Cloud Telescope Internet Background Radiation - October 2023 - February 2024

Citation Author(s):
Fabricio
Bortoluzzi
Noroff University College
Lucas
Beiler
University of Vale do Itajai
Barry
Irwin
Rhodes University
Carla
Westphall
Federal University of Santa Catarina
Submitted by:
Fabricio Bortoluzzi
Last updated:
Mon, 09/30/2024 - 12:23
DOI:
10.21227/zkyy-gk56
Data Format:
*.pcap (zip)
License:
Creative Commons Attribution
408 Views
Categories:
Security
Cloud Computing
Sensors
Keywords:
internet background radiation, internet background noise, darknet, network telescope, cloud telescope, cloud computing, pcap
0
0 ratings - Please login to submit your rating.
ACCESS DATASET CITE SHARE/EMBED

Abstract 

This dataset results from a 5-month-long Cloud Telescope Internet Background Radiation collection experiment conducted during the months of October 2023 until February 2024.
A total amount of 130 EC2 instances (sensors) were deployed across all the 26 commercially available AWS regions at the time,  5 sensors per region.
A Cloud Telescope sensor does not serve information. All traffic arriving to the sensor is unsolicited, and potentially malicious. Sensors were configured to allow all unsolicited traffic.

This dataset contains 530,914,922 network events recorded in the PCAP format. 425,674,635 (80%) of the datagrams fit the TCP transport-layer protocol, while 86,139,655 (16%) belong to ICMP messages, and 18,982,971 (4%) are UDP datagrams.

The architecture is reproducible. Terraform Infrastructure-As-Code is available at: https://github.com/lucasbeiler/ibr-iac

We keep a set of basic bash and python scripts that could help you to get started with your own ETL (extract-transform-load) workflow. This is available at: https://github.com/bortoluzzi/ibr-etl

We will attach the paper with a full analysis of this dataset once it gets published and indexed on IEEE Xplore.

Instructions: 

The files in this dataset are too large to be handled by Wireshark.
Command-line dataset exploration can be done with the use of Tshark. Tshark can be installed on Ubuntu-like systems with "sudo apt-get install tshark". On Windows, Tshark is installed with Wireshark.
The command to read an uncompressed dataset file is "tshark -r af-south-1.pcap" assuming you want to browse south africa's sub-dataset named "af-south-1.pcap".
Reading straight from the compressed is also possible with: "tshark -r af-south-1.pcap.gz".

We have launched a video explaining how to get started with Internet Background Radiation using the first Cloud Telescope dataset. Please watch https://bit.ly/ibr_workshop

Dataset Files

LOGIN TO ACCESS DATASET FILES

 

QUESTIONS?