Who controls the internet?

The internet has developed over time. Now, institutions are becoming both victims and perpetrators. Source: Pixabay/TheDigitalArtist

The internet has developed over time and is able to function because of the interplay between various services that are, in turn, operated by a range of different institutions. Frequently, IT security does not play a significant role and, as shown by the latest attacks, we are now paying the price. Institutions are becoming both victims and perpetrators. Researchers at the CISPA Helmholtz Centre in Saarbrücken are consequently investigating the global security status of the internet using formal methods.

“A growing number of reports and studies indicate that just a few players are having a decisive influence on the overall security of the internet’s infrastructure”, reports Milivoj Simeonovski, who carries out research at the CISPA Helmholtz Centre and is doing his doctorate at the University of Saarland. Moreover, in the past we have tended to focus more on analysing the security of individual services, but have given very little thought to researching the relationships between them. Simeonovski, together with Giancarlo Pellegrino, Professor Christian Rossow and Professor Michael Backes, founding director of CISPA, have therefore developed a computational model that will allow for better assessment of global online threats. The researchers are taking a similar approach to documenting genealogical data on family trees as they map out the infrastructure of the internet. However, the “nodes” on their charts do not represent people, but servers, organisations and autonomous systems. If these are in any way dependent on each other, they are connected using ‘edges’. To render their model more realistic, they expanded it by 1.8 million nodes and 4.7 million relationships. They then used the model to simulate attacks based on three scenarios. One of these was the global “PRISM” surveillance attack in 2013, which was revealed by Edward Snowden. The results confirmed the researchers’ theory that some players have greater power than others. 14 countries and 14 autonomous systems can directly or indirectly influence the security of 23 percent of all websites. “Our analysis also shows that the United States of America is the most powerful, thanks to the resources it has at its disposal”, explains Simeonovski. Together with Patrick Speicher, Marcel Steinmetz, Robert Künnemann and Professor Jörg Hoffmann, the researchers are also using the computational model for another project relating to global security. Electronic mail is sent by 3.7 billion people worldwide. E-mail is therefore considered to be the most used – and most important – service, ahead of even the World Wide Web. But IT security fared badly here too. Several approaches have already been discussed to upgrade the worldwide service. The security researchers from Saabrücken have consequently developed a procedure to automatically calculate the cost-benefit ratio of the possible measures on a global scale.

“The size of the data set places huge demands on the computations, because the best attack strategy for each combination of countermeasures must be determined”, reports Patrick Speicher from the University of Saarland. The scientists are therefore employing artificial intelligence methods in order to make the best choice as efficiently as possible. “This allows us to determine the extent of the most effective protective measures for a given budget”, explains Speicher, adding that this method can be used not only on a global, but also on a national and company-wide, basis.

Background: Saarland Informatics Campus (SIC)
1,700 students from 81 nations are studying 15 computer-science-related courses in three established faculties at the Saarland Informatics Campus (SIC) of the University of Saarland. At two graduate schools and six globally respected research institutes more than 800 scientists are researching the entire spectrum of computer science related subjects and furthering progress, particularly in IT security, artificial intelligence, visual computing, bioinformatics and the semantic web – from the fundamentals right through to innovative applications. The SIC cooperates with international groups such as Google, Microsoft and Facebook, promotes a large number of business start-ups with its IT incubator (ITI) and acts as a driver for further developments through industrial, research and development laboratories. The overall potential of the site is leveraged in order to take advantage of scientific publications, prizes, patent applications and technological innovations. Thanks to the excellent levels of expertise and competitiveness, joint success at the Saarland Informatics Campus is guaranteed.

Further information:
Who Controls the Internet? Analyzing Global Threats using Property Graph Traversals
https://publications.cispa.saarland/1091/

Formally Reasoning about the Cost and Efficacy of Securing the Email Infrastructure
https://publications.cispa.saarland/1428/

Contact:
Milivoj Simeonovski
CISPA Helmholtz Centre i.G.
Saarland Informatics Campus E9.1
E-mail: milivoj.simeonovski@cispa.saarland
Tel.: +49 681 302 57367

Patrick Speicher
CISPA Helmholtz Centre i.G.
Saarland Informatics Campus E9.1
E-mail: patrick.speicher@cispa.saarland
Tel.: +49 681 302 70961

Editor:
Gordon Bolduan
Competence Center Computer Science
SaarlandSaarland Informatics Campus E1.7
Saarland University
Tel.: +49 681 302 70741
E-mail: bolduan@mmci.uni-saarland.de