPv6 Prefixes: An Analysis of Scanning Behavior in Darknet and Honeynet

Liang Zhao, Satoru Kobayashi, and Kensuke Fukuda

In Passive and Active Measurement, 2024

Abs HTML

Internet-wide scanners can efficiently scan the expansive IPv6 network by targeting the active prefixes and responsive addresses on the hitlists. However, it is not clear enough how scanners discover fresh prefixes, which include newly assigned or deployed prefixes, as well as previously unused ones. This paper studies the whole discovery process of fresh prefixes by scanners. We implement four DNS-based address-exposing methods, analyze the arrival sequence of scans from distinct ASes, and examine the temporal and spatial scan patterns, with darknet and honeynet. Over six months, our custom-made darknet and probabilistic responsive honeynet collected 33 M packets (1.8 M sessions) of scans from 116 distinct ASes and 18.8 K unique source IP addresses. We investigate the whole process of fresh prefix discovery, including address-exposing, initial probing, hitlist registration, and large-scale scan campaigns. Furthermore, we analyze the difference in scanning behavior by ASes, and categorize the scanners into three types, honeynet-exclusive, honeynet-predominant and balanced, based on the respective ratio of scans to darknet and honeynet. Besides, we analyze the intentions of scanners, such as network reconnaissance or scanning responsive targets, and the methods they used to obtain potential targets, such as by sending DNS queries or using public hitlist. These findings bring insights into the process of fresh prefixes attracting scanners and highlight the vital role of responsive honeynet in analyzing scanner behaviors.