Potential cyber-threats against Canada’s critical infrastructure: an investigation of online discussion forums

Abstract

ABSTRACT Critical infrastructures (CI) are connecting their systems to the internet at an increasing rate, providing the opportunity for malicious actors to attack these systems using cyber-weapons. Compromised systems then pose issues for the affected company, and may disrupt the broader population. The purpose of the current study was to analyze IP addresses collected from discussion forums, with a specific interest in which Canadian CIs could potentially be at risk of a cyber-attack. Overall, 897,524 IP addresses were extracted from 47,134,503 posts across 20 discussion forums, 39,164 of which were associated with Canadian CI. Of all Canadian CI sectors, the majority of IP addresses were found to belong to the information and technology sector. A thematic analysis of posts containing IP addresses was conducted, revealing that the majority of posters were sharing large lists of IP addresses with no context given. Lastly, a keyword search was employed on the forums in an attempt to understand discussions surrounding CI. A thematic analysis was employed on a random sample of posts containing keywords, revealing two major themes: Potential threat and threat information. Findings from this study reveal that information useful for conducting cyber-attacks against CI is being shared within these online forums.