WP4 Public Statistics

WP4: Clearinghouse Function - public statistics, type 3

Complete Statistics: Overview.

The following graph shows all alerts since the deployment of the sensors. The deployment of each sensor is marked in the graph at the according time.

Daily stats of attacks seen by the sensors.

The following graphs show the number of the monitored attacks on each day, divided into the most significant classes.

Links to the previous graphs:

Monthly stats of attacks seen by the sensors.

The following graphs show the number of the monitored attacks for full months, divided into the most significant classes.

Links to the previous graphs:

Different kinds of attacks per attacker.

It is interesting to see how many different attacks an attacker tries on a host. This gives us not only a feeling for the many threads that our systems are confronted with. It is also a good indication for the stubbornness of the attackers that sometimes try many different attacks to reach their goal. The following table lists the number of hosts (= source IP addresses) sorted by their number of different attacks.

As the data shows most of the attacks are only single tries (and many of them are ICMP scans as the previous sections indicate). But there are also some hard attackers firing all their guns on a single host.

Hosts that attacked more than one sensor.

Because the eCSIRT.net sensors are placed in separated networks all over Europe it is possible to measure how many of the attackers had more than one target among the sensors. If a host is seen by more than one sensor this indicates that he is actively searching for victims in the net. The following table lists the number of hosts (= source IP addresses) sorted by the number of sensors they attacked.

eCSIRT.net The European Computer Security Incident Response Team Network News | Sitemap | Imprint | Privacy Statement | Contact | Top Last changed: 2004-04-01 / AUTO Copyright © 2002-2003 by PRESECURE Consulting GmbH, Germany