Does anyone know where we can get more information about the stats behind this slide:
https://twitter.com/AlecMuffett/status/730773970383982592
The slide says:
1:11,500 non-Tor IPs contained malicious requests 1:380 Tor exit nodes contained malicious requests
The way it's worded, it sounds like they're saying "1/11500 of the non-Tor IP addresses we saw sent malicious requests, and 1/380 of the Tor exit node IP addresses we saw sent malicious requests", but I'm finding that hard to believe, since 1/380 of the Tor exit node IP addresses is ~3 IP addresses. It's unlikely that all malicious Tor traffic was confined to 3 exit nodes. (But interesting if true.)
Were they perhaps being a little loose and really meant "1/11500 TCP connections coming from non-Tor IP addresses, and 1/380 TCP connections coming from Tor exit nodes, contained malicious requests"?
Thanks,
- Ian
On Fri, May 20, 2016 at 08:56:06AM -0400, Ian Goldberg wrote:
Does anyone know where we can get more information about the stats behind this slide:
https://twitter.com/AlecMuffett/status/730773970383982592
The slide says:
1:11,500 non-Tor IPs contained malicious requests 1:380 Tor exit nodes contained malicious requests
The way it's worded, it sounds like they're saying "1/11500 of the non-Tor IP addresses we saw sent malicious requests, and 1/380 of the Tor exit node IP addresses we saw sent malicious requests", but I'm finding that hard to believe, since 1/380 of the Tor exit node IP addresses is ~3 IP addresses. It's unlikely that all malicious Tor traffic was confined to 3 exit nodes. (But interesting if true.)
Were they perhaps being a little loose and really meant "1/11500 TCP connections coming from non-Tor IP addresses, and 1/380 TCP connections coming from Tor exit nodes, contained malicious requests"?
There's an actual written report (Sadia Afroz found the link to the report). The Tor part starts on page 59.
https://www.stateoftheinternet.com/downloads/pdfs/2015-cloud-security-report...
Here are the relevant tables. The heading "Global Rank" in Figure 4-2 is probably supposed to be "Source". The percentages in Figure 4-4 are off by a factor of 100; i.e. 1/380=0.0026=0.26%.
The first two figures, 4-2 and 4-3, are explicitly in terms of requests. Figure 4-4 is a ratio between two "traffic" values but the caption refers to requests.
Global Rank Legitimate HTTP Requests Frequency Non-Tor IPs 534,999,725,930 99.96% Tor exit nodes 228,436,820 00.04% Figure 4-2: Of the legitimate HTTP requests, excluding static media files, less than 1% were from Tor exit notes
Source Legitimate HTTP Requests Frequency Non-Tor IPs 46,530,841 98.74% Tor exit nodes 596,042 1.26% Figure 4-3: Of the malicious HTTP requests, 1.26% were from Tor exit notes
Source Ratio Between Malicious & Legitimate Traffic Frequency Non-Tor IPs 0.00008697% malicious traffic ~1:11,500 Tor exit nodes 0.00260922% malicious traffic ~1:380 Figure 4-4: Though the traffic levels are much smaller, Tor exit nodes were much more likely to contain malicious requests
On Fri, May 20, 2016 at 09:55:05AM -0700, David Fifield wrote:
On Fri, May 20, 2016 at 08:56:06AM -0400, Ian Goldberg wrote:
Does anyone know where we can get more information about the stats behind this slide:
https://twitter.com/AlecMuffett/status/730773970383982592
The slide says:
1:11,500 non-Tor IPs contained malicious requests 1:380 Tor exit nodes contained malicious requests
The way it's worded, it sounds like they're saying "1/11500 of the non-Tor IP addresses we saw sent malicious requests, and 1/380 of the Tor exit node IP addresses we saw sent malicious requests", but I'm finding that hard to believe, since 1/380 of the Tor exit node IP addresses is ~3 IP addresses. It's unlikely that all malicious Tor traffic was confined to 3 exit nodes. (But interesting if true.)
Were they perhaps being a little loose and really meant "1/11500 TCP connections coming from non-Tor IP addresses, and 1/380 TCP connections coming from Tor exit nodes, contained malicious requests"?
There's an actual written report (Sadia Afroz found the link to the report). The Tor part starts on page 59.
https://www.stateoftheinternet.com/downloads/pdfs/2015-cloud-security-report...
Here are the relevant tables. The heading "Global Rank" in Figure 4-2 is probably supposed to be "Source". The percentages in Figure 4-4 are off by a factor of 100; i.e. 1/380=0.0026=0.26%.
The first two figures, 4-2 and 4-3, are explicitly in terms of requests. Figure 4-4 is a ratio between two "traffic" values but the caption refers to requests.
Global Rank Legitimate HTTP Requests Frequency Non-Tor IPs 534,999,725,930 99.96% Tor exit nodes 228,436,820 00.04% Figure 4-2: Of the legitimate HTTP requests, excluding static media files, less than 1% were from Tor exit notes
Source Legitimate HTTP Requests Frequency Non-Tor IPs 46,530,841 98.74% Tor exit nodes 596,042 1.26% Figure 4-3: Of the malicious HTTP requests, 1.26% were from Tor exit notes
Source Ratio Between Malicious & Legitimate Traffic Frequency Non-Tor IPs 0.00008697% malicious traffic ~1:11,500 Tor exit nodes 0.00260922% malicious traffic ~1:380 Figure 4-4: Though the traffic levels are much smaller, Tor exit nodes were much more likely to contain malicious requests
Cool, thanks!
- Ian
tor-project@lists.torproject.org
-
David Fifield -
Ian Goldberg