# An Efficient Internet-Wide Scan Approach Based on Location Awareness
## 4 Proposed Approach
### Approach  
The method has two main objectives. One is to allow each scanning node to perform tasks according to its expertise based on its geographical location. The second is to ensure load balancing among the scanning nodes. As mentioned above, to achieve these two goals, we divide the method into two parts: clustering and grouping of scanner clusters and load balancing within and between clusters. In clustering and grouping of scanner nodes, the main factor is the geographical location of the scanners. However, due to the large number of countries in the world, we need to implement global IP address scanning at a limited number of scanning origin locations. Therefore, we need to introduce a similarity matrix (S\({}_{\text{m,n}}\)) to quantify the scanning similarity between regions, where M is the number of geographic locations of scanners and N is the number of countries in the world. The similarity of each region in the initial similarity matrix can be derived from the time delay of the historical scan data. In order to solve the problem of inaccurate similarity due to long actual scanning delay, the similarity matrix is updated periodically based on the average value of the scanning results, and the process is shown in Figure 3. The similarity between each country (S\({}_{\text{ij}}\)) can be expressed by using the total number of IP addresses scanned from country i to country j (N\({}_{\text{i,j}}\)) versus the total time required for country i to scan country j (T\({}_{\text{i,j}}\)). Specifically, see the following equation:  
\[\text{S}_{\text{i,j}}=\frac{\text{N}_{\text{i,j}}}{\text{T}_{\text{i,j}}} \tag{2}\]  
When the average scanning time is smaller, the similarity between the two countries increases. When a scanning task arrives, in order to allow each scanner cluster to scan IP addresses from the same country it is located in, the task is first divided into multiple subtasks based on the countries where the IP addresses are located. The most suitable scanner cluster is then selected by querying the similarity matrix for each subtask's corresponding country. However, task allocation solely based on geographic location can lead to load imbalance among scanning nodes. To address this issue, we adopt a three-layer load-balancing mechanism. The first layer is task matching with scanner clusters. When a scanning task arrives, the central server divides the task into several subtasks based on geographic location. When assigning tasks to scanner clusters, the priority is given to those clusters with high similarity and low load. Specifically, based on the similarity matrix, the server checks the workload of scanner clusters in descending order of similarity to the geographic location of the task. If the workload of a particular cluster is below a predefined threshold, the task is assigned to that cluster. By considering both similarity and workload when assigning scanning tasks, this mechanism avoids situations where some servers are idle while others are overloaded due to an excessive task volume from one country. The second layer is collaborative scanning between scanner clusters, as shown in Figure 4. During task execution, some scanner clusters may have faster scanning speeds than others, leading to the possibility of idle clusters. When a scanner cluster is idle, it will check the workload status of other clusters in sequence according to the similarity matrix. If another cluster is busy, the scanning nodes of both clusters will merge to jointly execute the task. This process will be repeated whenever an idle cluster is found, until all clusters are in a busy state, thereby improving the scanning efficiency of the busy clusters. The third layer is load balancing among scanning nodes within a cluster, as shown in Figure 5. To achieve load balancing within a cluster, we construct a task queue that stores and distributes scanning tasks. If the task queue is not empty, scanning nodes within the cluster will sequentially fetch tasks from the queue.