Vulnerability Analysis of Internet Devices from Indonesia Based on Exposure Data in Shodan

Abstract

Abstract The growth of internet-enabled devices has increased interest in cybersecurity. In 2014, Project SHINE (SHodan INtelligence Extraction) published a report of large-scale security assessments for devices connected to the Internet. However, the number of IP addresses harvested from Indonesia in 2014 is very small. There were 7.182 IP address from Indonesia. It was about 0,0032% from the total 2.186.971 IP addresses. In this paper, we propose an initiative to gather all information for all Autonomous System Number (AS Number) from Indonesia in Shodan. We have gathered a dataset about all information of AS Numbers in Indonesia such as 12.787 unique ports, 79 unique operating systems, 409 unique products, 3.634 unique domains, 145.543 unique IP addresses, and 790 unique organizations. We use the K-Means algorithm to cluster all AS Numbers into several classes according to the exposure level in shodan. Based on the result, we have 4 classes of AS Numbers. There are 1.075 AS Numbers in class:0 (no information in Shodan yet), 614 AS Numbers in class:1 (exposure level = low), 9 AS Numbers in class:2 (exposure level = medium), and 1 AS Number in class:3 (exposure level = high). This information can be used to warn the organizations that manage AS Numbers in Indonesia to be aware of the security and the threats to their systems.