发表机构
University of Münster; CAIDA/UC San Diego; University of Twente; University of Sydney（明斯特大学; 加州大学圣地亚哥分校网络分析中心; 特温特大学; 悉尼大学）
机构由 AI 辅助整理，请以论文原文为准。AI 中文总结
本文通过多云分布式望远镜揭示云中互联网背景辐射依赖提供商而非地理位置，并强调多云观测点对全面监测IBR的必要性。
AI 中文摘要
随着服务日益集中部署于公共云中，理解到达这些特定环境的互联网背景辐射（IBR）的性质，是理解其整体安全态势的重要部分。经典网络望远镜长期以来一直是IBR研究的基石，但在此面临障碍：其覆盖面积正在缩小，且其众所周知的地址范围容易被规避。本文提出了一个IBR的多云视角。我们在五个主要云提供商中部署了一个包含336个IP地址的被动分布式网络望远镜。我们将云望远镜的流量与两个经典望远镜（一个大型知名/9+/10望远镜和一个小型未知/16望远镜）的数据进行比较，以分析观测偏差。为了在不同规模的望远镜之间实现公平比较，我们调整了扫描检测算法以确定合适的阈值。我们的发现表明，云中的IBR强烈依赖于提供商而非地理位置，这凸显了多云部署对于全面了解云中IBR的必要性。我们的云望远镜还捕获了一组不同的扫描器，证实了扫描活动在IPv4空间中并不均匀，并且我们确认小型分布式望远镜不适合观测如DDoS反射等随机事件。我们的工作强调，监测必须超越经典望远镜，纳入多样化的多云观测点，以准确捕获IBR。
英文摘要
As services are increasingly centralized in public clouds, understanding the nature of Internet Background Radiation (IBR) hitting these particular environments is an important part of understanding their overall security posture. Classical network telescopes, long the cornerstone of IBR research, face hurdles here: their surface area is shrinking, and their well-known address ranges are easily avoided. We present a multi-cloud view of IBR in this paper. We deploy a passive, distributed network telescope with 336 IPs across five major cloud providers. We compare traffic from our cloud telescope with data from two classical telescopes, a large well-known (/9 + /10) and a small unknown /16, to analyze observational biases. To enable a fair comparison across very different telescope sizes, we tune a scan detection algorithm to determine appropriate thresholds. Our findings reveal that IBR in the cloud is strongly provider-dependent rather than geography-dependent, highlighting the necessity of multi-cloud deployments for comprehensive visibility of IBR in the cloud. Our cloud telescope also captures a distinct set of scanners, confirming that scanning activity is not uniform across the IPv4 space, and we confirm that small, distributed telescopes are ill-suited for observing random events like DDoS backscatter. Our work underscores that monitoring must evolve beyond classical telescopes to include diverse, multi-cloud vantage points to accurately capture IBR.
