Measuring the Internet´s threat level: A global-local approach

The Internet is a highly distributed and complex system consisting of billion devices and has become the field of various kinds of conflicts during the last two decades. As a matter of fact, various actors utilise the Internet for illicit purposes, such as for performing Distributed Denial of Service Attacks (DDoS) and for spreading various types of aggressive malware. Despite the fact that numerous services provide information regarding the threat level of the Internet, they are mostly based on information acquired by their sensors or on offline statistical sampling of various security applications (antivirus software, intrusion detection systems etc.). This paper presents PROTOS (PROactive Threat Observatory System), an early warning system which is capable of estimating the threat level across the Internet, using both a global and a local approach. The proposed system is therefore able to determine whether a specific host is under an imminent threat, as well as to provide an estimation of the malicious activity across the Internet.