Refine
Document Type
Language
- English (7)
Keywords
- Clustering and classification (1)
- Disinformation (1)
- Google Maps (1)
- Information systems (1)
- Network (1)
- Network measurement (1)
- Propaganda (1)
- Russia (1)
- Side Channels (1)
- Tripadvisor (1)
Institute
Blocklists constitute a widely-used Internet security mechanism to filter undesired network traffic based on IP/domain reputation and behavior. Many blocklists are distributed in open source form by threat intelligence providers who aggregate and process input from their own sensors, but also from thirdparty feeds or providers. Despite their wide adoption, many open-source blocklist providers lack clear documentation about their structure, curation process, contents, dynamics, and interrelationships with other providers. In this paper, we perform a transparency and content analysis of 2,093 free and open source blocklists with the aim of exploring those questions. To that end, we perform a longitudinal 6-month crawling campaign yielding more than 13.5M unique records. This allows us to shed light on their nature, dynamics, inter-provider relationships, and transparency. Specifically, we discuss how the lack of consensus on distribution formats, blocklist labeling taxonomy, content focus, and temporal dynamics creates a complex ecosystem that complicates their combined crawling, aggregation and use. We also provide observations regarding their generally low overlap as well as acute differences in terms of liveness (i.e., how frequently records get indexed and removed from the list) and the lack of documentation about their data collection processes, nature and intended purpose. We conclude the paper with recommendations in terms of transparency, accountability, and standardization.
In this paper, we report on a measurement study by researchers from several institutions that collected and analyzed network data to assess the impact of the first wave of COVID-19 (February-June 2020) on the Internet traffic. The datasets from Internet Service Providers, Internet Exchange Points, and academic networks, primarily in Europe, provide a unique view on the changes of Internet traffic due to pandemic and the lockdown that forced hundreds of millions of citizens to stay and work from home. The analysis shows that the increase of Internet traffic was about 15-20 % within a couple of weeks, an increase that is typically spread over multiple months under typical operation. However, traffic during peak hours does not increase by more than 5 %. The increase was noticeably higher for specific applications, e.g., remote work applications, teleconferencing, video on demand; in some cases up to 200 %. However, overall, the Internet reacted well to these unprecedented times.
Reviewing War: Unconventional User Reviews as a Side Channel to Circumvent Information Controls
(2023)
During the first days of the 2022 Russian invasion of Ukraine, Russia’s media regulator blocked access to many global social media
platforms and news sites, including Twitter, Facebook, and the
BBC. To bypass the information controls set by Russian authorities,
pro-Ukrainian groups explored unconventional ways to reach out
to the Russian population, such as posting war-related content in
the user reviews of Russian business available on Google Maps or
Tripadvisor. This paper provides a first analysis of this new phenomenon by analyzing the creative strategies to avoid state censorship.
Specifically, we analyze reviews posted on these platforms from
the beginning of the conflict to September 2022. We measure the
channeling of war messages through user reviews in Tripadvisor
and Google Maps, as well as in VK, a popular Russian social network.
Our analysis of the content posted on these services reveals
that users leveraged these platforms to seek and exchange humanitarian
and travel advice, but also to disseminate disinformation and
polarized messages. Finally, we analyze the response of platforms
in terms of content moderation and their impact.
Domain classification services have applications in multiple areas,including cybersecurity, content blocking, and targeted advertising.Yet, these services are often a black box in terms of their method-ology to classifying domains, which makes it difficult to assesstheir strengths, aptness for specific applications, and limitations. Inthis work, we perform a large-scale analysis of 13 popular domainclassification services on more than 4.4M hostnames. Our studyempirically explores their methodologies, scalability limitations,label constellations, and their suitability to academic research aswell as other practical applications such as content filtering. Wefind that the coverage varies enormously across providers, rangingfrom over 90% to below 1%. All services deviate from their docu-mented taxonomy, hampering sound usage for research. Further,labels are highly inconsistent across providers, who show littleagreement over domains, making it difficult to compare or combinethese services. We also show how the dynamics of crowd-sourcedefforts may be obstructed by scalability and coverage aspects aswell as subjective disagreements among human labelers. Finally,through case studies, we showcase that most services are not fitfor detecting specialized content for research or content-blockingpurposes. We conclude with actionable recommendations on theirusage based on our empirical insights and experience. Particularly,we focus on how users should handle the significant disparitiesobserved across services both in technical solutions and in research.
Due to the COVID-19 pandemic, many governments imposed lock downs that forced hundreds of millions of citizens to stay at home. The implementation of confinement measures increased Internet traffic demands of residential users, in particular, for remote working, entertainment, commerce, and education, which, as a result, caused traffic shifts in the Internet core. In this paper, using data from a diverse set of vantage points (one ISP, three IXPs, and one metropolitan educational network), we examine the effect of these lockdowns on traffic shifts. We find that the traffic volume increased by 15-20% almost within a week--while overall still modest, this constitutes a large increase within this short time period. However, despite this surge, we observe that the Internet infrastructure is able to handle the new volume, as most traffic shifts occur outside of traditional peak hours. When looking directly at the traffic sources, it turns out that, while hypergiants still contribute a significant fraction of traffic, we see (1) a higher increase in traffic of non-hypergiants, and (2) traffic increases in applications that people use when at home, such as Web conferencing, VPN, and gaming. While many networks see increased traffic demands, in particular, those providing services to residential users, academic networks experience major overall decreases. Yet, in these networks, we can observe substantial increases when considering applications associated to remote working and lecturing.