Internet Censosrship Revealed Through Haze of Malware Pollution

On a January evening in 2011, Egypt – with a population of 80 million, including 23 million Internet users – vanished from cyberspace after its government ordered an Internet blackout amidst anti-government protests that led to the ouster of Egyptian President Hosni Mubarak. The following month, the Libyan government, also under siege, imposed an Internet “curfew” before completely cutting off access for almost four days.

To help explain exactly how these governments disrupted the Internet, a team of scientists led by the Cooperative Association for Internet Data Analysis (CAIDA) at the University of California, San Diego conducted an analysis based largely on the drop in a specific subset of observable Internet traffic that is a residual product of malware. Many types of malicious software or network activity generate unsolicited traffic in attempting to compromise or infect vulnerable machines. This traffic “pollution” is commonly referred to as Internet background radiation (IBR) and is ubiquitously observable on most publicly accessible Internet links.

The analysis marks the first time that this malware-generated traffic pollution was used to analyze Internet censorship and/or network outages, and the researchers believe this novel methodology could be adopted on a wider scale to create an automated early warning system to help detect such Internet reachability problems in the future.

“We actually used something that’s generally regarded as bad – traffic pollution due to malware – for a beneficial purpose, specifically to improve our understanding of geopolitical censorship behavior,” said K.C. Claffy, CAIDA’s founder and principal investigator for the research, funded by the National Science Foundation (NSF) and the Department of Homeland Security (DHS).

Added Emile Aben, part of the research team and a system architect with the Reseaux IP Europeens Network Coordination Centre (RIPE NCC), an independent organization based in The Netherlands that supports the infrastructure of the Internet through technical coordination: “We believe that research such as this has security relevance and implications for every nation in the world.”

Specifically, the research team – including scientists in Italy and The Netherlands – used UC San Diego’s Network Telescope, which consists of a globally routed segment of Internet address space that carries almost no legitimate Internet traffic. Also known as a ‘darknet’ because this subset of addresses does not have any devices assigned to them, the UC San Diego network telescope collects what could be considered “garbage” of the Internet, such as traffic due to mistyped IP (Internet protocol) addresses, malicious scanning of address space by hackers looking for vulnerable targets, backscatter from random source DoS (denial of service) attacks, and the automated spread of malicious software, including botnet and worm activity. The team also used other multiple sources of large-scale data available to the academic community, such as global routing signaling information.

“Using a combination of this data allowed us to narrow down which forms of Internet access disruption were implemented in a given region over time, but the malware-induced traffic helped us uncover things that the other data did not reveal,” said Alberto Dainotti, who recently joined CAIDA from the University of Napoli Federico II in Naples, Italy, and served as lead author of the study, called Analysis of Country-wide Internet Outages Caused by Censorship. “Among other insights, we detected what we believe were the Gaddafi government's attempts to test a firewall to conduct higher precision host-based blocking while they were executing the coarser approach of router-based disconnection.”

“On a larger scale, we were able to analyze how regimes go about bringing down an entire country’s Internet infrastructure,” said Aben.

CAIDA has also been exploring the impact of geophysically disruptive events, such as major earthquakes or other natural disasters, on Internet connectivity. Another recent study was described in a study called Extracting Benefit From Harm: Using Malware Pollution to Analyze Political and Geophysical Events, published in the January 2012 issue of the ACM SIGCOMM Computer Communication Review. In this study, Dainotti, Claffy, and Aben, along with Roman Amman from the Auckland University of Technology, in Auckland, New Zealand, showed how IBR traffic revealed aspects of not only the Egypt and Libya political uprisings, but also during the powerful earthquakes that struck Christchurch, New Zealand, in February 2011, and Tohoku, Japan one month later – the most powerful earthquake to ever hit that nation.

Dainotti acknowledges that this research is still preliminary, and the team has not explored any automated early warning functionality for natural disasters. But the earthquake study above explored metrics for effectively and efficiently gauging the impact of disasters on Internet infrastructure, based on the analysis of IBR activity from the affected region or regions.

The metric they experimented with to analyze the earthquakes captured a level-shift in the number of IP addresses reaching the observation point. It clearly showed that the Tohoku earthquake had much higher impact on network infrastructure than the Christchurch earthquake (partly because there is much higher population density and thus Internet infrastructure density in Japan). The researchers also were able to compare the geographic extent, or radius, of the damage, and approximate restoration times based on when IBR traffic was again observable by the UC San Diego network telescope.

“Although we have only scratched the surface, we are convinced that IBR traffic is an important building block for comprehensive monitoring, analysis, and possibly even detection of events unrelated to the IBR itself,” said Claffy, noting that CAIDA plans further study in this area. “We hope our methodology will be used to detect outages or similar macroscopically disruptive events in other geographic or topological regions.”

Additional researchers in the Analysis of Country-wide Internet Outages Caused by Censorship paper included Marco Chiesa and Claudio Squarcella (Roma Tre University, Rome, Italy); and Michele Russo and Antonio Pescapé (University of Napoli Federico II, Naples, Italy.)

Featured

  • New Report Reveals Top Trends Transforming Access Controller Technology

    Mercury Security, a provider in access control hardware and open platform solutions, has published its Trends in Access Controllers Report, based on a survey of over 450 security professionals across North America and Europe. The findings highlight the controller’s vital role in a physical access control system (PACS), where the device not only enforces access policies but also connects with readers to verify user credentials—ranging from ID badges to biometrics and mobile identities. With 72% of respondents identifying the controller as a critical or important factor in PACS design, the report underscores how the choice of controller platform has become a strategic decision for today’s security leaders. Read Now

  • Overwhelming Majority of CISOs Anticipate Surge in Cyber Attacks Over the Next Three Years

    An overwhelming 98% of chief information security officers (CISOs) expect a surge in cyber attacks over the next three years as organizations face an increasingly complex and artificial intelligence (AI)-driven digital threat landscape. This is according to new research conducted among 300 CISOs, chief information officers (CIOs), and senior IT professionals by CSC1, the leading provider of enterprise-class domain and domain name system (DNS) security. Read Now

  • ASIS International Introduces New ANSI-Approved Investigations Standard

    • Guard Services
  • Cloud Security Alliance Brings AI-Assisted Auditing to Cloud Computing

    The Cloud Security Alliance (CSA), the world’s leading organization dedicated to defining standards, certifications, and best practices to help ensure a secure cloud computing environment, today introduced an innovative addition to its suite of Security, Trust, Assurance and Risk (STAR) Registry assessments with the launch of Valid-AI-ted, an AI-powered, automated validation system. The new tool provides an automated quality check of assurance information of STAR Level 1 self-assessments using state-of-the-art LLM technology. Read Now

  • Report: Nearly 1 in 5 Healthcare Leaders Say Cyberattacks Have Impacted Patient Care

    Omega Systems, a provider of managed IT and security services, today released new research that reveals the growing impact of cybersecurity challenges on leading healthcare organizations and patient safety. According to the 2025 Healthcare IT Landscape Report, 19% of healthcare leaders say a cyberattack has already disrupted patient care, and more than half (52%) believe a fatal cyber-related incident is inevitable within the next five years. Read Now

New Products

  • Camden CM-221 Series Switches

    Camden CM-221 Series Switches

    Camden Door Controls is pleased to announce that, in response to soaring customer demand, it has expanded its range of ValueWave™ no-touch switches to include a narrow (slimline) version with manual override. This override button is designed to provide additional assurance that the request to exit switch will open a door, even if the no-touch sensor fails to operate. This new slimline switch also features a heavy gauge stainless steel faceplate, a red/green illuminated light ring, and is IP65 rated, making it ideal for indoor or outdoor use as part of an automatic door or access control system. ValueWave™ no-touch switches are designed for easy installation and trouble-free service in high traffic applications. In addition to this narrow version, the CM-221 & CM-222 Series switches are available in a range of other models with single and double gang heavy-gauge stainless steel faceplates and include illuminated light rings.

  • Unified VMS

    AxxonSoft introduces version 2.0 of the Axxon One VMS. The new release features integrations with various physical security systems, making Axxon One a unified VMS. Other enhancements include new AI video analytics and intelligent search functions, hardened cybersecurity, usability and performance improvements, and expanded cloud capabilities

  • EasyGate SPT and SPD

    EasyGate SPT SPD

    Security solutions do not have to be ordinary, let alone unattractive. Having renewed their best-selling speed gates, Cominfo has once again demonstrated their Art of Security philosophy in practice — and confirmed their position as an industry-leading manufacturers of premium speed gates and turnstiles.