DScope: A Cloud-Native Internet Telescope

DScope is a cloud-native interactive Internet telescope deployed to AWS. By interactively collecting traffic from scanners contacting public cloud IPs, DScope provides a vantage point on attacks against cloud infrastructure and other systems.

This website offers information on DScope, collected data, and emergent trends in Internet and cloud exploitation.

DScope is an open data project operated by the Madison Security and Privacy Research Group at the University of Wisconsin–Madison. For more information on accessing and using data collected by DScope, click here.

Traditionally, Internet telescopes are unused portions of the IP address space that are used to receive traffic sent from the broader Internet. Because no legitimate services are hosted at these addresses, the traffic received is background radiation. While these telescopes are useful, the traffic they receive may not be indicative of what deployed services would, and their inability to interact prevents characterizing application payloads. As services continue to transition to public clouds, and protocol semantics move up the stack (for instance, HTTP has become the common denominator of many Web APIs), measurement techniques must adapt to characterize new threats.

DScope aims to complement existing telescopes by bypassing the above limitations. Instead of being deployed to a fixed IP space, DScope works by continually allocating new IP addresses from Amazon Web Services. These IPs are pulled from the broader AWS pool, and are indistinguishable from other cloud server IPs. As a result, the traffic DScope receives aligns with what would be expected by any cloud service. Each IP is held for 10 minutes. During this time, DScope accepts TCP connections on all ports and acknowledges traffic but does not send application-layer responses. This collects TCP banner information from clients, which proves useful for identifying trends and threats.

To build DScope, we had to rethink how internet measurement apparatus are designed and deployed. As a result, DScope has a variety of advantages over existing measurement techniques. For further technical details, see the Telescope Architecture page and our paper at the 2023 USENIX Security Symposium.