Cloud Telescope: An Ephemeral, Distributed, and Cloud-Native Architecture for Collecting Internet Background Radiation

For two decades, cyber security researchers have been looking to answer one major question: what threats affect the Internet at large? In addition, what malicious traffic patterns would emerge if we could sample the unsolicited traffic - termed Internet Background Radiation (IBR) - arriving at devices directly connected to the Internet? The standard approach to collecting malicious traffic is the Network Telescope: a computer device assigned with a public IP address range, configured to passively listen to incoming packets. The deployment of Network Telescopes has helped to detect and quantify major cyberspace outbreaks, from the rise of the Conficker malware, to uncovering massive botnet propagation activity, such as performed by Mirai and its variants, against the Internet-of-Things. This paper introduces the Cloud Telescope: an ephemeral, cloud-native architecture, described as Infrastructure-as-Code, enabling for geographically distributed capture of the IBR, along with a discussion of a 5-month-long validation experiment, in which a sensor fleet comprising 130 cloud instances was launched across twenty-six regions of the world. The result is a quantitative and qualitative analysis of 530 million captured packets. This includes traffic breakdown by protocol: TCP (80%), UDP (3%), ICMP (17%), and by source country. We also discuss traffic aggregation by destination country and by affected cloud region, enabling novel forms of geopolitical influence analysis.