akamai’s [state of the internet]

Q3 2015 executive review

[state of the internet] / Q3 2015 executive review

2 Download the full reports at www.stateoftheinternet.com

about the review / Akamai, the world’s leading

content delivery network (CDN) provider, uses its

globally distributed Intelligent PlatformTM to process

approximately 2 trillion Internet transactions each day.

This allows us to gather massive amounts of data on

many metrics related to broadband connectivity, cloud

security and media delivery. The State of the Internet

program was built to leverage that data to better enable

businesses and governments to make intelligent,

strategic decisions. Each quarter, Akamai uses this data

to publish reports in the State of the Internet program

focused on broadband connectivity and cloud security.

[state of the internet] / Q3 2015 executive review

3 Download the full reports at www.stateoftheinternet.com

GLOBAL BROADBAND LEADERS

5.1 Mbps /Global Average

Connection Speed

32.2 Mbps /Global Average

Peak Connection Speed

Country/Region Q3 2015Avg. Mbps

– Global 5.1

1 South Korea 20.5

2 Sweden 17.4

3 Norway 16.4

4 Switzerland 16.2

5 Hong Kong 15.8

6 Netherlands 15.6

7 Japan 15.0

8 Finland 14.8

9 Latvia 14.5

10 Czech Republic 14.5

Country/Region Q3 2015Peak Mbps

– Global 32.2

1 Singapore 135.4

2 Hong Kong 101.1

3 South Korea 86.6

4 Japan 78.4

5 Taiwan 77.9

6 Qatar 75.2

7 Macao 73.7

8 Romania 72.9

9 Israel 70.0

10 Sweden 69.0

Global Top 10 / Average Peak Connection SpeedsGlobal Top 10 / Average Connection Speeds

internet and broadband adoption / The State of the Internet / Connectivity Report is now in its 8th year of publication. In it, Akamai reports extensively on Internet connection speeds, network connectivity/availability issues, and IPv6 adoption progress.

[state of the internet] / Q3 2015 executive review

4 Download the full reports at www.stateoftheinternet.com

IPv4

Ad

dre

sses

(Mill

ions

)

0

5

10

15

20

25

3035

4540

50

RIPENCCLACNICARINAPNICAFRINIC

1-Jul 8-Jul 15-Jul 22-Jul 29-Jul 26-Aug 9-Sep 16-Sep 23-Sep 30-Sep5-Aug 12-Aug 19-Aug

Broadband Adoption / This section illustrates the global leaders with the highest percentage of unique ip addresses connecting to Akamai with average connection speeds above four separate thresholds.

Available IPv4 Space Continues Steady Decline:

Available IPv4 Address Pool Size by RIR, Q3 2015

96%4+ Mbps

Bulgaria/ South Korea

68%10+ Mbps

South Korea

45%15+ Mbps

South Korea

24%25+ Mbps

South Korea

DOWNLOAD THE FULL REPORT

TAPHERE

IPv4 Exhaustion and IPv6 Adoption / Country with the highest percentage of

content requests made to Akamai over IPV6:

35%OF TRAFFIC OVER IPv6

Belgium

[state of the internet] / Q3 2015 executive review

5 Download the full reports at www.stateoftheinternet.com

IPv4

Ad

dre

sses

(Mill

ions

)

121110

9876543210

RIPENCCLACNICARINAPNICAFRINIC

1-Jul 8-Jul 15-Jul 22-Jul 29-Jul 26-Aug 9-Sep 16-Sep 23-Sep 30-Sep5-Aug 12-Aug 19-Aug

Total Number of IPv4 Address Pool Size by RIR, Q3 2015

[state of the internet] / Q3 2015 executive review

6 Download the full reports at www.stateoftheinternet.com

Cloud Security / The q2 2015 State of the Internet / Security Report combines the DDoS attack data previously published in the classic State of the Internet Report with the data previously published in the quarterly Prolexic DDoS Attack Report.

DDoS Update / Attack activity over our network jumped again this quarter, setting a record for the number of DDoS attacks. At the same time, average peak bandwidth and packets-per-second have been dropping, a trend continued from q2. The use of reflection-based DDoS methods by DDoS-for-hire sites resulted in smaller attacks on average than we have observed from infection-based botnets. Akamai tracked nine infrastructure-layer reflection attack vectors, including the three newer reflection attacks: NetBIOS, Sentinel, and rpc. There were eight mega attacks greater than 100 gigabits per second (Gbps), with the largest at 149 Gbps. Half of all attacks were between 400 Mbps to 5 Gbps. The online gaming sector was hit particularly hard in q3, accounting for half of all DDoS attacks. Media and entertainment faced more of the biggest DDoS attacks.

CLOUD SECURITY

YEAR-OVER-YEAR STATS [Q3 2014 – Q3 2015]

180% increase in total DDoS attacks

66% decrease in average peak bandwidth

89% decrease in average peak packets per second

26% increase in application layer attacks

198% increase in infrastructure layer attacks

16% decrease in average attack duration

SSDP attacks: 0 vs. 16% of all attacks

LARGEST ATTACK

Q3 2015

Q2 2015

149 Gbps

249 Gbps

q3 marks the first time Akamai Edge Firewall data is analyzed in the report. Edge Firewall data sets provide a broad look at attack activity at the global platform perimeter — with information on attack traffic coming from 200,000 machines outfitted with Akamai. The data was used to identify more than 1.5 million DDoS reflectors on a geographical heatmap.

DDoS Size as a Function of Time

0.100

10.000

0.001

Q3 2013

Q4 2013

Q1 2014

Q2 2014

Q3 2014

Q4 2014

Q1 2015

Q2 2015

Q3 2015

DDoS attacks from Q3 2013 to Q3 2015. Each dot represents a DDoS attack, and each interval covers a 10-fold increase in attack size

Gb

ps

DDoS Reflector Heatmap, Q3 2015

A geographical heat map of victim SSDP, CHARGEN, NTP and QOTD reflectors in Q3 2015

7 Download the full reports at www.stateoftheinternet.com

[state of the internet] / Q3 2015 executive review

[state of the internet] / Q3 2015 executive review

8 Download the full reports at www.stateoftheinternet.com

attack spotlight / When it comes to DDoS attacks, high bandwidth is usually the most notable metric, but a high packet-per-second rate can also be devastating. In q3, Akamai mitigated an attack that would require at least 145 Gbps of available bandwidth just to withstand its brunt. Further, the attack generated a record-setting 222 million packets-per-second (Mpps).

web application attack statistics / Last quarter Shellshock over https dominated web application attacks observed by Akamai, but this was not the case in q3. Local file inclusion (lfi) and sql injection (SQLi) attacks over http were by far the most prevalent web application attack vectors in q3. There was a notable increase in WordPress plugin attack attempts, not only for popular plugins but also for less-known vulnerable plugins.

Web application attacks rely heavily on botnets that take advantage of unsecured home-based routers and devices.

The retail industry was hit hardest, receiving 55% of web application attacks, with the financial services industry a distant second, receiving 15% of attacks. The u.s. was the main source of web application attacks (59%), and sites within the u.s. in were the most common target (75%).

China / 21% India / 7%UK / 26% USA / 17% Spain / 7%

Top 5 source countries for DDoS attacks in Q3 / Non-spoofed attacking IP addresses by source country for DDoS attacks mitigated during Q3 2015

[state of the internet] / Q3 2015 executive review

9 Download the full reports at www.stateoftheinternet.com

16

14

12

10

8

6

4

2

0

Perc

enta

ge

Ret

ail P

erce

ntag

e

60

50

40

30

20

10

0FinancialServices

14.70

Media &Entertainment

7.99

PublicSector

7.24

Hotel &Travel

7.16

HighTechnology

ConsumerGoods

Gaming Other

1.492.69

1.59Retail

54.52

2.62

Web Application Attacks by Industry, Q3 2015

Retail suffered the vast majority of web application attacks in Q3 2015 — 55%

[state of the internet]

EditorDavid Belson

DesignShawn Doughty, Creative DirectionBrendan O’Hara, Art Direction/Design

Contactstateoftheinternet@akamai.comTwitter: @akamai_soti / @akamai www.stateoftheinternet.com

[state of the internet] / secur i ty

ContentDavid Fernandez, Editor in ChiefBill Brenner, Managing EditorJose Arteaga, Data Visualization and ResearchEzra Caltum, Web Application Threat ResearchMartin McKeay, Senior Editor

ContributorsDave Lewis, EditorJon Thompson, Threat Data ModelingPatrick Laverty, ResearchLarry Cashdollar, ResearchChad Seaman, Research

DesignShawn Doughty, Creative DirectionBrendan O’Hara, Art Direction/Design

Contactstateoftheinternet@akamai.comTwitter: @State_Internet / @akamaiwww.stateoftheinternet.com

©2015 Akamai Technologies, Inc. All Rights Reserved. Reproduction in whole or in part in any form or medium without express written permission is prohibited. Akamai and the Akamai wave logo are registered trademarks. Other trademarks contained herein are the property of their respective owners. Akamai believes that the information in this publication is accurate as of its publication date; such information is subject to change without notice. Published 12/15.

Akamai is headquartered in Cambridge, Massachusetts in the United States with operations in more than 57 offices around the world. Our services and renowned customer care are designed to enable businesses to provide an unparalleled Internet experience for their customers worldwide. Addresses, phone numbers and contact information for all locations are listed on www.akamai.com/locations.

As the global leader in Content Delivery Network (cdn) services, Akamai makes the Internet fast, reliable and secure for its customers. The company’s advanced web performance, mobile performance, cloud security and media delivery solutions are revolutionizing how businesses optimize consumer, enterprise and entertainment experiences for any device, anywhere. To learn how Akamai solutions and its team of Internet experts are helping businesses move faster forward, please visit www.akamai.com or blogs.akamai.com, and follow @Akamai on Twitter.

Download the Ful l Reports

[state of the internet] report

Q3 2015

[state of the internet] / security report

Q3 2015