{"id":"https://openalex.org/W7116798794","doi":"https://doi.org/10.23919/cnsm67658.2025.11297506","title":"Double-Edged Sword: An Empirical Study on the Contribution of Cloud Providers in Malicious Infrastructure","display_name":"Double-Edged Sword: An Empirical Study on the Contribution of Cloud Providers in Malicious Infrastructure","publication_year":2025,"publication_date":"2025-10-27","ids":{"openalex":"https://openalex.org/W7116798794","doi":"https://doi.org/10.23919/cnsm67658.2025.11297506"},"language":"en","primary_location":{"id":"doi:10.23919/cnsm67658.2025.11297506","is_oa":false,"landing_page_url":"https://doi.org/10.23919/cnsm67658.2025.11297506","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2025 21st International Conference on Network and Service Management (CNSM)","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://research.utwente.nl/en/publications/cb26137c-9b70-41ef-93ee-93ff28b2824d","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5056261980","display_name":"Sousan Tarahomi","orcid":null},"institutions":[{"id":"https://openalex.org/I94624287","display_name":"University of Twente","ror":"https://ror.org/006hf6230","country_code":"NL","type":"education","lineage":["https://openalex.org/I94624287"]}],"countries":["NL"],"is_corresponding":false,"raw_author_name":"Sousan Tarahomi","raw_affiliation_strings":["University of Twente,Enschede,The Netherlands"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Twente,Enschede,The Netherlands","institution_ids":["https://openalex.org/I94624287"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5002961985","display_name":"Raffaele Sommese","orcid":"https://orcid.org/0000-0003-3484-9259"},"institutions":[{"id":"https://openalex.org/I94624287","display_name":"University of Twente","ror":"https://ror.org/006hf6230","country_code":"NL","type":"education","lineage":["https://openalex.org/I94624287"]}],"countries":["NL"],"is_corresponding":false,"raw_author_name":"Raffaele Sommese","raw_affiliation_strings":["University of Twente,Enschede,The Netherlands"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Twente,Enschede,The Netherlands","institution_ids":["https://openalex.org/I94624287"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5121004903","display_name":"Jeroen Linssen","orcid":null},"institutions":[{"id":"https://openalex.org/I2801398864","display_name":"Saxion","ror":"https://ror.org/005t9n460","country_code":"NL","type":"education","lineage":["https://openalex.org/I2801398864"]}],"countries":["NL"],"is_corresponding":false,"raw_author_name":"Jeroen Linssen","raw_affiliation_strings":["Saxion University of Applied Sciences,Enschede,The Netherlands"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Saxion University of Applied Sciences,Enschede,The Netherlands","institution_ids":["https://openalex.org/I2801398864"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5005480813","display_name":"Ralph Holz","orcid":"https://orcid.org/0000-0001-9614-2377"},"institutions":[{"id":"https://openalex.org/I94624287","display_name":"University of Twente","ror":"https://ror.org/006hf6230","country_code":"NL","type":"education","lineage":["https://openalex.org/I94624287"]}],"countries":["NL"],"is_corresponding":false,"raw_author_name":"Ralph Holz","raw_affiliation_strings":["University of Twente,Enschede,The Netherlands"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Twente,Enschede,The Netherlands","institution_ids":["https://openalex.org/I94624287"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5025537461","display_name":"Anna Sperotto","orcid":"https://orcid.org/0000-0002-9481-5846"},"institutions":[{"id":"https://openalex.org/I94624287","display_name":"University of Twente","ror":"https://ror.org/006hf6230","country_code":"NL","type":"education","lineage":["https://openalex.org/I94624287"]}],"countries":["NL"],"is_corresponding":false,"raw_author_name":"Anna Sperotto","raw_affiliation_strings":["University of Twente,Enschede,The Netherlands"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Twente,Enschede,The Netherlands","institution_ids":["https://openalex.org/I94624287"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.58173897,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"1","last_page":"7"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.25189998745918274,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.25189998745918274,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11614","display_name":"Cloud Data Security Solutions","score":0.23489999771118164,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.17180000245571136,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/cloud-computing","display_name":"Cloud computing","score":0.9057999849319458},{"id":"https://openalex.org/keywords/the-internet","display_name":"The Internet","score":0.5565000176429749},{"id":"https://openalex.org/keywords/flexibility","display_name":"Flexibility (engineering)","score":0.5412999987602234},{"id":"https://openalex.org/keywords/software-deployment","display_name":"Software deployment","score":0.5350000262260437},{"id":"https://openalex.org/keywords/empirical-research","display_name":"Empirical research","score":0.53329998254776},{"id":"https://openalex.org/keywords/cloud-computing-security","display_name":"Cloud computing security","score":0.4699999988079071},{"id":"https://openalex.org/keywords/focus","display_name":"Focus (optics)","score":0.41819998621940613},{"id":"https://openalex.org/keywords/core","display_name":"Core (optical fiber)","score":0.3928000032901764}],"concepts":[{"id":"https://openalex.org/C79974875","wikidata":"https://www.wikidata.org/wiki/Q483639","display_name":"Cloud computing","level":2,"score":0.9057999849319458},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.680899977684021},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.5893999934196472},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.5565000176429749},{"id":"https://openalex.org/C2780598303","wikidata":"https://www.wikidata.org/wiki/Q65921492","display_name":"Flexibility (engineering)","level":2,"score":0.5412999987602234},{"id":"https://openalex.org/C105339364","wikidata":"https://www.wikidata.org/wiki/Q2297740","display_name":"Software deployment","level":2,"score":0.5350000262260437},{"id":"https://openalex.org/C120936955","wikidata":"https://www.wikidata.org/wiki/Q2155640","display_name":"Empirical research","level":2,"score":0.53329998254776},{"id":"https://openalex.org/C184842701","wikidata":"https://www.wikidata.org/wiki/Q370563","display_name":"Cloud computing security","level":3,"score":0.4699999988079071},{"id":"https://openalex.org/C192209626","wikidata":"https://www.wikidata.org/wiki/Q190909","display_name":"Focus (optics)","level":2,"score":0.41819998621940613},{"id":"https://openalex.org/C2164484","wikidata":"https://www.wikidata.org/wiki/Q5170150","display_name":"Core (optical fiber)","level":2,"score":0.3928000032901764},{"id":"https://openalex.org/C12725497","wikidata":"https://www.wikidata.org/wiki/Q810247","display_name":"Baseline (sea)","level":2,"score":0.3346000015735626},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.3343000113964081},{"id":"https://openalex.org/C108827166","wikidata":"https://www.wikidata.org/wiki/Q175975","display_name":"Internet privacy","level":1,"score":0.3239000141620636},{"id":"https://openalex.org/C93996380","wikidata":"https://www.wikidata.org/wiki/Q44127","display_name":"Server","level":2,"score":0.3160000145435333},{"id":"https://openalex.org/C38822068","wikidata":"https://www.wikidata.org/wiki/Q131406","display_name":"Denial-of-service attack","level":3,"score":0.3059999942779541},{"id":"https://openalex.org/C116537","wikidata":"https://www.wikidata.org/wiki/Q2169973","display_name":"Service provider","level":3,"score":0.28459998965263367},{"id":"https://openalex.org/C2983819522","wikidata":"https://www.wikidata.org/wiki/Q483639","display_name":"Cloud service provider","level":4,"score":0.27959999442100525},{"id":"https://openalex.org/C75684735","wikidata":"https://www.wikidata.org/wiki/Q858810","display_name":"Big data","level":2,"score":0.27059999108314514},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.2662000060081482},{"id":"https://openalex.org/C2777059624","wikidata":"https://www.wikidata.org/wiki/Q914359","display_name":"Cloud storage","level":3,"score":0.26089999079704285},{"id":"https://openalex.org/C81860439","wikidata":"https://www.wikidata.org/wiki/Q251212","display_name":"Internet of Things","level":2,"score":0.25369998812675476}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.23919/cnsm67658.2025.11297506","is_oa":false,"landing_page_url":"https://doi.org/10.23919/cnsm67658.2025.11297506","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2025 21st International Conference on Network and Service Management (CNSM)","raw_type":"proceedings-article"},{"id":"pmh:oai:ris.utwente.nl:openaire/cb26137c-9b70-41ef-93ee-93ff28b2824d","is_oa":true,"landing_page_url":"https://research.utwente.nl/en/publications/cb26137c-9b70-41ef-93ee-93ff28b2824d","pdf_url":null,"source":{"id":"https://openalex.org/S4406922991","display_name":"University of Twente Research Information","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"other-oa","license_id":"https://openalex.org/licenses/other-oa","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Tarahomi Yousofi Sherbaf, S, Sommese, R, Linssen, J M, Holz, R & Sperotto, A 2025, Double-Edged Sword : An Empirical Study on the Contribution of Cloud Providers in Malicious Infrastructure. in 21st International Conference on Network and Service Management (CNSM). IEEE, 21st International Conference on Network and Service Management, CNSM 2025, Bologna, Italy, 27/10/25. https://doi.org/10.23919/CNSM67658.2025.11297506","raw_type":"info:eu-repo/semantics/conferenceObject"}],"best_oa_location":{"id":"pmh:oai:ris.utwente.nl:openaire/cb26137c-9b70-41ef-93ee-93ff28b2824d","is_oa":true,"landing_page_url":"https://research.utwente.nl/en/publications/cb26137c-9b70-41ef-93ee-93ff28b2824d","pdf_url":null,"source":{"id":"https://openalex.org/S4406922991","display_name":"University of Twente Research Information","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"other-oa","license_id":"https://openalex.org/licenses/other-oa","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Tarahomi Yousofi Sherbaf, S, Sommese, R, Linssen, J M, Holz, R & Sperotto, A 2025, Double-Edged Sword : An Empirical Study on the Contribution of Cloud Providers in Malicious Infrastructure. in 21st International Conference on Network and Service Management (CNSM). IEEE, 21st International Conference on Network and Service Management, CNSM 2025, Bologna, Italy, 27/10/25. https://doi.org/10.23919/CNSM67658.2025.11297506","raw_type":"info:eu-repo/semantics/conferenceObject"},"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/9","display_name":"Industry, innovation and infrastructure","score":0.6502550840377808}],"awards":[],"funders":[{"id":"https://openalex.org/F4320320300","display_name":"European Commission","ror":"https://ror.org/00k4n6c32"},{"id":"https://openalex.org/F4320321800","display_name":"Nederlandse Organisatie voor Wetenschappelijk Onderzoek","ror":"https://ror.org/04jsz6e67"}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":12,"referenced_works":["https://openalex.org/W1993390796","https://openalex.org/W2344804892","https://openalex.org/W2538613254","https://openalex.org/W2695177217","https://openalex.org/W2941041872","https://openalex.org/W3012038311","https://openalex.org/W3097435565","https://openalex.org/W3127553735","https://openalex.org/W4384157971","https://openalex.org/W4398192563","https://openalex.org/W4404026284","https://openalex.org/W4405936378"],"related_works":[],"abstract_inverted_index":{"Cloud":[0],"computing":[1],"offers":[2],"flexibility":[3],"and":[4,42,45,84],"costeffectiveness,":[5],"but":[6],"can":[7],"also":[8,131],"be":[9],"abused":[10],"for":[11,121],"malicious":[12,27,101,107,139,155],"activities.":[13],"In":[14],"this":[15],"study,":[16],"we":[17,46,92],"conduct":[18],"an":[19],"empirical":[20],"analysis":[21,149],"of":[22,26,52,62,72,89,96,136,138,154],"the":[23,60,94,159],"cloud":[24,80,90,114,128],"infrastructure":[25,115,140],"(blocklisted)":[28],"domains,":[29],"with":[30,117],"a":[31,50,85,118,133,151],"focus":[32],"on":[33],"three":[34,144],"core":[35],"infrastructural":[36],"components":[37,66],"\u2014":[38,44],"web":[39,123],"hosting,":[40],"DNS,":[41],"email":[43],"compare":[47],"them":[48],"against":[49],"baseline":[51],"general":[53],"domains.":[54],"Our":[55,103],"goal":[56],"is":[57],"to":[58],"assess":[59],"rate":[61],"abuse":[63],"targeting":[64],"these":[65],"as":[67],"they":[68],"represent":[69],"fundamental":[70],"pillars":[71],"Internet":[73],"communication.":[74],"Leveraging":[75],"DNS":[76],"data":[77],"from":[78,82],"OpenINTEL,":[79],"classification":[81],"IP2Location,":[83],"curated":[86],"ground-truth":[87],"list":[88],"providers,":[91],"evaluate":[93],"role":[95],"major":[97],"providers":[98],"in":[99,158],"hosting":[100,124,156],"infrastructure.":[102],"results":[104],"show":[105],"that":[106],"domains":[108],"are":[109],"increasingly":[110],"shifting":[111],"toward":[112],"partial":[113],"outsourcing,":[116],"strong":[119],"preference":[120],"cloud-based":[122],"while":[125],"avoiding":[126],"full-stack":[127],"adoption.":[129],"We":[130],"observe":[132],"high":[134],"degree":[135],"diversity":[137],"deployment":[141],"across":[142],"all":[143],"components.":[145],"Finally,":[146],"our":[147],"country":[148],"highlights":[150],"growing":[152],"concentration":[153],"activity":[157],"Asia-Pacific":[160],"region.":[161]},"counts_by_year":[],"updated_date":"2026-07-29T14:22:42.915294","created_date":"2025-12-22T00:00:00"}