Security Monitoring of the Cyber Space

Billions of users utilize the largest and more complex network of information, namely, the Internet. Despite the fact that this IT critical infrastructure provides various communication services, adversaries are abusing the Internet security and privacy to execute cyber attacks for various reasons. To cope with these threats, security operators utilize various security tools and techniques to monitor the cyber space. An efficient way to monitor and infer threat activities online is to collect information from trap-based monitoring sensors. This chapter primarily defines the cyberspace trap-based monitoring systems and their taxonomies. Moreover, it presents the state-of-the-art in terms of research contributions and techniques, tools and technologies. Furthermore, it identifies the gaps in terms of science and technology. Additionally, it presents some case studies and practical approaches corresponding to large-scale cyber monitoring systems such as Nicter. In this context, we further present some related security policies and legal issues on network monitoring. In a nutshell, the chapter aims to provide an overview on the Internet monitoring space and provides a guideline for readers to help them understand the concepts of observing, detecting and analyzing cyber attacks through network traps.