Limitations and pitfalls

Windows in which something did not collect, or data did not reach every destination. The list is generated from the incident analyses and never maintained by hand – each gap links to the incident that caused it. The files from the archive are the source of truth, not the counts in the live syslog.

Source: the data_gaps of every incident in Incidents

Not everything in the data comes from attackers. These values belong to monitoring and to tests during deployment, and should be excluded before analysis.

Mistakes that are easy to make with this data – how to spot them and how to avoid them.

• The ::ffff: prefix on IPv4 addresses cowrie writes IPv4 addresses as ::ffff:203.0.113.5. Unless the prefix is stripped, the same attacker is counted twice – once from cowrie and once from the other sensors.
• Redirected ports on srv4 On srv4, cowrie sees ports 42222 and 42223 and hpweb sees 42280 and 42443. These are not the ports the attacker aimed at but the nftables redirect target. Only hptcp knows the real destination port. For cowrie and hpweb on srv4, ignore the port or derive it from the session.
• Own traffic Monitoring probes, test data from deployment and diagnostic commands by agents and the operator. The concrete values to filter out are in the table above.
• Campaigns Single campaigns could produce most of a day’s traffic. Without separating campaigns from baseline noise, a volume chart looks like a trend or a collection outage.
• Event time, not processing time For time-based analysis use the timestamp inside the event. Log copies on the collection server also carry a receive time that can be hours or days later.
• Incomparable servers srv4 exposed a surface orders of magnitude larger than srv3. Absolute counts of the two servers cannot be compared, only their structure and ranking.
• Format changes during the run The agents adjusted configuration during checks, so the format of some records may have changed mid-run. Specific changes will be added after going through the data; their trace is in the run log.

The limits of what this data can support are best stated up front.

• Two servers are not statistics The results describe what reached two particular servers. General conclusions about the whole internet cannot be drawn from them.
• One provider, one location Both servers ran at the same provider. Attackers target address ranges differently, and elsewhere the traffic could look different.
• Less than a month The run captured the campaigns that happened to be active – not long-term trends or seasonality.
• An address’s country is not the attacker’s origin Geolocation says where a source address is registered. Attacks routinely go through rented servers, proxies and compromised devices, so the address’s country does not tell you where the attacker comes from.
• Comparing language models Each server was run by a different model, but two runs are not enough to judge which model is better. Differences in the data can have many causes, from the exposed surface to individual technical decisions.

Under the GDPR a source IP address is personal data. It was collected in full for analysis and appears in the results only in aggregate.

How the published raw data is pseudonymised, and what is lost in the process, will be described when the data is published.