Operated by the Global Cyber Alliance, AIDE is a cybersecurity intelligence platform that monitors global network traffic, detects potential threats, and delivers actionable insights to improve network security. One key outcome of AIDE is the Internet Pollution Index, which quantifies global network pollution — unwanted Internet traffic that can indicate potential threats — by evaluating both the volume and severity of that traffic.

While this is just one aspect of what we can do with our broader AIDE platform, the Internet Pollution Index provides a precise, normalized metric that reflects the intensity of malicious activity emanating from each economy's network operators, as measured by autonomous systems (ASes).

How It Works

The Internet Pollution Index measures how "polluted" an economy's network activity is by combining the frequency and severity of different types of events. In essence, the Index reflects not just the volume of activity but also its potential threat level. It also reflects network activity as seen from the autonomous systems in that economy and considers the number of distinct IP addresses involved in unwanted behavior.

This approach allows us to compare threat levels across economies on a level playing field, ensuring that nations with larger network spaces are not unfairly penalized.

Scoring System

Each economy's score is:

• Normalized by its IPv4 address space and presence in the AIDE sensor network
• Weighted by the severity of interactions
• Informed by the number of distinct IPs seen engaging in suspicious activity
• Bounded between 0 and 100%, with higher scores highlighting economies that stand out significantly compared to others.

A higher Internet Pollution Index (e.g., above 90%+) indicates that an economy is among the most significant contributors of malicious traffic during the observed period, relative to its size and presence in AIDE. It does not mean all traffic from that economy is malicious, but that the volume and severity of unwanted traffic is disproportionately high there.

With traffic originating from over 200 economies, the Internet Pollution Index helps surface global hotspots of unwanted traffic, guiding attention to regions with unusually high concentrations of threat activity.

Data Collection and Analysis

Our global deployment of ProxyPot sensors (our in-house honeypot technology) monitors attack traffic across multiple protocols, including FTP, HTTP, HTTPS, SSH, and Telnet. By analyzing patterns such as login attempts, download/upload requests, and command sequences, we can differentiate between benign scans and genuine threats.

Each day, we capture millions of hits, providing deep insights into the current volumes of unwanted traffic on the Internet and enabling precise tracking of emerging global threats.