publications

2026

1. Characterizing Global IPv6 Scanning Activities via Proactive Network Telescopes

   Liang Zhao

   The Graduate University for Advanced Studies, SOKENDAI, Sep 2026

   Ph.D. dissertation
2. Comparing IPv4 and IPv6 Scanning Activities in the Wild: A Cross-Protocol and Cross-Exposure Study

   Liang Zhao, Satoru Kobayashi, and Kensuke Fukuda

   In Proc. CNSM 2026 (mini-conference track), Oct 2026

   Accepted

2025

1. Exposed in the Pool: An Analysis of IPv6 NTP Server Scanning Activities

   Liang Zhao, Satoru Kobayashi, and Kensuke Fukuda

   In Proc. IEEE GLOBECOM 2025, Dec 2025

   HTML
2. Insights into the IPv6 Scanning Landscape: An Extended Study Using Passive Darknets and Responsive Honeynets with Prefix Exposing Techniques

   Liang Zhao, Satoru Kobayashi, and Kensuke Fukuda

   IEICE TRANSACTIONS on Communications, Aug 2025

2024

1. Exploring IPv6 Scanning Activities and Prefix Discovery

   Liang Zhao

   Jun 2024

   APNIC Blog (invited guest post)

   HTML
2. Exploring the Discovery Process of Fresh IPv6 Prefixes: An Analysis of Scanning Behavior in Darknet and Honeynet

   Liang Zhao, Satoru Kobayashi, and Kensuke Fukuda

   In Passive and Active Measurement, Jun 2024

   Abs HTML

   Internet-wide scanners can efficiently scan the expansive IPv6 network by targeting the active prefixes and responsive addresses on the hitlists. However, it is not clear enough how scanners discover fresh prefixes, which include newly assigned or deployed prefixes, as well as previously unused ones. This paper studies the whole discovery process of fresh prefixes by scanners. We implement four DNS-based address-exposing methods, analyze the arrival sequence of scans from distinct ASes, and examine the temporal and spatial scan patterns, with darknet and honeynet. Over six months, our custom-made darknet and probabilistic responsive honeynet collected 33 M packets (1.8 M sessions) of scans from 116 distinct ASes and 18.8 K unique source IP addresses. We investigate the whole process of fresh prefix discovery, including address-exposing, initial probing, hitlist registration, and large-scale scan campaigns. Furthermore, we analyze the difference in scanning behavior by ASes, and categorize the scanners into three types, honeynet-exclusive, honeynet-predominant and balanced, based on the respective ratio of scans to darknet and honeynet. Besides, we analyze the intentions of scanners, such as network reconnaissance or scanning responsive targets, and the methods they used to obtain potential targets, such as by sending DNS queries or using public hitlist. These findings bring insights into the process of fresh prefixes attracting scanners and highlight the vital role of responsive honeynet in analyzing scanner behaviors.

2023

1. Design and Implementation of IPv6 Scan Detection System

   Zhao Liang, Kobayashi Satoru, and Fukuda Kensuke

   IEICE General Conference, Mar 2023

2021

1. AoI-aware Information Update Scheduling and Caching for Internet-of-Things Systems

   Zhao Liang, Chiang Yi-Han, Lui John C.S., and 1 more author

   awaiting publication, Mar 2021

2018

1. Bitrate Adaptation based on Available-Bandwidth Estimation in Video Streaming over NDN

   Zhao Liang, and Aida Hitoshi

   NS/IN, Mar 2018