Evil Through the Lens of Web Logs

Web logs can be analyzed with specific attention to Internet Background Abuse (IBA), a term to be defined here as a subset of Internet Background Radiation (IBR). Two bands of the IBR spectrum include scanning and misconfiguration and can be applied to Internet Background Abuse where details about attacker and victim patterns are readily available. Via web application specific examples this paper will discuss tooling and methods to analyze attacks exhibiting traits, trends, and tendencies from the attacker and victim perspectives.