{"id":1640,"date":"2012-10-08T09:24:45","date_gmt":"2012-10-08T14:24:45","guid":{"rendered":"http:\/\/rud.is\/b\/?p=1640"},"modified":"2018-03-10T07:53:18","modified_gmt":"2018-03-10T12:53:18","slug":"diy-zeroaccess-geoip-analysis-so-what","status":"publish","type":"post","link":"https:\/\/rud.is\/b\/2012\/10\/08\/diy-zeroaccess-geoip-analysis-so-what\/","title":{"rendered":"DIY ZeroAccess GeoIP Analysis : So What?"},"content":{"rendered":"<p><i>NOTE: A great deal of this post comes from @jayjacobs as he took a conversation we were having about thoughts on ways to look at the data and just ran like the Flash with it.<\/i><\/p>\n<p>Did you know that \u2013\u00a0if you&#8217;re a US citizen \u2013\u00a0you have approximately a <strong>1 in 5<\/strong> chance of getting the flu this year? If you&#8217;re a male (no regional bias for this one), you have a <strong>1 in 400<\/strong> chance of developing Hodgkin&#8217;s Disease and a <strong>1 in 5,000<\/strong> chance of dying from testicular cancer.<\/p>\n<p>Moving away from medical stats, if you&#8217;re a NJ resident, you have a <strong>1 in 1,000<\/strong> chance of winning $275 in the straight &#8220;Pick 3&#8221; lottery and a <strong>1 in 13,983,816<\/strong> chance of jackpotting the &#8220;Pick 6&#8221;.<\/p>\n<p>What does this have to do with botnets? Well, we&#8217;ve determined that \u2013\u00a0<strong>if you&#8217;re a US resident \u2013 you have a 1 in 6,000 chance of getting the ZeroAccess flu<\/strong> (or winning the ZeroAccess lottery, whichever makes you feel better). Don&#8217;t believe me? Let&#8217;s look at the data.<\/p>\n<p>For starters, we&#8217;re working with <a href=\"https:\/\/rud.is\/b\/wp-content\/uploads\/2012\/10\/zerogeo.csv\">this file<\/a> which is a summary file by US state that includes actual state population, the number of internet users in that state and the number of bots in that state (data is from <a href=\"https:\/\/www.internetworldstats.com\/stats26.htm\">Internet World Statistics<\/a>). As an example, Maine has:<\/p>\n<ul>\n<li>1,332,155 residents<\/li>\n<li>1,102,933 internet users<\/li>\n<li>219 bot infections<\/li>\n<\/ul>\n<p><em>(To aspiring security data scientists out there, I should point out that we&#8217;ve had to gather or crunch through on our own much of the data we&#8217;re using. While @fsecure gave us a great beginning, there&#8217;s no free data lunch)<\/em><\/p>\n<p>Where&#8217;d we get the <b>1 : 6000<\/b> figure? We can do some quick R math and view the histogram and summary data:<\/p>\n<pre lang=\"rsplus\">#read in the summary data\ndf <- read.csv(\"zerogeo.csv\", header=T)\n\n# calculate how many people for 1 bot infection per state:\ndf$per <- round(df$intUsers\/df$bots)\n\n# plot histogram of the spread\nhist(df$per, breaks=10, col=\"#CCCCFF\", freq=T, main=\"Internet Users per Bot Infection\")<\/pre>\n<p><center><img data-recalc-dims=\"1\" loading=\"lazy\" decoding=\"async\" data-attachment-id=\"1647\" data-permalink=\"https:\/\/rud.is\/b\/2012\/10\/08\/diy-zeroaccess-geoip-analysis-so-what\/bothist\/\" data-orig-file=\"https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2012\/10\/bothist.png?fit=550%2C450&amp;ssl=1\" data-orig-size=\"550,450\" data-comments-opened=\"1\" data-image-meta=\"{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;}\" data-image-title=\"bothist\" data-image-description=\"\" data-image-caption=\"\" data-large-file=\"https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2012\/10\/bothist.png?fit=510%2C417&amp;ssl=1\" src=\"https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2012\/10\/bothist.png?resize=510%2C417&#038;ssl=1\" alt=\"\" title=\"bothist\" width=\"510\" height=\"417\" class=\"aligncenter size-full wp-image-1647\" srcset=\"https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2012\/10\/bothist.png?w=550&amp;ssl=1 550w, https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2012\/10\/bothist.png?resize=300%2C245&amp;ssl=1 300w\" sizes=\"auto, (max-width: 510px) 100vw, 510px\" \/><\/center><\/p>\n<p>Along with the infection rate\/risk, we can also do a quick <a href=\"https:\/\/en.wikipedia.org\/wiki\/Linear_regression\">linear regression<\/a> to see if there's a correlation between the number of internet users in a state and the infection rate of that state:<\/p>\n<pre lang=\"rsplus\"># \"lm\" is an R function that, amongst other things, can be used for linear regression\n# so we use it to performa quick regression on how internet users describe bot infections\nusers <- lm(df$bots~df$intUsers)\n\n# and, R makes it easy to plot that model\nplot(df$intUsers, df$bots, xlab=\"Internet Users\", ylab=\"Bots\", pch=19, cex=0.7, col=\"#3333AA\")\nabline(users, col=\"#3333AA\")<\/pre>\n<p><center><img data-recalc-dims=\"1\" loading=\"lazy\" decoding=\"async\" data-attachment-id=\"1650\" data-permalink=\"https:\/\/rud.is\/b\/2012\/10\/08\/diy-zeroaccess-geoip-analysis-so-what\/regress\/\" data-orig-file=\"https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2012\/10\/regress.png?fit=550%2C450&amp;ssl=1\" data-orig-size=\"550,450\" data-comments-opened=\"1\" data-image-meta=\"{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;}\" data-image-title=\"regress\" data-image-description=\"\" data-image-caption=\"\" data-large-file=\"https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2012\/10\/regress.png?fit=510%2C417&amp;ssl=1\" src=\"https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2012\/10\/regress.png?resize=510%2C417&#038;ssl=1\" alt=\"\" title=\"regress\" width=\"510\" height=\"417\" class=\"alignnone size-full wp-image-1650\" srcset=\"https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2012\/10\/regress.png?w=550&amp;ssl=1 550w, https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2012\/10\/regress.png?resize=300%2C245&amp;ssl=1 300w\" sizes=\"auto, (max-width: 510px) 100vw, 510px\" \/><\/center><\/p>\n<p>Apart from some outliers (more on that in another post), there is \u2013\u00a0as Jay puts it \u2013 <em>\"very strong (statistical) relationship between the population of internet users and the infection rate in the states.\"<\/em> Some of you may be saying <em>\"Duh?!\"<\/em> right about now, but all we've had up until this point are dots or colors on a map. We've taken that superficial view (yes, it's just really eye candy) and given it some depth and meaning.<\/p>\n<p>We're pulling some demographic data from the US Census and will be doing another data summarization at the ZIP code level to see what other aspects (I'm really focused on analyzing median income by ZIP code to see if\/how that describes bot presence).<\/p>\n<p><em>If you made it this far, I'd really like to know what you would have thought the ZeroAccess \"flu\" chances were before seeing that it's 1 : 6,000 (since your guesstimate was probably based on the map views).<\/em><\/p>\n<p>Finally, Jay used the summary data to work up a choropleth in R:<\/p>\n<pre lang=\"rsplus\"># setup our environment\nlibrary(ggplot2)\nlibrary(maps)\nlibrary(colorspace)\n\n# read the data\nzero <- read.csv(\"zerogeo.csv\", header=T)\n\n# extract state geometries from maps library\nstates <- map_data(\"state\")\n\n# this \"cleans up the data\" to make it easier to merge with the built in state data\nzero.clean <- data.frame(region=tolower(zero$state), \n                         perBot=round(zero$intUsers\/zero$bots),\n                         intUsers=zero$intUsers)\nchoro <- merge(states, zero.clean, sort = FALSE, by = \"region\")\n\nchoro <- choro[order(choro$order),]\n\n# \"bin\" the data to enable us to use a better set of colors\nchoro$botBreaks <- cut(choro$perBot, 10)\n\n# get the plot\nc1 = qplot(long, lat, data = choro, group = group, fill = botBreaks, geom = \"polygon\", \n      main=\"Population of Internet Users to One Zero Access Botnet Infenction\") +\n        theme(axis.line=element_blank(),axis.text.x=element_blank(),\n              axis.text.y=element_blank(),axis.ticks=element_blank(),\n              axis.title.x=element_blank(),\n              axis.title.y=element_blank(),\n              panel.background=element_blank(),panel.border=element_blank(),panel.grid.major=element_blank(),\n              panel.grid.minor=element_blank(),plot.background=element_blank())\n\n# display it with modified color scheme (we hate the default ggplot2 blue)\nc1 + scale_fill_brewer(palette = \"Reds\")<\/pre>\n<p><center><img data-recalc-dims=\"1\" loading=\"lazy\" decoding=\"async\" data-attachment-id=\"1657\" data-permalink=\"https:\/\/rud.is\/b\/2012\/10\/08\/diy-zeroaccess-geoip-analysis-so-what\/choror\/\" data-orig-file=\"https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2012\/10\/choroR.png?fit=600%2C389&amp;ssl=1\" data-orig-size=\"600,389\" data-comments-opened=\"1\" data-image-meta=\"{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;}\" data-image-title=\"choroR\" data-image-description=\"\" data-image-caption=\"\" data-large-file=\"https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2012\/10\/choroR.png?fit=510%2C331&amp;ssl=1\" src=\"https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2012\/10\/choroR.png?resize=510%2C331&#038;ssl=1\" alt=\"\" title=\"choroR\" width=\"510\" height=\"331\" class=\"alignnone size-full wp-image-1657\" srcset=\"https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2012\/10\/choroR.png?w=600&amp;ssl=1 600w, https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2012\/10\/choroR.png?resize=300%2C194&amp;ssl=1 300w\" sizes=\"auto, (max-width: 510px) 100vw, 510px\" \/><\/center><\/p>\n","protected":false},"excerpt":{"rendered":"<p>NOTE: A great deal of this post comes from @jayjacobs as he took a conversation we were having about thoughts on ways to look at the data and just ran like the Flash with it. Did you know that \u2013\u00a0if you&#8217;re a US citizen \u2013\u00a0you have approximately a 1 in 5 chance of getting the [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":true,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"activitypub_content_warning":"","activitypub_content_visibility":"","activitypub_max_image_attachments":3,"activitypub_interaction_policy_quote":"anyone","activitypub_status":"","footnotes":""},"categories":[24,3,47,91],"tags":[],"class_list":["post-1640","post","type-post","status-publish","format-standard","hentry","category-charts-graphs","category-information-security","category-metrics","category-r"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.3 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>DIY ZeroAccess GeoIP Analysis : So What? - rud.is<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/rud.is\/b\/2012\/10\/08\/diy-zeroaccess-geoip-analysis-so-what\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"DIY ZeroAccess GeoIP Analysis : So What? - rud.is\" \/>\n<meta property=\"og:description\" content=\"NOTE: A great deal of this post comes from @jayjacobs as he took a conversation we were having about thoughts on ways to look at the data and just ran like the Flash with it. Did you know that \u2013\u00a0if you&#8217;re a US citizen \u2013\u00a0you have approximately a 1 in 5 chance of getting the [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/rud.is\/b\/2012\/10\/08\/diy-zeroaccess-geoip-analysis-so-what\/\" \/>\n<meta property=\"og:site_name\" content=\"rud.is\" \/>\n<meta property=\"article:published_time\" content=\"2012-10-08T14:24:45+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2018-03-10T12:53:18+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/rud.is\/b\/wp-content\/uploads\/2012\/10\/bothist.png\" \/>\n<meta name=\"author\" content=\"hrbrmstr\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"hrbrmstr\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"1 minute\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/rud.is\\\/b\\\/2012\\\/10\\\/08\\\/diy-zeroaccess-geoip-analysis-so-what\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/rud.is\\\/b\\\/2012\\\/10\\\/08\\\/diy-zeroaccess-geoip-analysis-so-what\\\/\"},\"author\":{\"name\":\"hrbrmstr\",\"@id\":\"https:\\\/\\\/rud.is\\\/b\\\/#\\\/schema\\\/person\\\/d7cb7487ab0527447f7fda5c423ff886\"},\"headline\":\"DIY ZeroAccess GeoIP Analysis : So What?\",\"datePublished\":\"2012-10-08T14:24:45+00:00\",\"dateModified\":\"2018-03-10T12:53:18+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/rud.is\\\/b\\\/2012\\\/10\\\/08\\\/diy-zeroaccess-geoip-analysis-so-what\\\/\"},\"wordCount\":501,\"commentCount\":2,\"publisher\":{\"@id\":\"https:\\\/\\\/rud.is\\\/b\\\/#\\\/schema\\\/person\\\/d7cb7487ab0527447f7fda5c423ff886\"},\"image\":{\"@id\":\"https:\\\/\\\/rud.is\\\/b\\\/2012\\\/10\\\/08\\\/diy-zeroaccess-geoip-analysis-so-what\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/rud.is\\\/b\\\/wp-content\\\/uploads\\\/2012\\\/10\\\/bothist.png\",\"articleSection\":[\"Charts &amp; Graphs\",\"Information Security\",\"Metrics\",\"R\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/rud.is\\\/b\\\/2012\\\/10\\\/08\\\/diy-zeroaccess-geoip-analysis-so-what\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/rud.is\\\/b\\\/2012\\\/10\\\/08\\\/diy-zeroaccess-geoip-analysis-so-what\\\/\",\"url\":\"https:\\\/\\\/rud.is\\\/b\\\/2012\\\/10\\\/08\\\/diy-zeroaccess-geoip-analysis-so-what\\\/\",\"name\":\"DIY ZeroAccess GeoIP Analysis : So What? - rud.is\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/rud.is\\\/b\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/rud.is\\\/b\\\/2012\\\/10\\\/08\\\/diy-zeroaccess-geoip-analysis-so-what\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/rud.is\\\/b\\\/2012\\\/10\\\/08\\\/diy-zeroaccess-geoip-analysis-so-what\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/rud.is\\\/b\\\/wp-content\\\/uploads\\\/2012\\\/10\\\/bothist.png\",\"datePublished\":\"2012-10-08T14:24:45+00:00\",\"dateModified\":\"2018-03-10T12:53:18+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/rud.is\\\/b\\\/2012\\\/10\\\/08\\\/diy-zeroaccess-geoip-analysis-so-what\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/rud.is\\\/b\\\/2012\\\/10\\\/08\\\/diy-zeroaccess-geoip-analysis-so-what\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/rud.is\\\/b\\\/2012\\\/10\\\/08\\\/diy-zeroaccess-geoip-analysis-so-what\\\/#primaryimage\",\"url\":\"https:\\\/\\\/i0.wp.com\\\/rud.is\\\/b\\\/wp-content\\\/uploads\\\/2012\\\/10\\\/bothist.png?fit=550%2C450&ssl=1\",\"contentUrl\":\"https:\\\/\\\/i0.wp.com\\\/rud.is\\\/b\\\/wp-content\\\/uploads\\\/2012\\\/10\\\/bothist.png?fit=550%2C450&ssl=1\",\"width\":\"550\",\"height\":\"450\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/rud.is\\\/b\\\/2012\\\/10\\\/08\\\/diy-zeroaccess-geoip-analysis-so-what\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/rud.is\\\/b\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"DIY ZeroAccess GeoIP Analysis : So What?\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/rud.is\\\/b\\\/#website\",\"url\":\"https:\\\/\\\/rud.is\\\/b\\\/\",\"name\":\"rud.is\",\"description\":\"&quot;In God we trust. All others must bring data&quot;\",\"publisher\":{\"@id\":\"https:\\\/\\\/rud.is\\\/b\\\/#\\\/schema\\\/person\\\/d7cb7487ab0527447f7fda5c423ff886\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/rud.is\\\/b\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\\\/\\\/rud.is\\\/b\\\/#\\\/schema\\\/person\\\/d7cb7487ab0527447f7fda5c423ff886\",\"name\":\"hrbrmstr\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/i0.wp.com\\\/rud.is\\\/b\\\/wp-content\\\/uploads\\\/2023\\\/10\\\/ukr-shield.png?fit=460%2C460&ssl=1\",\"url\":\"https:\\\/\\\/i0.wp.com\\\/rud.is\\\/b\\\/wp-content\\\/uploads\\\/2023\\\/10\\\/ukr-shield.png?fit=460%2C460&ssl=1\",\"contentUrl\":\"https:\\\/\\\/i0.wp.com\\\/rud.is\\\/b\\\/wp-content\\\/uploads\\\/2023\\\/10\\\/ukr-shield.png?fit=460%2C460&ssl=1\",\"width\":460,\"height\":460,\"caption\":\"hrbrmstr\"},\"logo\":{\"@id\":\"https:\\\/\\\/i0.wp.com\\\/rud.is\\\/b\\\/wp-content\\\/uploads\\\/2023\\\/10\\\/ukr-shield.png?fit=460%2C460&ssl=1\"},\"description\":\"Don't look at me\u2026I do what he does \u2014 just slower. #rstats avuncular \u2022 ?Resistance Fighter \u2022 Cook \u2022 Christian \u2022 [Master] Chef des Donn\u00e9es de S\u00e9curit\u00e9 @ @rapid7\",\"sameAs\":[\"http:\\\/\\\/rud.is\"],\"url\":\"https:\\\/\\\/rud.is\\\/b\\\/author\\\/hrbrmstr\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"DIY ZeroAccess GeoIP Analysis : So What? - rud.is","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/rud.is\/b\/2012\/10\/08\/diy-zeroaccess-geoip-analysis-so-what\/","og_locale":"en_US","og_type":"article","og_title":"DIY ZeroAccess GeoIP Analysis : So What? - rud.is","og_description":"NOTE: A great deal of this post comes from @jayjacobs as he took a conversation we were having about thoughts on ways to look at the data and just ran like the Flash with it. Did you know that \u2013\u00a0if you&#8217;re a US citizen \u2013\u00a0you have approximately a 1 in 5 chance of getting the [&hellip;]","og_url":"https:\/\/rud.is\/b\/2012\/10\/08\/diy-zeroaccess-geoip-analysis-so-what\/","og_site_name":"rud.is","article_published_time":"2012-10-08T14:24:45+00:00","article_modified_time":"2018-03-10T12:53:18+00:00","og_image":[{"url":"https:\/\/rud.is\/b\/wp-content\/uploads\/2012\/10\/bothist.png","type":"","width":"","height":""}],"author":"hrbrmstr","twitter_card":"summary_large_image","twitter_misc":{"Written by":"hrbrmstr","Est. reading time":"1 minute"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/rud.is\/b\/2012\/10\/08\/diy-zeroaccess-geoip-analysis-so-what\/#article","isPartOf":{"@id":"https:\/\/rud.is\/b\/2012\/10\/08\/diy-zeroaccess-geoip-analysis-so-what\/"},"author":{"name":"hrbrmstr","@id":"https:\/\/rud.is\/b\/#\/schema\/person\/d7cb7487ab0527447f7fda5c423ff886"},"headline":"DIY ZeroAccess GeoIP Analysis : So What?","datePublished":"2012-10-08T14:24:45+00:00","dateModified":"2018-03-10T12:53:18+00:00","mainEntityOfPage":{"@id":"https:\/\/rud.is\/b\/2012\/10\/08\/diy-zeroaccess-geoip-analysis-so-what\/"},"wordCount":501,"commentCount":2,"publisher":{"@id":"https:\/\/rud.is\/b\/#\/schema\/person\/d7cb7487ab0527447f7fda5c423ff886"},"image":{"@id":"https:\/\/rud.is\/b\/2012\/10\/08\/diy-zeroaccess-geoip-analysis-so-what\/#primaryimage"},"thumbnailUrl":"https:\/\/rud.is\/b\/wp-content\/uploads\/2012\/10\/bothist.png","articleSection":["Charts &amp; Graphs","Information Security","Metrics","R"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/rud.is\/b\/2012\/10\/08\/diy-zeroaccess-geoip-analysis-so-what\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/rud.is\/b\/2012\/10\/08\/diy-zeroaccess-geoip-analysis-so-what\/","url":"https:\/\/rud.is\/b\/2012\/10\/08\/diy-zeroaccess-geoip-analysis-so-what\/","name":"DIY ZeroAccess GeoIP Analysis : So What? - rud.is","isPartOf":{"@id":"https:\/\/rud.is\/b\/#website"},"primaryImageOfPage":{"@id":"https:\/\/rud.is\/b\/2012\/10\/08\/diy-zeroaccess-geoip-analysis-so-what\/#primaryimage"},"image":{"@id":"https:\/\/rud.is\/b\/2012\/10\/08\/diy-zeroaccess-geoip-analysis-so-what\/#primaryimage"},"thumbnailUrl":"https:\/\/rud.is\/b\/wp-content\/uploads\/2012\/10\/bothist.png","datePublished":"2012-10-08T14:24:45+00:00","dateModified":"2018-03-10T12:53:18+00:00","breadcrumb":{"@id":"https:\/\/rud.is\/b\/2012\/10\/08\/diy-zeroaccess-geoip-analysis-so-what\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/rud.is\/b\/2012\/10\/08\/diy-zeroaccess-geoip-analysis-so-what\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/rud.is\/b\/2012\/10\/08\/diy-zeroaccess-geoip-analysis-so-what\/#primaryimage","url":"https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2012\/10\/bothist.png?fit=550%2C450&ssl=1","contentUrl":"https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2012\/10\/bothist.png?fit=550%2C450&ssl=1","width":"550","height":"450"},{"@type":"BreadcrumbList","@id":"https:\/\/rud.is\/b\/2012\/10\/08\/diy-zeroaccess-geoip-analysis-so-what\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/rud.is\/b\/"},{"@type":"ListItem","position":2,"name":"DIY ZeroAccess GeoIP Analysis : So What?"}]},{"@type":"WebSite","@id":"https:\/\/rud.is\/b\/#website","url":"https:\/\/rud.is\/b\/","name":"rud.is","description":"&quot;In God we trust. All others must bring data&quot;","publisher":{"@id":"https:\/\/rud.is\/b\/#\/schema\/person\/d7cb7487ab0527447f7fda5c423ff886"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/rud.is\/b\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":["Person","Organization"],"@id":"https:\/\/rud.is\/b\/#\/schema\/person\/d7cb7487ab0527447f7fda5c423ff886","name":"hrbrmstr","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2023\/10\/ukr-shield.png?fit=460%2C460&ssl=1","url":"https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2023\/10\/ukr-shield.png?fit=460%2C460&ssl=1","contentUrl":"https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2023\/10\/ukr-shield.png?fit=460%2C460&ssl=1","width":460,"height":460,"caption":"hrbrmstr"},"logo":{"@id":"https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2023\/10\/ukr-shield.png?fit=460%2C460&ssl=1"},"description":"Don't look at me\u2026I do what he does \u2014 just slower. #rstats avuncular \u2022 ?Resistance Fighter \u2022 Cook \u2022 Christian \u2022 [Master] Chef des Donn\u00e9es de S\u00e9curit\u00e9 @ @rapid7","sameAs":["http:\/\/rud.is"],"url":"https:\/\/rud.is\/b\/author\/hrbrmstr\/"}]}},"jetpack_featured_media_url":"","jetpack_shortlink":"https:\/\/wp.me\/p23idr-qs","jetpack_likes_enabled":true,"jetpack-related-posts":[{"id":2590,"url":"https:\/\/rud.is\/b\/2013\/08\/21\/zeroaccess-bots-desperately-seeking-freedom-visualization\/","url_meta":{"origin":1640,"position":0},"title":"ZeroAccess Bots Desperately Seeking Freedom (Visualization)","author":"hrbrmstr","date":"2013-08-21","format":false,"excerpt":"I've been doing a bit of graphing (with real, non-honeypot network data) as part of the research for the book I'm writing with @jayjacobs and thought one of the images was worth sharing (especially since it may not make it into the book :-). Click image for larger view This\u2026","rel":"","context":"In &quot;Data Visualization&quot;","block_context":{"text":"Data Visualization","link":"https:\/\/rud.is\/b\/category\/data-visualization\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":1667,"url":"https:\/\/rud.is\/b\/2012\/10\/11\/diy-zeroaccess-analysis-lesson-1-treat-geoip-results-lightly\/","url_meta":{"origin":1640,"position":1},"title":"DIY ZeroAccess Analysis Lesson #1 : Treat GeoIP Results Lightly","author":"hrbrmstr","date":"2012-10-11","format":false,"excerpt":"UPDATE: While the cautionary advice still (IMO) holds true, it turns out that \u2013 once I actually looked at the lat\/lng pair being returned for the anomaly presented below, the weird results come from horrible precision resolution from the initial IP address \u2192 lat\/lng conversion (which isn't the fault of\u2026","rel":"","context":"In &quot;Charts &amp; Graphs&quot;","block_context":{"text":"Charts &amp; Graphs","link":"https:\/\/rud.is\/b\/category\/charts-graphs\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":1591,"url":"https:\/\/rud.is\/b\/2012\/10\/05\/diy-zeroaccess-geoip-plots\/","url_meta":{"origin":1640,"position":2},"title":"DIY ZeroAccess GeoIP Plots","author":"hrbrmstr","date":"2012-10-05","format":false,"excerpt":"Since F-Secure was #spiffy enough to provide us with GeoIP data for mapping the scope of the ZeroAccess botnet, I thought that some aspiring infosec data scientists might want to see how to use something besides Google Maps & Google Earth to view the data. If you look at the\u2026","rel":"","context":"In &quot;Charts &amp; Graphs&quot;","block_context":{"text":"Charts &amp; Graphs","link":"https:\/\/rud.is\/b\/category\/charts-graphs\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":1622,"url":"https:\/\/rud.is\/b\/2012\/10\/05\/diy-zeroaccess-geoip-visualizations-back-to-the-basics\/","url_meta":{"origin":1640,"position":3},"title":"DIY ZeroAccess GeoIP Visualizations :: Back To The Basics","author":"hrbrmstr","date":"2012-10-05","format":false,"excerpt":"While shiny visualizations are all well-and-good, sometimes plain ol' charts & graphs can give you the data you're looking for. If we take the one-liner filter from the previous example and use it to just output CSV-formatted summary data: cat ZeroAccessGeoIPs.csv | cut -f1,1 -d\\,| sort | uniq -c |\u2026","rel":"","context":"In &quot;Charts &amp; Graphs&quot;","block_context":{"text":"Charts &amp; Graphs","link":"https:\/\/rud.is\/b\/category\/charts-graphs\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":1611,"url":"https:\/\/rud.is\/b\/2012\/10\/05\/more-diy-zeroaccess-geoip-fun-jqueryd3-choropleths\/","url_meta":{"origin":1640,"position":4},"title":"More DIY ZeroAccess GeoIP Fun : jQuery\/D3 Choropleths","author":"hrbrmstr","date":"2012-10-05","format":false,"excerpt":"In the spirit of the previous example this one shows you how to do a quick, country-based choropleth in D3\/jQuery with some help from the command-line since not everyone is equipped to kick out some R and most folks I know are very handy at a terminal prompt. I took\u2026","rel":"","context":"In &quot;Charts &amp; Graphs&quot;","block_context":{"text":"Charts &amp; Graphs","link":"https:\/\/rud.is\/b\/category\/charts-graphs\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":4805,"url":"https:\/\/rud.is\/b\/2017\/01\/02\/removing-personal-bias-from-flu-severity-estimation-a-k-a-misery-loves-data\/","url_meta":{"origin":1640,"position":5},"title":"Removing Personal Bias From Flu Severity Estimation (a.k.a. Misery Loves Data)","author":"hrbrmstr","date":"2017-01-02","format":false,"excerpt":"The family got hit pretty hard with the flu right as the Christmas festivities started and we were all pretty much bed-ridden zombies up until today (2017-01-02). When in the throes of a very bad ILI it's easy to imagine that you're a victim of a severe outbreak, especially with\u2026","rel":"","context":"In &quot;ggplot&quot;","block_context":{"text":"ggplot","link":"https:\/\/rud.is\/b\/category\/ggplot\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2017\/01\/Cursor_and___Development_cdcfluview_-_master_-_RStudio-1.png?fit=1200%2C610&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2017\/01\/Cursor_and___Development_cdcfluview_-_master_-_RStudio-1.png?fit=1200%2C610&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2017\/01\/Cursor_and___Development_cdcfluview_-_master_-_RStudio-1.png?fit=1200%2C610&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2017\/01\/Cursor_and___Development_cdcfluview_-_master_-_RStudio-1.png?fit=1200%2C610&ssl=1&resize=700%2C400 2x, https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2017\/01\/Cursor_and___Development_cdcfluview_-_master_-_RStudio-1.png?fit=1200%2C610&ssl=1&resize=1050%2C600 3x"},"classes":[]}],"jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/rud.is\/b\/wp-json\/wp\/v2\/posts\/1640","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/rud.is\/b\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/rud.is\/b\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/rud.is\/b\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/rud.is\/b\/wp-json\/wp\/v2\/comments?post=1640"}],"version-history":[{"count":0,"href":"https:\/\/rud.is\/b\/wp-json\/wp\/v2\/posts\/1640\/revisions"}],"wp:attachment":[{"href":"https:\/\/rud.is\/b\/wp-json\/wp\/v2\/media?parent=1640"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/rud.is\/b\/wp-json\/wp\/v2\/categories?post=1640"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/rud.is\/b\/wp-json\/wp\/v2\/tags?post=1640"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}