D 2018

Assessing Internet-wide Cyber Situational Awareness of Critical Sectors

HUSÁK, Martin; Nataliia NESHENKO; Morteza SAFAEI POUR; Elias BOU-HARB; Pavel ČELEDA et al.

Základní údaje

Originální název

Assessing Internet-wide Cyber Situational Awareness of Critical Sectors

Autoři

HUSÁK, Martin; Nataliia NESHENKO; Morteza SAFAEI POUR; Elias BOU-HARB a Pavel ČELEDA

Vydání

Hamburg, Proceedings of the 13th International Conference on Availability, Reliability and Security, od s. "29:1"-"29:6", 6 s. 2018

Nakladatel

ACM

Další údaje

Jazyk

angličtina

Typ výsledku

Stať ve sborníku

Utajení

není předmětem státního či obchodního tajemství

Forma vydání

elektronická verze "online"

Odkazy

URL

Označené pro přenos do RIV

Ano

Kód RIV

RIV/00216224:14610/18:00102646

Organizace

Ústav výpočetní techniky – Masarykova univerzita – Repozitář

ISBN

978-1-4503-6448-5

UT WoS

000477981800057

EID Scopus

2-s2.0-85055250105

Klíčová slova anglicky

network security; network scanning; DDoS; critical infrastructure

Návaznosti

EF16_019/0000822, projekt VaV.
Změněno: 5. 9. 2020 16:09, RNDr. Daniel Jakubík

Anotace

V originále

In this short paper, we take a first step towards empirically assessing Internet-wide malicious activities generated from and targeted towards Internet-scale business sectors (i.e., financial, health, education, etc.) and critical infrastructure (i.e., utilities, manufacturing, government, etc.). Facilitated by an innovative and a collaborative large-scale effort, we have conducted discussions with numerous Internet entities to obtain rare and private information related to allocated IP blocks pertaining to the aforementioned sectors and critical infrastructure. To this end, we employ such information to attribute Internet-scale maliciousness to such sectors and realms, in an attempt to provide an in-depth analysis of the global cyber situational posture. We draw upon close to 16.8 TB of darknet data to infer probing activities (typically generated by malicious/infected hosts) and DDoS backscatter, from which we distill IP addresses of victims. By executing week-long measurements, we observed an alarming number of more than 11,000 probing machines and 300 DDoS attack victims hosted by critical sectors. We also generate rare insights related to the maliciousness of various business sectors, including financial, which typically do not report their hosted and targeted illicit activities for reputation-preservation purposes. While we treat the obtained results with strict confidence due to obvious sensitivity reasons, we postulate that such generated cyber threat intelligence could be shared with sector/critical infrastructure operators, backbone networks and Internet service providers to contribute to the overall threat remediation objective.
Zobrazeno: 6. 5. 2026 19:16