I've seen maps like this discussed[0] on /r/netsec/ and other similar forums and from my understanding, they are mostly useless. It's aggregates some data to make a very pretty site, but doesn't really give you anything actionable. Normally you need to run it through real monitoring tools with various thresholds configured so you can alert the proper teams to act when something odd is going on.

[0] http://www.reddit.com/r/netsec/comments/2xuai9/pewpew_your_v...

The Norse Map used to have a little "about" section that explained how the map is a general aggregation of data and designed to show at a very high level what is going on, but doesn't provide any deep insight into each attack. The famous disclaimer "for entertainment purposes only" comes to mind, but in reality I think the Norse Map is just a really neat and sort-of functional advertisement for the capabilities of Norse. If you go to http://norsecorp.com, you'll see that the company behind the map is a security firm that wants you to pay for "real-time visibility into global cyber attacks", which means either signing up for their service that alerts you of weird activity on your network, or purchasing their appliance that can help block attacks at the point of entry. I'd conclude that the map is not really meant to actually provide real threat warnings, but rather a way to see into what the Norse Intelligence Service is capable of monitoring.

Norse is generally considered a joke by all the professionals I know in the infosec and threat intelligence industries, and not just for their silly map. Even moreso after their recent Iran report, done in conjunction with the political thinktank American Enterprise Institute. No bias there at all.

Agree, though I think the value in this is purely demonstrative to non-tech people, just to try to emphasise specific concepts.

With a title like that, I was at first expecting to see a map of coastal attacks against northern Europe.

This map has much better pew pew sounds: http://threatbutt.com/map/

Thought it was a video game. Tried shooting back at China.

Nops. The only winning move is not to play.

How about global thermonuclear war?

A strange game. The only winning move is not to play. How about a nice game of chess?

Plot twist, you are China.

Are there any open source map platforms like this for integrating into real time data feeds (i.e. if we want to track sales by region etc...) onto a map?

I know about http://cesiumjs.org/ but it was extremely resource intensive heavy last time I tried to use it.

EDIT: it looks like they use http://leafletjs.com/ -- looks interesting

There's this https://github.com/hrbrmstr/pewpew it's as much a criticism of these sorts of security visualizations as it is a means to create them.

You can take a look at http://www.jsgraphs.com/ which has a list.

http://echarts.baidu.com/doc/example-en.html#map

http://echarts.baidu.com/doc/example/map9.html#-en

http://echarts.baidu.com/extension/BMap/doc/example.html#-en

http://echarts.baidu.com/doc/example/map12.html#-en

Hi. You can try https://map.blueliv.com/

Disclaimer: I work there.

Seems like China needs to go to internet time-out.

what is norse, and why does it hate st. louis?

LOL, I had the same initial reaction. Apparently Norse monitors global cyber attacks[1]. So the real question is not why they hate St. Louis but why does China hate St. Louis?

I found the link while reading conspiracy theories about the NYSE shut down this morning[2]. I have no idea about the quality of the data. I just thought the visualization was cool.

[1] http://norsecorp.com/. [2] http://www.zerohedge.com/news/2015-07-08/what-first-world-cy...

Norse has offices in St. Louis and I'm sure that's where they host the majority of their honeypots. Thus, you see a lot of attacks hitting St. Louis.

There are 16 colo centers in St. Louis according to http://www.datacentermap.com/usa/missouri/st-louis/, I wonder if anyone interesting has rack space there.

Norse Corp. is a threat intelligence company. I believe one of their HQ is located in St. Louis and is where they currently host many of their honeypots. That is why you see St. Louis being attacked a lot.

Seems like China hates St Louis?

I've never posted a link to a Fox News affiliate before... Here goes!

http://fox2now.com/2015/07/08/is-st-louis-under-a-cyber-atta...

Ok, so.. Norse Corp, the ones that make the map, has offices in St. Louis.

"We are not under attack. We are not going to die. You have to come to work tomorrow."

Awesome.

Wow, that FOX site has actually replaced the original article with the one you see now. There's NO mention of the change.

We're shocked.

That's because of all the defense / Intel work in St. Louis (Scott afb etc). And to the other commenter talking about Kirksville, that's where the JSS is.

What's even funnier is all the attacks aimed at Kirksville. What a funny little one-horse town that is.

If Norse wanted to make this data useful, they'd present it as a CSV, too. How else could I determine if one entity owns all the St. Louis targets??? :)

They actually sell that sort of data feed. The map is an ad.

The company that runs this attack map published a blog post about China yesterday.

http://darkmatters.norsecorp.com/2015/07/07/chinas-new-secur...

[EDIT: removed 'unflattering'.]

Their homepage says "Norse Tracks over 200,000 tor exit nodes". Tor metrics [1] says there exist 1,000 ish Tor exit nodes. So is Norse's statement a blatant lie?

[1] https://metrics.torproject.org/relayflags.html

I don't know much about network security. Is there a difference between the kind of attacks that would be caught by honeypots vs targeted attacks? Do these statistics depend heavily on how they setup their honeypots, which I assume is limited by the company's logistics.

How do they collect this data?

Honeypots

That would, in my view, mean I shouldn't take the map as accurate.

What does "accurate" mean? It's not comprehensive - what it does is show you where their honeypots get the most attacks from over time.

That said, it's not all that useful - there's no shocking information here. As mentioned, it's largely a marketing tool.

Correct. But you could do a pretty good idea with some honeypots (customers) and a few agreements with ISPs to see where similar packets go.

Not sure how they are getting their attack data. Especially since they are classifying shodan as an "attacker"

interesting that attacks come directly from China instead of say some botnets distributed around the world.

China probably has the most compromised PCs due to the levels of piracy there.

This is more of a sales pitching device (and it's a nice one) than a useful tool

What about that spot mid Russia which just pulsates? attacking itself?

I expected Russia to be active.