Filtering Noise in (Cyber)Space

Summary: GreyNoise describes its global network of thousands of sensors, deployed across many countries and networks, that captures untargeted mass-scanning traffic across the entire IPv4 space so it can be subtracted from defenders' views. The company says it borrows methods from astronomy, ecology and biochemistry - including bias frames, the Michaelis-Menten equation, the Chao1 index, the ACE index and species accumulation curves - to estimate how much scanning activity its sensors may still be missing.
Bottom line: GreyNoise states that a single sensor sees scans from dozens of benign services such as Shodan and Censys, opportunistic malware probes and curious researchers within seconds of coming online, and that a high Chao1 estimate is a red flag its coverage may be incomplete - so the confidence behind any 'we haven't seen this IP' claim rests on how much of the internet is actually being sampled.

Read the original at GreyNoise Blog ↗