A Large-scale Analysis of Cloud Service Abuse
A Large-scale Analysis of Cloud Service Abuse
复制标题
云服务滥用的大规模分析
DOI：
--
复制
发表时间：
2020
期刊：
影响因子：
--
通讯作者：
M. Uchida
中科院分区：
文献类型：
--
作者：
Naoki Fukushi;Daiki Chiba;Mitsuaki Akiyama;M. Uchida
网络攻击者滥用云服务作为其攻击的基础设施。在云服务中，为服务器分配的互联网协议（IP）地址由云服务提供商拥有。当服务器关闭时，分配的IP地址将被释放，然后分配给同一云服务中的另一台服务器。因此，滥用云服务的网络攻击者对合法的服务提供商、开发人员和最终用户构成了可能被错误地列入黑名单的风险，这导致服务的声誉下降。在这项研究中，我们使用黑名单IP地址对云服务滥用进行了大规模测量。我们使用39个黑名单对四个云服务进行了154天的分析，结果显示，这些云服务提供商共有61，060个IP地址被列入黑名单，约14，000个IP地址继续被列入黑名单，每天约有5%的IP地址被替换。此外，我们的研究揭示了滥用云服务的攻击在攻击类型、区域、持续时间和反滥用行动方面的趋势。最后，我们讨论了针对云服务用户、云服务提供商和黑名单提供商的建议。
Cyber-attackers abuse cloud services as an infrastructure for their attacks. In a cloud service, the assigned Internet Protocol (IP) address for a server is owned by the cloud service provider. When the server is shut down, the assigned IP address is released and then assigned to another server in the same cloud service. Thus, cyber-attackers abusing cloud services pose a risk to legitimate service providers, developers, and end users of potentially being falsely blacklisted, which results in a poorer reputation for the service. In this study, we conducted a large-scale measurement of cloud service abuse using blacklisted IP addresses. Our analysis of four cloud services over 154 days using 39 blacklists revealed that a total of 61,060 IP addresses from these cloud service providers were blacklisted, approximately 14,000 IP addresses continue to be blacklisted, and approximately 5% are replaced daily. Moreover, our study revealed trends in attacks that abuse cloud services with respect to attack type, region, duration, and anti-abuse actions. Finally, we discussed recommendations for cloud service users, cloud service providers, and blacklist providers.
Cloud Strife：降低域验证证书的安全风险
DOI：
10.14722/ndss.2018.23327
发表时间：
2018
期刊：
Internet Society Symposium on Network and Distributed System Security (NDSS
影响因子：
--
作者：
Borgolte, Kevin;Fiebig, Tobias;Hao, Shuang;Kruegel, Christopher;Vigna, Giovanni
通讯作者：
Vigna, Giovanni