arXiv subjects

Andrea Sordello

Publications and source records attributed to Andrea Sordello.

2 recordsLinked to original sources

arXiv2026

Holoscope: Open and Lightweight Telescope & Honeypot Platform

The complexity and scale of Internet attacks call for distributed, cooperative observatories capable of monitoring malicious traffic across diverse networks. Holoscope is an open, lightweight, and cloud-native platform designed to simplify the deployment and management of telescope (passive) and honeypot (active) sensors. Built upon K3s and WireGuard, Holoscope offers secure connectivity, automated sensor onboarding, and resilient operation even in resource-constrained environments. Through modular design and Infrastructure-as-Code principles, it supports dynamic sensor orchestration, automated recovery, and data processing. We build, deploy, and operate Holoscope across multiple institutions and cloud networks in Europe and Brazil, enabling unified visibility into large-scale attack phenomena while maintaining ease of integration and security compliance.

cs.DC↗

arXiv2026

The Potential of Erroneous Outbound Traffic Analysis to Unveil Silent Internal Anomalies

Passive measurement has traditionally focused on inbound traffic to detect malicious activity, based on the assumption that threats originate externally. In this paper, we offer a complementary perspective by examining outbound traffic, and argue that a narrow subset -- what we term erroneous outbound traffic -- is a lighter and revealing yet overlooked data source for identifying a broad range of security threats and network problems. This traffic consists of packets sent by internal hosts that either receive no response, trigger ICMP errors, or are ICMP error messages themselves generated in response to unsolicited requests. To demonstrate its potential, we collect and analyse erroneous traffic from a large network, uncovering a variety of previously unnoticed issues, including misconfigurations, obsolete deployments and compromised hosts.

cs.NI↗