際際滷

際際滷Share a Scribd company logo
CYBERSPACE
PATTERNS & ANOMALIES IN
TIM BASS
TIM BASS 8 MARCH 2017TIM BASS 9 MARCH 2017
CYBERSPACE
SITUATIONAL AWARENESS

PRESENTATION DOI 10.13140/RG.2.2.31306.77766/2
TIM BASS 8 MARCH 2017TIM BASS 9 MARCH 2017
VISUALIZING NEAR REAL TIME NETWORK
OBJECTS & RELATIONSHIPS
FOR INCREASED SITUATIONAL KNOWLEDGE
OF CYBERSPACE ACTIVITY & ANOMALIES

PRESENTATION DOI 10.13140/RG.2.2.31306.77766/2
TIM BASS 8 MARCH 2017PRESENTATION DOI 10.13140/RG.2.2.31306.77766/2
CLANDESTINE BAIDU BOTS . GEOIP CHINA
TIM BASS 9 MARCH 2017
INDEXING WEBSITE
CLANDESTINELY
BLOCKED
TIM BASS 8 MARCH 2017
CLANDESTINE BAIDU BOTS . GEOIP CHINA
TIM BASS 9 MARCH 2017PRESENTATION DOI 10.13140/RG.2.2.31306.77766/2
INDEXING WEBSITE
CLANDESTINELY
BLOCKED
TIM BASS 8 MARCH 2017
LINK INDEXING BOT NETWORK 
TIM BASS 9 MARCH 2017PRESENTATION DOI 10.13140/RG.2.2.31306.77766/2
INDEXING WEBSITE
IDENTIFIED AS
Ahref BOTS - GEOIP US
PERMISSION GRANTED
TIM BASS 8 MARCH 2017
CLANDESTINE BAIDU BOTS . GEOIP BRAZIL
TIM BASS 9 MARCH 2017
UNREGISTERED
USER
REGISTERED
WEBSITE USER
PRESENTATION DOI 10.13140/RG.2.2.31306.77766/2
TIM BASS 8 MARCH 2017
CLANDESTINE BAIDU BOTS . GEOIP BRAZIL
TIM BASS 9 MARCH 2017
NORMAL BOT NETWORKS
PRESENTATION DOI 10.13140/RG.2.2.31306.77766/2
BLOCKED
TIM BASS 8 MARCH 2017TIM BASS 9 MARCH 2017
CLANDESTINE BAIDU BOTS . GEOIP CHINA
PRESENTATION DOI 10.13140/RG.2.2.31306.77766/2
INDEXING WEBSITE
CLANDESTINELY
BLOCKED
TIM BASS 8 MARCH 2017TIM BASS 9 MARCH 2017
PATTERN-BASED ANOMALY DETECTION
OBSERVE SITUATIONS IN CYBERSPACE
4
- PATTERNS ANOMALIES
- STRANGE BEHAVIOR
- UNEXPECTED SITUATIONS
- UNEXPLAINABLE OBSERVATIONS
PRESENTATION DOI 10.13140/RG.2.2.31306.77766/2
TIM BASS 8 MARCH 2017TIM BASS 9 MARCH 2017PRESENTATION DOI 10.13140/RG.2.2.31306.77766/2
CLANDESTINE BAIDU BOTS . GEOIP BRAZIL
A CLOSER LOOK SHOWS > 200 BOTS DISGUISED AS NORMAL USERS
BLOCKED
TIM BASS 8 MARCH 2017
NORMAL LARGE
BOTNET - INDEXING
WEBSITE AS AFREF BOTS
TIM BASS 9 MARCH 2017
LARGE IDENTIFIED SEARCH BOT NETWORK - GEOIP US
PRESENTATION DOI 10.13140/RG.2.2.31306.77766/2
PERMISSION GRANTED
TIM BASS 8 MARCH 2017TIM BASS 9 MARCH 2017PRESENTATION DOI 10.13140/RG.2.2.31306.77766/2
CLANDESTINE BOT NETWORK - GEOIP KOREA 
INDEXING WEBSITE
DISGUISED AS NORMAL WEB USERS (NOT BOTS)
BLOCKED
TIM BASS 8 MARCH 2017TIM BASS 9 MARCH 2017PRESENTATION DOI 10.13140/RG.2.2.31306.77766/2
CLANDESTINE BANKRUPT IP ADDRESS BLOCK BOTNET - GEOIP US 
ADDRESS SPACE ASSIGNED TO
BANKRUPT GRAPHICS CHIP
COMPANY NOW RUNNING
UNIDENTIFIED BOT NETWORK FROM
ASSIGNED IP ADDRESS SPACE
CI - TRIDENT MICROSYSTEMS SID-18863
BLOCKED
TIM BASS 8 MARCH 2017TIM BASS 9 MARCH 2017PRESENTATION DOI 10.13140/RG.2.2.31306.77766/2
CLANDESTINE BOT NETWORK - GEOIP INDIA 
SUSPICIOUS ACTIVITY
FROM IP ADDRESS
CLUSTER IN INDIA
ADDED TO WATCH LIST
TIM BASS 8 MARCH 2017TIM BASS 9 MARCH 2017PRESENTATION DOI 10.13140/RG.2.2.31306.77766/2
YANDEX BOT DISGUISED AT MOBILE DEVICE - GEOIP RUSSIA 
YANDEX BOT IDENTIFYING
ITSELF AS AN APPLE IOS
DEVICE IN USER AGENT (UA)
STRING
IGNORED
TIM BASS 8 MARCH 2017TIM BASS 9 MARCH 2017
PATTERN-BASED VISUAL ANOMALY DETECTION
SHOULD APPLIED TO MOST (IF NOT ALL) NETWORK OBJECTS
- WEBSITES & SERVERS
- MOBILE PHONES
- SMART DEVICES - IOTS
- NETWORK INFRASTRUCTURE
PRESENTATION DOI 10.13140/RG.2.2.31306.77766/2
TIM BASS 8 MARCH 2017TIM BASS 9 MARCH 2017
REFERENCES
TIM BASS, INTRUSION DETECTION SYSTEMS AND MULTISENSOR DATA FUSION,
COMMUNICATIONS OF THE ACM 43(4): 99-105, APRIL 2000, DOI 10.1145/332051.332079
TIM BASS, CYBERSPACE SITUATIONAL AWARENESS DEMANDS MIMIC TRADITIONAL
COMMAND REQUIREMENTS, SIGNAL, OFFICIAL PUBLICATION OF AFCEA, FEBRUARY 2000,
DOI 10.13140/RG.2.2.27068.85127
TIM BASS, CYBERSPACE SITUATION GRAPHS - A BRIEF OVERVIEW, PRESENTATION,
AFFILIATION: WWW.THECEPBLOG.COM, SEPTEMBER 2016, DOI 10.13140/RG.
2.2.16014.56643/9
TIM BASS, A JOURNEY INTO CYBERSPACE, PRESENTATION, AFFILIATION:
WWW.THECEPBLOG.COM, MARCH 4, 2017, DOI 10.13140/RG 2.2.26109.77284/1
PRESENTATION DOI 10.13140/RG.2.2.31306.77766/2
MY SINCERE APOLOGIES FOR THE SELF-REFERENCES
TIM BASS 8 MARCH 2017
TIM BASS 8 MARCH 2017
息 TIM BASS, MARCH 2017
ALL RIGHTS RESERVED
TIM@UNIX.COM
PRESENTATION DOI 10.13140/RG.2.2.31306.77766/2 9 MARCH 2017

More Related Content

Patterns & Anomalies in Cyberspace

  • 2. TIM BASS 8 MARCH 2017TIM BASS 9 MARCH 2017 CYBERSPACE SITUATIONAL AWARENESS PRESENTATION DOI 10.13140/RG.2.2.31306.77766/2
  • 3. TIM BASS 8 MARCH 2017TIM BASS 9 MARCH 2017 VISUALIZING NEAR REAL TIME NETWORK OBJECTS & RELATIONSHIPS FOR INCREASED SITUATIONAL KNOWLEDGE OF CYBERSPACE ACTIVITY & ANOMALIES PRESENTATION DOI 10.13140/RG.2.2.31306.77766/2
  • 4. TIM BASS 8 MARCH 2017PRESENTATION DOI 10.13140/RG.2.2.31306.77766/2 CLANDESTINE BAIDU BOTS . GEOIP CHINA TIM BASS 9 MARCH 2017 INDEXING WEBSITE CLANDESTINELY BLOCKED
  • 5. TIM BASS 8 MARCH 2017 CLANDESTINE BAIDU BOTS . GEOIP CHINA TIM BASS 9 MARCH 2017PRESENTATION DOI 10.13140/RG.2.2.31306.77766/2 INDEXING WEBSITE CLANDESTINELY BLOCKED
  • 6. TIM BASS 8 MARCH 2017 LINK INDEXING BOT NETWORK TIM BASS 9 MARCH 2017PRESENTATION DOI 10.13140/RG.2.2.31306.77766/2 INDEXING WEBSITE IDENTIFIED AS Ahref BOTS - GEOIP US PERMISSION GRANTED
  • 7. TIM BASS 8 MARCH 2017 CLANDESTINE BAIDU BOTS . GEOIP BRAZIL TIM BASS 9 MARCH 2017 UNREGISTERED USER REGISTERED WEBSITE USER PRESENTATION DOI 10.13140/RG.2.2.31306.77766/2
  • 8. TIM BASS 8 MARCH 2017 CLANDESTINE BAIDU BOTS . GEOIP BRAZIL TIM BASS 9 MARCH 2017 NORMAL BOT NETWORKS PRESENTATION DOI 10.13140/RG.2.2.31306.77766/2 BLOCKED
  • 9. TIM BASS 8 MARCH 2017TIM BASS 9 MARCH 2017 CLANDESTINE BAIDU BOTS . GEOIP CHINA PRESENTATION DOI 10.13140/RG.2.2.31306.77766/2 INDEXING WEBSITE CLANDESTINELY BLOCKED
  • 10. TIM BASS 8 MARCH 2017TIM BASS 9 MARCH 2017 PATTERN-BASED ANOMALY DETECTION OBSERVE SITUATIONS IN CYBERSPACE 4 - PATTERNS ANOMALIES - STRANGE BEHAVIOR - UNEXPECTED SITUATIONS - UNEXPLAINABLE OBSERVATIONS PRESENTATION DOI 10.13140/RG.2.2.31306.77766/2
  • 11. TIM BASS 8 MARCH 2017TIM BASS 9 MARCH 2017PRESENTATION DOI 10.13140/RG.2.2.31306.77766/2 CLANDESTINE BAIDU BOTS . GEOIP BRAZIL A CLOSER LOOK SHOWS > 200 BOTS DISGUISED AS NORMAL USERS BLOCKED
  • 12. TIM BASS 8 MARCH 2017 NORMAL LARGE BOTNET - INDEXING WEBSITE AS AFREF BOTS TIM BASS 9 MARCH 2017 LARGE IDENTIFIED SEARCH BOT NETWORK - GEOIP US PRESENTATION DOI 10.13140/RG.2.2.31306.77766/2 PERMISSION GRANTED
  • 13. TIM BASS 8 MARCH 2017TIM BASS 9 MARCH 2017PRESENTATION DOI 10.13140/RG.2.2.31306.77766/2 CLANDESTINE BOT NETWORK - GEOIP KOREA INDEXING WEBSITE DISGUISED AS NORMAL WEB USERS (NOT BOTS) BLOCKED
  • 14. TIM BASS 8 MARCH 2017TIM BASS 9 MARCH 2017PRESENTATION DOI 10.13140/RG.2.2.31306.77766/2 CLANDESTINE BANKRUPT IP ADDRESS BLOCK BOTNET - GEOIP US ADDRESS SPACE ASSIGNED TO BANKRUPT GRAPHICS CHIP COMPANY NOW RUNNING UNIDENTIFIED BOT NETWORK FROM ASSIGNED IP ADDRESS SPACE CI - TRIDENT MICROSYSTEMS SID-18863 BLOCKED
  • 15. TIM BASS 8 MARCH 2017TIM BASS 9 MARCH 2017PRESENTATION DOI 10.13140/RG.2.2.31306.77766/2 CLANDESTINE BOT NETWORK - GEOIP INDIA SUSPICIOUS ACTIVITY FROM IP ADDRESS CLUSTER IN INDIA ADDED TO WATCH LIST
  • 16. TIM BASS 8 MARCH 2017TIM BASS 9 MARCH 2017PRESENTATION DOI 10.13140/RG.2.2.31306.77766/2 YANDEX BOT DISGUISED AT MOBILE DEVICE - GEOIP RUSSIA YANDEX BOT IDENTIFYING ITSELF AS AN APPLE IOS DEVICE IN USER AGENT (UA) STRING IGNORED
  • 17. TIM BASS 8 MARCH 2017TIM BASS 9 MARCH 2017 PATTERN-BASED VISUAL ANOMALY DETECTION SHOULD APPLIED TO MOST (IF NOT ALL) NETWORK OBJECTS - WEBSITES & SERVERS - MOBILE PHONES - SMART DEVICES - IOTS - NETWORK INFRASTRUCTURE PRESENTATION DOI 10.13140/RG.2.2.31306.77766/2
  • 18. TIM BASS 8 MARCH 2017TIM BASS 9 MARCH 2017 REFERENCES TIM BASS, INTRUSION DETECTION SYSTEMS AND MULTISENSOR DATA FUSION, COMMUNICATIONS OF THE ACM 43(4): 99-105, APRIL 2000, DOI 10.1145/332051.332079 TIM BASS, CYBERSPACE SITUATIONAL AWARENESS DEMANDS MIMIC TRADITIONAL COMMAND REQUIREMENTS, SIGNAL, OFFICIAL PUBLICATION OF AFCEA, FEBRUARY 2000, DOI 10.13140/RG.2.2.27068.85127 TIM BASS, CYBERSPACE SITUATION GRAPHS - A BRIEF OVERVIEW, PRESENTATION, AFFILIATION: WWW.THECEPBLOG.COM, SEPTEMBER 2016, DOI 10.13140/RG. 2.2.16014.56643/9 TIM BASS, A JOURNEY INTO CYBERSPACE, PRESENTATION, AFFILIATION: WWW.THECEPBLOG.COM, MARCH 4, 2017, DOI 10.13140/RG 2.2.26109.77284/1 PRESENTATION DOI 10.13140/RG.2.2.31306.77766/2 MY SINCERE APOLOGIES FOR THE SELF-REFERENCES
  • 19. TIM BASS 8 MARCH 2017
  • 20. TIM BASS 8 MARCH 2017 息 TIM BASS, MARCH 2017 ALL RIGHTS RESERVED TIM@UNIX.COM PRESENTATION DOI 10.13140/RG.2.2.31306.77766/2 9 MARCH 2017