Assessing Internet-wide Cyber Situational Awareness of Critical Sectors

摘要: In this short paper, we take a first step towards empirically assessing Internet-wide malicious activities generated from and targeted Internet-scale business sectors (i.e., financial, health, education, etc.) critical infrastructure utilities, manufacturing, government, etc.). Facilitated by an innovative collaborative large-scale effort, have conducted discussions with numerous Internet entities to obtain rare private information related allocated IP blocks pertaining the aforementioned infrastructure. To end, employ such attribute maliciousness realms, in attempt provide in-depth analysis of global cyber situational posture. We draw upon close 16.8 TB darknet data infer probing (typically malicious/infected hosts) DDoS backscatter, which distill addresses victims. By executing week-long measurements, observed alarming number more than 11,000 machines 300 attack victims hosted sectors. also generate insights various sectors, including typically do not report their illicit for reputation-preservation purposes. While treat obtained results strict confidence due obvious sensitivity reasons, postulate that threat intelligence could be shared sector/critical operators, backbone networks service providers contribute overall remediation objective.