Frequently Asked Questions

LightScope is a cybersecurity research project that examines unwanted traffic on the internet. It is based upon work supported by the U.S. National Science Foundation under Grant No. 2313998 and the University of Southern California Information Sciences Institute.

Specifically, LightScope is software that turns closed ports on your live production machine into honeypots or network telescopes. It then examines the traffic that scanners and attackers have sent to learn about how they interact with you.

Research topics we examine include trends in AI/ML-based unwanted traffic, identifying and attributing large-scale distributed campaings, and how scanners and attackers interact with live/production machines as opposed to honeypots or network telescopes.

In order to give back to those who deploy the LightScope software on their systems, we provide free general threat intelligence to the public, and free cutomized threat intelligence to those who deploy LightScope.

We are interested in the unwanted traffic that scanners and attackers send to your closed ports. We are not interested in legitimate traffic between you and your users. As a result, we have specifically designed LightScope not to collect any "wanted" traffic, or any information that may identify you or your users.

For example, if you are running a web server on port 80, LightScope will see that port 80 is open and not collect any data going to or from that port. Our study has passed IRB approval verifying our collection and storage methods (certified exempt), as study UP-25-00124 --- LightScope - Survey of unwanted traffic to large user populations to the University of Southern California Institutional Review Board.

Our code is open source, written in python (specifically to provide transparency), and our study was reviewed by the University of Southern California IRB and found not to generate identifiable private information.

Specific Data Collected

We collect the following fields from packets without modification, which cannot be used to identify participants in our study:

Anonymization and Privacy

System Information

Yes, LightScope is an open-source project developed under NSF grant #2313998. The source code is available on GitHub under the MIT license, allowing for both academic and commercial use with proper attribution.

GitHub Repository: https://github.com/Thelightscope/thelightscope

We encourage contributions from the community to help improve and extend the capabilities of LightScope.

LightScope observes traffic sent to closed ports on production machines, while honeypots and network telescopes operate quite differently:

Honeypots vs. LightScope:

• Honeypots are dedicated machines that usually don't run production services. They are designed to attract and trap attackers by simulating vulnerable systems.
• Attackers actively attempt to avoid honeypots, which can significantly impact what we can learn from them. Modern attackers use various techniques to identify and bypass honeypots.
• LightScope monitors real production systems, capturing authentic attacker behavior as they interact with legitimate infrastructure.

Network Telescopes vs. LightScope:

• Network telescopes typically monitor unused IP address space, capturing traffic sent to addresses that shouldn't receive any legitimate traffic.
• LightScope focuses on live, production endpoints that are actively used for legitimate purposes, providing insights into how attackers interact with real systems.

Key Advantages of LightScope:

• Authentic Attack Patterns: By monitoring production systems, LightScope captures genuine attacker behavior without the artificial environment that honeypots create.
• Real-world Context: Understanding how attackers target and interact with actual production infrastructure provides more actionable threat intelligence.
• Evasion-resistant: Since LightScope monitors legitimate systems, attackers cannot easily identify and avoid them like they can with honeypots.
• Comprehensive Coverage: Captures the full spectrum of scanning and attack activity against real infrastructure, not just traffic to unused space.
• Operational Relevance: The data collected directly reflects threats to actual production environments, making it more relevant for defensive planning.

Why This Matters: Getting attacker and scanner data from live production endpoints is crucial because it provides the most accurate picture of actual threats. This real-world data helps organizations better understand their threat landscape and develop more effective security strategies based on how attackers actually behave when targeting legitimate infrastructure.

Your personalized LightScope dashboard URL is displayed during installation and is always available through systemctl status.

Easiest Method - SystemCtl Status:

Run this command on your LightScope server to see your dashboard URL:

Look for your dashboard URL in the "Docs:" section:

🎯 Simply copy the second Docs URL (the one containing /tables/) and paste it into your browser!

Alternative Methods: