internet infrastructure operators

Abstract: Large language models (LLMs) have enabled more effective vulnerability scanning of web applications. However, these capabilities also make it significantly easier for attackers to automate cyberattacks on the web. In this work, we investigate how to divert malicious LLM-based web scanning, with preservation of genuine functionality as a deployment requirement. We systematically study six LLM-based scanners and summarize how they gather information and iteratively select actions based on observations. Guided by the study, we then present WebMaze, a defense that preserves genuine application functionality while diverting LLM-based scanners to a generated decoy world. WebMaze embeds functionality-coupled traps in genuine pages and constructs view-tailored interactive decoy worlds from the application's existing views. The traps blend into genuine components and expose entry points to decoy worlds that sustain exploration through connected pages and interactions without changing genuine functionality. Across 12 web applications and three LLM-based scanners under the default no-disclosure setting, decoy pages account for an average of 93.0% of the distinct pages requested per run. This demonstrates that WebMaze effectively diverts scanners away from genuine application pages and into the generated decoy worlds. Even when explicitly informed about the decoy mechanism and instructed to avoid decoy pages, scanners continue to explore predominantly decoy pages.

Abstract: Internet Exchange Points (IXPs) operate from colocation facilities that draw power from regional grids and store limited backup fuel. In April 2025, the Iberian blackout kept the Spanish grid down for 16 hours, beyond the 12 hours of fuel required by the industry standard, while traffic at major Iberian IXPs fell by up to 70%. Yet operators cannot tell which facilities a grid event cuts off, whether it outlasts their backup, or where traffic from a failed IXP goes. We present SPARC, which maps power-grid and Internet dependencies from substations to IXPs and their traffic. Using open data validated against transmission operators, SPARC links 552 facilities hosting 275 IXPs to the substations that likely feed them. We spread grid events over this map and measure failover through controlled BGP withdrawals on the PEERING testbed. Disabling the most-shared 16% of facility-feeding substations cuts power to half of all IXP presences (an IXP at one facility), under half of what randomized maps require. Losing the 5% most central substations cuts power to 0.1% of IXP presences directly but to 9-52% once the grid splits into disconnected islands. Traffic often fails over to nearby sites that share the failing grid: a cascade affecting four metropolitan areas sends up to 40% of one area's monitored addresses to another of the four. We introduce SPARC-Shield to select substations to harden or facilities whose backup to extend. Against an attacker disabling ten substations, hardening the ten selected by SPARC-Shield reduces offline IXP presence by 72%, compared with 52% for the best standard ranking.

Abstract: Comprehensive visibility into Internet Background Radiation (IBR) requires diverse measurement infrastructure. Recent work showed that cloud IBR depends on the provider making single-provider telescopes systematically biased. These studies relied entirely on Western providers and left the Asia-Pacific region as a blind spot. In this report we extend a multi-cloud network telescope onto Tencent Cloud inside mainland China. We detail how Internet fragmentation, geo-politics, and provider rules complicate global measurement through strict onboarding barriers and an unreliable management plane. Once deployed, our nodes captured high-volume regional scanning invisible to our Western vantage points. We conclude by connecting our findings to the Responsible Internet framework. This framework relies on independent global observation to build a transparent Network Inspection Plane. We show that building this plane is bottlenecked by sovereign ecosystems and requires a collaborative community effort.

Abstract: As services are increasingly centralized in public clouds, understanding the nature of Internet Background Radiation (IBR) hitting these particular environments is an important part of understanding their overall security posture. Classical network telescopes, long the cornerstone of IBR research, face hurdles here: their surface area is shrinking, and their well-known address ranges are easily avoided. We present a multi-cloud view of IBR in this paper. We deploy a passive, distributed network telescope with 336 IPs across five major cloud providers. We compare traffic from our cloud telescope with data from two classical telescopes, a large well-known (/9 + /10) and a small unknown /16, to analyze observational biases. To enable a fair comparison across very different telescope sizes, we tune a scan detection algorithm to determine appropriate thresholds. Our findings reveal that IBR in the cloud is strongly provider-dependent rather than geography-dependent, highlighting the necessity of multi-cloud deployments for comprehensive visibility of IBR in the cloud. Our cloud telescope also captures a distinct set of scanners, confirming that scanning activity is not uniform across the IPv4 space, and we confirm that small, distributed telescopes are ill-suited for observing random events like DDoS backscatter. Our work underscores that monitoring must evolve beyond classical telescopes to include diverse, multi-cloud vantage points to accurately capture IBR.

Abstract: Security analysts can become overwhelmed with monitoring real-time security information that is important to help them defend their network. They also tend to focus on a limited portion of the alerts, and therefore risk missing important events and links between them. At the heart of the problem is the system that analysts use to detect, explore, and respond to cyber-attacks. Developers of security analysis systems face the challenge of developing a system that can present different sources of information at multiple levels of abstraction, while also creating a system that is intuitive to use. In this article, we examine the complementary nature of exploratory analysis and automated analysis by testing the development of a system that monitors real-time Border Gateway Protocol (BGP) traffic for anomalies that might indicate security threats. BGP is an essential component for supporting the infrastructure of the Internet; however, it is also highly vulnerable and can be hijacked by attackers to propagate spam or launch denial-of-service attacks. Some of the attack scenarios on the BGP infrastructure can be quite elaborate, and it is difficult, if not impossible, to fully automate the detection of such attacks. This article makes two contributions: i) it describes a prototype platform for computing indicators and threat alerts in real time and for visualizing the context of an alert, and ii) it discusses the interaction of exploratory analysis (visualization) and automated analysis. This article is relevant to students, security researchers, and developers who are interested in the development or use of real-time security monitoring systems. They will gain insights into the complementary aspects of automated analysis and exploratory analysis through the development of a real-time streaming system.