4665 Reelin' in Unwanted Traffic
Over three years ago, the Global Cyber Alliance (GCA) established a worldwide honeyfarm, with hundreds of sensors, to collect IoT attack traffic for analysis. GCA now has terabytes of data, with over a million hits a day on the honeyfarm sensors. If nothing else, it clearly communicates that the Internet is full of a lot of unwanted traffic, hammering unrelentingly on unsuspecting devices. GCA’s interest is in using this project to help protect (IoT) devices and networks from such bad actors. The open question is: how to reduce the amount and impact of such unwanted traffic, without building IP block lists or otherwise unwittingly carving up the Internet?
This presentation will review some of the data from the honeyfarm collection, giving a sense of what we have learned, and some of the surprises along the way (e.g., 5 IP addresses that spewed MIRAI at GCA’s sensors every single day for over 2 years). More importantly, it will raise a series of questions about what can be done to address the level of unwanted traffic on the Internet, in ways that are consistent with a continued free and open Internet.
Speaker: Phil Roberts