BackgroundWikileaks.org has been the subject of some major news stories in mid-2010. The site is geared toward sharing information that was previously unknown in the public eye, usually obtained through insider contacts (leaks, whistle-blowers, disgruntled employees, etc.). I won’t rehash the history of Wikileaks and all of its related stories, I’ll leave that for the reader to research if they haven’t already done so. These are the prominent Wikileaks stories from mid-2010:
- April 5, 2010 – release of “Collateral Murder” video (reference)
- June 7, 2010 – arrest of Army Spc. Bradley Manning
- July 25, 2010 – release of “Afghan War Diary” (reference)
A more detailed timeline of these and other Wikileaks events can be found on
Cryptome and
Wikipedia.
Internet Traffic: The Wikileaks “Pandemic”For those unfamiliar with Zscaler, Inc. – we are a security software-as-a-service (SaaS) vendor. I won’t detail our capabilities here (if interested visit our
website), but I will say that we have a large and geographically diverse population of enterprise users browsing the web through our solution: several million users across a large number of countries. This puts Zscaler in a unique position to conduct analyses, stats, and trends for a variety of events on the web (e.g., malware threats). In the case of this story, the event is “Internet Rubber-Necking” or “Gawking.” In other words, the population hears about the Wikileaks story on the news, from their friends, etc. and have to go check it out for themselves.
To conduct some basic statistics for this event, I first focused in on the April and June events and pulled logs for traffic to wikileaks.org from April-June and extracted the number of unique client IP addresses seen visiting the site per day. This provided a basic measure of popularity throughout Q2 2010.
(April - June 2010 Wikileaks traffic)
The results show spikes in visiting IPs on:
- April 5 – 8
- June 7 – 9, 11
- June 22
The largest spike was April 6
th, where 25% of the total unique IPs seen visiting the site for the quarter were seen visiting the site on this day.
The April spike corresponds to the “Collateral Murder” video release.
Comparing the spike to the days leading up to the event, shows that the initial spike was roughly a 2000% increase in daily visits.
The spike follows a similar pandemic pattern (see below): (1) spike at the onset of the event, (2) secondary spike from those coming in contact with (learning of) the event, (3) drop-off from saturation of the population, and (4) return to slightly elevated normal levels.
(1918 Flu Pandemic - reference)
The spikes in early June are directly related to Manning’s arrest on June 7th and the corresponding press briefing from the Dept. of State on June 11 on the incident. The spike on June 22, 2010 corresponds to Wikileaks announcement of its plans to release documents related to a U.S. airstrike that killed Afghan civilians in 2009 (
reference). Eventually it released a corpus of documents July 25, 2010 entitled “Afghan War Diary.”
These documents resulted in much more of a traffic increase. The below chart averages the daily client visits to Wikileaks from March – July 2010 and charted the percentage increase or decrease over time:
(March - July 2010 Wikileaks traffic)
Needless to say, there was a huge spike throughout 7/25 – 7/31 corresponding with the Afghan documents release. To be more specific, 7/25, the release of the documents, saw a 242% increase above average and 7/26 over a 2300% increase above average. In comparison, the April 6th spike for the ‘Collateral Murder’ video was around a 407% increase above average.
Below shows Zscaler’s daily average of unique IPs visiting Wikileaks each month. Both April and June had over twice that of March and May, but July had four times that of April and June.
(2010 Wikileaks traffic)The following chart shows the geographic distribution of the unique client IPs / organizations visiting Wikileaks. 51.5% of the client IPs seen visiting Wikileaks were from the United States, and Australia, Germany, France, and India made up slightly over 25%.
(Country Breakdown of Wikileaks Visitors)
Purpose / Future WorkAside from this just being
interesting statistics about a noteworthy Internet event, it provides us with some stats/trends to identify a micro pandemic or viral, user-driven event on the Internet. By studying this and other noteworthy events on the Internet, helps us to define models (algorithms) for early detection and prediction of similar future events. Early detections and predictions of these events could be leveraged for a variety of reasons, such as, identification and prioritization of news, stories, and Internet resources (e.g., caching and routing).
Google Trends provides a window of such spikes in their search topics. This information can be valuable in advertising and marketing (SEO). It may also be possible to identify and distinguish between an event like the Wikileaks event and a malware attack.
There are several differences between a malware attack and the Wikileaks event on the Internet – most notably was the voluntary, user-driven nature of the traffic to Wikileaks. In comparison, malicious events like the
mass SQL injection / robint.us malware from this past June are not voluntary. The involuntary nature means a larger and wider user base is impacted, and depending on the infection vector can spread more quickly than a voluntary event.
Posts
