Back to Basics: Using Descriptive Statistics to Study the Shape of the Internet

Emily Austin uses descriptive statistics to explore internet-wide scan data. She opens with the case for exploratory analysis before building models, using the classic Anscombe's quartet example to show how identical summary numbers can hide very different data shapes.

The middle of the talk applies these methods to the internet itself. Counting services by port and protocol, HTTP dominates the observed services, while SSH and FTP mostly run on their assigned ports, with a notable cluster of FTP on an unusual port. Cloud providers host many services, yet only a small share of exposed services sit in the major clouds. Looking at SSH software versions and ciphers shows deprecated algorithms still in active use, along with implausible version strings that may be broken, hacked or deliberately misleading. Risk data from passive scanning groups findings into misconfigurations, exposures and vulnerabilities, with misconfigurations forming the largest share. Patch curves for the Log4j, GitLab and Confluence vulnerabilities differ sharply, showing how quickly each one was addressed.

The closing section looks at the long tail of distributions, where anomalous entries can reveal unusual or broken systems. The takeaway for practitioners is that understanding data before modeling it leads to better questions, and that simple aggregate views can help non-specialists prioritize work amid alert fatigue.