Internet Background Radiation: Exploiting the Void#

Paweł Pawliński, Jan Adamski, Jakub Koman (NASK / CERT.PL), Paul Jung (CIRCL)

• Why: Network telescopes are pure network telemetry at internet scale — scanning, botnets, exploitation attempts, DDoS, misconfigurations — and this is operator-led (two national CERTs) rather than academic.
• What: A 2-hour workshop in two halves: (1) how CIRCL and NASK/CERT.PL collect and process large network telescopes — pipelines that turn raw unsolicited packets into structured, enriched datasets and actionable threat intelligence, with honest discussion of strengths and limitations; (2) a hackathon-style exploration of real telescope datasets with instructor support and no predefined outcome.
• How: Darknet/telescope capture, transformation and enrichment pipelines, and comparative analysis across different telescope environments.
• Where applicable: Anyone doing internet-scale visibility or threat intel; requires a laptop and L3+ protocol knowledge. The data source is inherently noisy — the limitation discussion is part of the value. (from abstract only)