D 2018

Assessing Internet-wide Cyber Situational Awareness of Critical Sectors

HUSÁK, Martin; Nataliia NESHENKO; Morteza SAFAEI POUR; Elias BOU-HARB; Pavel ČELEDA et al.

Basic information

Original name

Assessing Internet-wide Cyber Situational Awareness of Critical Sectors

Authors

HUSÁK, Martin; Nataliia NESHENKO; Morteza SAFAEI POUR; Elias BOU-HARB and Pavel ČELEDA

Edition

Hamburg, Proceedings of the 13th International Conference on Availability, Reliability and Security, p. "29:1"-"29:6", 6 pp. 2018

Publisher

ACM

Other information

Language

English

Type of outcome

Proceedings paper

Confidentiality degree

is not subject to a state or trade secret

Publication form

electronic version available online

References:

URL

Marked to be transferred to RIV

Yes

RIV identification code

RIV/00216224:14610/18:00102646

Organization

Ústav výpočetní techniky – Repository – Repository

ISBN

978-1-4503-6448-5

UT WoS

000477981800057

EID Scopus

2-s2.0-85055250105

Keywords in English

network security; network scanning; DDoS; critical infrastructure

Links

EF16_019/0000822, research and development project.
Changed: 5/9/2020 16:09, RNDr. Daniel Jakubík

Abstract

In the original language

In this short paper, we take a first step towards empirically assessing Internet-wide malicious activities generated from and targeted towards Internet-scale business sectors (i.e., financial, health, education, etc.) and critical infrastructure (i.e., utilities, manufacturing, government, etc.). Facilitated by an innovative and a collaborative large-scale effort, we have conducted discussions with numerous Internet entities to obtain rare and private information related to allocated IP blocks pertaining to the aforementioned sectors and critical infrastructure. To this end, we employ such information to attribute Internet-scale maliciousness to such sectors and realms, in an attempt to provide an in-depth analysis of the global cyber situational posture. We draw upon close to 16.8 TB of darknet data to infer probing activities (typically generated by malicious/infected hosts) and DDoS backscatter, from which we distill IP addresses of victims. By executing week-long measurements, we observed an alarming number of more than 11,000 probing machines and 300 DDoS attack victims hosted by critical sectors. We also generate rare insights related to the maliciousness of various business sectors, including financial, which typically do not report their hosted and targeted illicit activities for reputation-preservation purposes. While we treat the obtained results with strict confidence due to obvious sensitivity reasons, we postulate that such generated cyber threat intelligence could be shared with sector/critical infrastructure operators, backbone networks and Internet service providers to contribute to the overall threat remediation objective.
Displayed: 6/5/2026 20:11