Assessing Internet-wide Cyber Situational Awareness of Critical Sectors

Abstract

In this short paper, we take a first step towards empirically assessing Internet-wide malicious activities generated from and targeted towards Internet-scale business sectors (i.e., financial, health, education, etc.) and critical infrastructure (i.e., utilities, manufacturing, government, etc.). Facilitated by an innovative and a collaborative large-scale effort, we have conducted discussions with numerous Internet entities to obtain rare and private information related to allocated IP blocks pertaining to the aforementioned sectors and critical infrastructure. To this end, we employ such information to attribute Internet-scale maliciousness to such sectors and realms, in an attempt to provide an in-depth analysis of the global cyber situational posture. We draw upon close to 16.8 TB of darknet data to infer probing activities (typically generated by malicious/infected hosts) and DDoS backscatter, from which we distill IP addresses of victims. By executing week-long measurements, we observed an alarming number of more than 11,000 probing machines and 300 DDoS attack victims hosted by critical sectors. We also generate rare insights related to the maliciousness of various business sectors, including financial, which typically do not report their hosted and targeted illicit activities for reputation-preservation purposes. While we treat the obtained results with strict confidence due to obvious sensitivity reasons, we postulate that such generated cyber threat intelligence could be shared with sector/critical infrastructure operators, backbone networks and Internet service providers to contribute to the overall threat remediation objective. CCS CONCEPTS• Security and privacy → Network security; Intrusion/anomaly detection and malware mitigation; Denial-of-service attacks; KEYWORDS network security, network scanning, DDoS, critical infrastructure ARES

Hypersparse Neural Network Analysis of Large-Scale Internet Traffic

“…On a given day, millions of IPs are engaged in scanning behavior. Our improved models can aid cybersecurity analysts in determining which of these IPs are nefarious [50], the distribution of attacks in particular critical sectors [51], identifying spamming behavior [52], how to vacinate against computer viruses [53], obscuring web sources [54], identifying significant flow aggregates in traffic [55], and sources of rumors [56].…”

Separating privacy and security in online decision-making process: The case of Venmo

“…Apple Pay, PayPal, Samsung Pay, Amazon Pay, and Google Pay follow behind [32]. Although, the Department of Homeland Security classifies financial services as critical sectors [33] and the market for digital wallets becomes increasingly populated, some platforms, such as Ali Pay and WeChat Pay, are exploring the opportunity to merge the financial services with online social media features. Users can publicly post their financial transactions just like they publicly share or get the bill at the restaurant.…”

Missed Opportunities: Measuring the Untapped TLS Support in the Industrial Internet of Things

“…Other researchers [7,27,46] collect their data via active Internet measurement tools, e.g., ZMap [24]. While such tools typically do not interfere with the operation of industrial equipment [13], malicious attacks can.…”