Fabricio Bortoluzzi

For two decades, cyber security researchers have been looking to answer one major question: what threats affect the Internet at large? In addition, what malicious traffic patterns would emerge if we could sample the unsolicited traffic - termed Internet Background Radiation (IBR) - arriving at devices directly connected to the Internet? The standard approach to collecting malicious traffic is the Network Telescope: a computer device assigned with a public IP address range, configured to passively listen to incoming packets. The deployment of Network Telescopes has helped to detect and quantify major cyberspace outbreaks, from the rise of the Conficker malware, to uncovering massive botnet propagation activity, such as performed by Mirai and its variants, against the Internet-of-Things. This paper introduces the Cloud Telescope: an ephemeral, cloud-native architecture, described as Infrastructure-as-Code, enabling for geographically distributed capture of the IBR, along with a discussion of a 5-month-long validation experiment, in which a sensor fleet comprising 130 cloud instances was launched across twenty-six regions of the world. The result is a quantitative and qualitative analysis of 530 million captured packets. This includes traffic breakdown by protocol: TCP (80%), UDP (3%), ICMP (17%), and by source country. We also discuss traffic aggregation by destination country and by affected cloud region, enabling novel forms of geopolitical influence analysis.

Smart environments are pervasive computing systems that provide higher comfort levels on daily routines throughout interactions among smart sensors and embedded computers. The lack of privacy within these interactions can lead to the exposure of sensitive data. We present PRIPRO (PRIvacy PROfiles), a management tool that includes an Android application that acts on the user’s smartphone by allowing or blocking resources according to the context, in order to address this issue. Back-end web server processes and imposes a protocol according to the conditions that the user selected beforehand. The experimental results show that the proposed solution successfully communicates with the Android Device Administration framework, and the device appropriately reacts to the expected set of permissions imposed according to the user’s profile with low response time and resource usage.