Presenting visual patterns and anomalies in cyberspace based on research and development into visualization tools and processing methods for cyberspace situational awareness.

1. CYBERSPACE
PATTERNS & ANOMALIES IN
TIM BASS

2. TIM BASS 8 MARCH 2017TIM BASS 9 MARCH 2017
CYBERSPACE
SITUATIONAL AWARENESS
PRESENTATION DOI 10.13140/RG.2.2.31306.77766/2

3. TIM BASS 8 MARCH 2017TIM BASS 9 MARCH 2017
VISUALIZING NEAR REAL TIME NETWORK
OBJECTS & RELATIONSHIPS
FOR INCREASED SITUATIONAL KNOWLEDGE
OF CYBERSPACE ACTIVITY & ANOMALIES
PRESENTATION DOI 10.13140/RG.2.2.31306.77766/2

4. TIM BASS 8 MARCH 2017PRESENTATION DOI 10.13140/RG.2.2.31306.77766/2
CLANDESTINE BAIDU BOTS …. GEOIP CHINA
TIM BASS 9 MARCH 2017
INDEXING WEBSITE
CLANDESTINELY
BLOCKED

5. TIM BASS 8 MARCH 2017
CLANDESTINE BAIDU BOTS …. GEOIP CHINA
TIM BASS 9 MARCH 2017PRESENTATION DOI 10.13140/RG.2.2.31306.77766/2
INDEXING WEBSITE
CLANDESTINELY
BLOCKED

6. TIM BASS 8 MARCH 2017
LINK INDEXING BOT NETWORK …
TIM BASS 9 MARCH 2017PRESENTATION DOI 10.13140/RG.2.2.31306.77766/2
INDEXING WEBSITE
IDENTIFIED AS
AHREF BOTS - GEOIP US
PERMISSION GRANTED

7. TIM BASS 8 MARCH 2017
CLANDESTINE BAIDU BOTS …. GEOIP BRAZIL
TIM BASS 9 MARCH 2017
UNREGISTERED
USER
REGISTERED
WEBSITE USER
PRESENTATION DOI 10.13140/RG.2.2.31306.77766/2

8. TIM BASS 8 MARCH 2017
CLANDESTINE BAIDU BOTS …. GEOIP BRAZIL
TIM BASS 9 MARCH 2017
“NORMAL” BOT NETWORKS
PRESENTATION DOI 10.13140/RG.2.2.31306.77766/2
BLOCKED

9. TIM BASS 8 MARCH 2017TIM BASS 9 MARCH 2017
CLANDESTINE BAIDU BOTS …. GEOIP CHINA
PRESENTATION DOI 10.13140/RG.2.2.31306.77766/2
INDEXING WEBSITE
CLANDESTINELY
BLOCKED

10. TIM BASS 8 MARCH 2017TIM BASS 9 MARCH 2017
PATTERN-BASED ANOMALY DETECTION
OBSERVE SITUATIONS IN CYBERSPACE
4
- PATTERNS ANOMALIES
- STRANGE BEHAVIOR
- UNEXPECTED SITUATIONS
- UNEXPLAINABLE OBSERVATIONS
PRESENTATION DOI 10.13140/RG.2.2.31306.77766/2

11. TIM BASS 8 MARCH 2017TIM BASS 9 MARCH 2017PRESENTATION DOI 10.13140/RG.2.2.31306.77766/2
CLANDESTINE BAIDU BOTS …. GEOIP BRAZIL
A CLOSER LOOK SHOWS > 200 BOTS DISGUISED AS NORMAL USERS
BLOCKED

12. TIM BASS 8 MARCH 2017
NORMAL “LARGE”
BOTNET - INDEXING
WEBSITE AS AFREF BOTS
TIM BASS 9 MARCH 2017
LARGE “IDENTIFIED” SEARCH BOT NETWORK - GEOIP US
PRESENTATION DOI 10.13140/RG.2.2.31306.77766/2
PERMISSION GRANTED

13. TIM BASS 8 MARCH 2017TIM BASS 9 MARCH 2017PRESENTATION DOI 10.13140/RG.2.2.31306.77766/2
CLANDESTINE BOT NETWORK - GEOIP KOREA …
INDEXING WEBSITE
DISGUISED AS NORMAL WEB USERS (NOT BOTS)
BLOCKED

14. TIM BASS 8 MARCH 2017TIM BASS 9 MARCH 2017PRESENTATION DOI 10.13140/RG.2.2.31306.77766/2
CLANDESTINE “BANKRUPT IP ADDRESS BLOCK” BOTNET - GEOIP US …
ADDRESS SPACE ASSIGNED TO
BANKRUPT GRAPHICS CHIP
COMPANY NOW RUNNING
UNIDENTIFIED BOT NETWORK FROM
ASSIGNED IP ADDRESS SPACE
CI - TRIDENT MICROSYSTEMS SID-18863
BLOCKED

15. TIM BASS 8 MARCH 2017TIM BASS 9 MARCH 2017PRESENTATION DOI 10.13140/RG.2.2.31306.77766/2
CLANDESTINE BOT NETWORK - GEOIP INDIA …
SUSPICIOUS ACTIVITY
FROM IP ADDRESS
CLUSTER IN INDIA
ADDED TO WATCH LIST

16. TIM BASS 8 MARCH 2017TIM BASS 9 MARCH 2017PRESENTATION DOI 10.13140/RG.2.2.31306.77766/2
YANDEX BOT DISGUISED AT MOBILE DEVICE - GEOIP RUSSIA …
YANDEX BOT IDENTIFYING
ITSELF AS AN APPLE IOS
DEVICE IN USER AGENT (UA)
STRING
IGNORED

17. TIM BASS 8 MARCH 2017TIM BASS 9 MARCH 2017
PATTERN-BASED VISUAL ANOMALY DETECTION
SHOULD APPLIED TO MOST (IF NOT ALL) NETWORK OBJECTS
- WEBSITES & SERVERS
- MOBILE PHONES
- SMART DEVICES - IOTS
- NETWORK INFRASTRUCTURE
PRESENTATION DOI 10.13140/RG.2.2.31306.77766/2

18. TIM BASS 8 MARCH 2017TIM BASS 9 MARCH 2017
REFERENCES
TIM BASS, INTRUSION DETECTION SYSTEMS AND MULTISENSOR DATA FUSION,
COMMUNICATIONS OF THE ACM 43(4): 99-105, APRIL 2000, DOI 10.1145/332051.332079
TIM BASS, CYBERSPACE SITUATIONAL AWARENESS DEMANDS MIMIC TRADITIONAL
COMMAND REQUIREMENTS, SIGNAL, OFFICIAL PUBLICATION OF AFCEA, FEBRUARY 2000,
DOI 10.13140/RG.2.2.27068.85127
TIM BASS, CYBERSPACE SITUATION GRAPHS - A BRIEF OVERVIEW, PRESENTATION,
AFFILIATION: WWW.THECEPBLOG.COM, SEPTEMBER 2016, DOI 10.13140/RG.
2.2.16014.56643/9
TIM BASS, A JOURNEY INTO CYBERSPACE, PRESENTATION, AFFILIATION:
WWW.THECEPBLOG.COM, MARCH 4, 2017, DOI 10.13140/RG 2.2.26109.77284/1
PRESENTATION DOI 10.13140/RG.2.2.31306.77766/2
MY SINCERE APOLOGIES FOR THE SELF-REFERENCES

19. TIM BASS 8 MARCH 2017

20. TIM BASS 8 MARCH 2017
© TIM BASS, MARCH 2017
ALL RIGHTS RESERVED
TIM@UNIX.COM
PRESENTATION DOI 10.13140/RG.2.2.31306.77766/2 9 MARCH 2017