ak amais [ st at e o f t h e in t e r n et]

Q 3 2 0 1 5 e x e c u t ive re vie w

[ st at e of t h e i n t e r n e t ] / Q 3 2015 executive review

about the review / Akamai, the worlds leading

content delivery network (CDN) provider, uses its

globally distributed Intelligent PlatformTM to process
approximately 2 trillion Internet transactions each day.
This allows us to gather massive amounts of data on
many metrics related to broadband connectivity, cloud
security and media delivery. The State of the Internet
program was built to leverage that data to better enable
businesses and governments to make intelligent,
strategic decisions. Each quarter, Akamai uses this data
to publish reports in the State of the Internet program
focused on broadband connectivity and cloud security.

2
Download the full reports at www.stateoftheinter net.com

[ st at e of t h e i n t e r n e t ] / Q 3 2015 executive review

GLOBA L BR O A D BA N D L E ADE R S

5.1 Mbps /
Global Average
Connection Speed
32.2 Mbps /
Global Average
Peak Connection Speed

internet and broadband adoption / The State of the Internet / Connectivity

Report is now in its 8th year of publication. In it, Akamai reports extensively on
Internet connection speeds, network connectivity/availability issues, and IPv6
adoption progress.
Global Top 10 / Average Connection Speeds

Country/Region

Global Top 10 / Average Peak Connection Speeds

Q3 2015
Avg. Mbps

Country/Region

Q3 2015
Peak Mbps

Global

5.1

Global

32.2

South Korea

20.5

Singapore

135.4

Sweden

17.4

Hong Kong

101.1

Norway

16.4

South Korea

86.6

Switzerland

16.2

Japan

78.4

Hong Kong

15.8

Taiwan

77.9

Netherlands

15.6

Qatar

75.2

Japan

15.0

Macao

73.7

Finland

14.8

Romania

72.9

Latvia

14.5

Israel

70.0

10

Czech Republic

14.5

10

Sweden

69.0

3
Download the full reports at www.stateoftheinter net.com

[ st at e of t h e i n t e r n e t ] / Q 3 2015 executive review

Broadband Adoption / This section illustrates the global leaders with the highest

percentage of unique ip addresses connecting to Akamai with average connection

speeds above four separate thresholds.
4+ Mbps

10+ Mbps

96%

15+ Mbps

68%

Bulgar i a /
So ut h Ko rea

45%

S ou th K orea

DOWNLOAD THE
FULL REPORT

25+ Mbps

24%

South Korea

South Korea

IPv4 Exhaustion and IPv6 Adoption /

35%

OF TRAFFIC
OVER IPv6

Country with the highest percentage of

TAP
HERE

content requests made to Akamai over IPV6:

Belg ium

Available IPv4 Space Continues Steady Decline:

Available IPv4 Address Pool Size by RIR, Q3 2015

AFRINIC

APNIC

ARIN

LACNIC

RIPENCC

IPv4 Addresses (Millions)

50
45
40
35
30
25
20
15
10
5
0
1-Jul

8-Jul

15-Jul

22-Jul

29-Jul

5-Aug

12-Aug

19-Aug

26-Aug

9-Sep

16-Sep

4
Download the full reports at www.stateoftheinter net.com

23-Sep

30-Sep

[ st at e of t h e i n t e r n e t ] / Q 3 2015 executive review

Total Number of IPv4 Address Pool Size by RIR, Q3 2015

IPv4 Addresses (Millions)

AFRINIC
12
11
10
9
8
7
6
5
4
3
2
1
0
1-Jul

8-Jul

15-Jul

22-Jul

APNIC

29-Jul

5-Aug

ARIN

12-Aug

19-Aug

LACNIC

26-Aug

9-Sep

RIPENCC

16-Sep

5
Download the full reports at www.stateoftheinter net.com

23-Sep

30-Sep

[ st at e of t h e i n t e r n e t ] / Q 3 2015 executive review

CLOUD SECURITY
YEAR-O V E R-YE AR S TAT S [ Q3 2014 Q3 2015]
180% increase in total DDoS attacks
66% decrease in average peak bandwidth

LARGEST ATTACK

89% decrease in average peak packets per second

26% increase in application layer attacks
198% increase in infrastructure layer attacks
16% decrease in average attack duration
SSDP attacks: 0 vs. 16% of all attacks

Q3 2015

149 Gbps
Q2 2015

249 Gbps

Cloud Security / The q2 2015 State of the Internet / Security Report combines the

DDoS attack data previously published in the classic State of the Internet Report
with the data previously published in the quarterly Prolexic DDoS Attack Report.
DDoS Update / Attack activity over our network jumped again this quarter,

setting a record for the number of DDoS attacks. At the same time, average peak
bandwidth and packets-per-second have been dropping, a trend continued from
q2. The use of reflection-based DDoS methods by DDoS-for-hire sites resulted in
smaller attacks on average than we have observed from infection-based botnets.
Akamai tracked nine infrastructure-layer reflection attack vectors, including the
three newer reflection attacks: NetBIOS, Sentinel, and rpc. There were eight mega
attacks greater than 100 gigabits per second (Gbps), with the largest at 149 Gbps.
Half of all attacks were between 400 Mbps to 5 Gbps. The online gaming sector
was hit particularly hard in q3, accounting for half of all DDoS attacks. Media and
entertainment faced more of the biggest DDoS attacks.

6
Download the full reports at www.stateoftheinter net.com

[ st at e of t h e i n t e r n e t ] / Q 3 2015 executive review

DDoS Size as a Function of Time

Gbps

10.000

0.100

0.001

Q3
2013

Q4
2013

Q1
2014

Q2
2014

Q3
2014

Q4
2014

Q1
2015

Q2
2015

Q3
2015

DDoS attacks from Q3 2013 to Q3 2015. Each dot represents a DDoS attack, and each
interval covers a 10-fold increase in attack size

q3 marks the first time Akamai Edge Firewall data is analyzed in the report. Edge
Firewall data sets provide a broad look at attack activity at the global platform
perimeterwith information on attack traffic coming from 200,000 machines
outfitted with Akamai. The data was used to identify more than 1.5 million DDoS
reflectors on a geographical heatmap.

DDoS Reflector Heatmap, Q3 2015

A geographical heat map of victim SSDP, CHARGEN, NTP and QOTD reflectors in
Q3 2015
7
Download the full reports at www.stateoftheinter net.com

[ st at e of t h e i n t e r n e t ] / Q 3 2015 executive review

attack spotlight / When it comes to DDoS attacks, high bandwidth is usually

the most notable metric, but a high packet-per-second rate can also be devastating.
In q3, Akamai mitigated an attack that would require at least 145 Gbps of available
bandwidth just to withstand its brunt. Further, the attack generated a record-setting
222 million packets-per-second (Mpps).
Top 5 source countries for DDoS attacks in Q3 / Non-spoofed attacking IP
addresses by source country for DDoS attacks mitigated during Q3 2015
UK / 26%

China / 21%

USA / 17%

India / 7%

Spain / 7%

web application attack statistics / Last quarter Shellshock over https

dominated web application attacks observed by Akamai, but this was not the case
in q3. Local file inclusion (lfi) and sql injection (SQLi) attacks over http were
by far the most prevalent web application attack vectors in q3. There was a notable
increase in WordPress plugin attack attempts, not only for popular plugins but also
for less-known vulnerable plugins.
Web application attacks rely heavily on botnets that take advantage of unsecured
home-based routers and devices.
The retail industry was hit hardest, receiving 55% of web application attacks, with
the financial services industry a distant second, receiving 15% of attacks. The u.s.
was the main source of web application attacks (59%), and sites within the u.s. in
were the most common target (75%).

8
Download the full reports at www.stateoftheinter net.com

[ st at e of t h e i n t e r n e t ] / Q 3 2015 executive review

Web Application Attacks by Industry, Q3 2015

60

14 14.70

54.52

50

Percentage

12
40

10
8
6

30
7.99

7.24

7.16

20

4
2
0

2.62
Financial
Media &
Public
Services Entertainment Sector

10

2.69
1.59

1.49

Hotel &
High
Consumer Gaming
Travel Technology Goods

Other

Retail suffered the vast majority of web application attacks in Q3 201555%

9
Download the full reports at www.stateoftheinter net.com

Retail

Retail Percentage

16

[s tate of t h e i n t e r n e t ]

[ st at e o f t h e in t e r n e t ] / se curity

Editor
David Belson

Content
David Fernandez, Editor in Chief
Bill Brenner, Managing Editor
Jose Arteaga, Data Visualization and Research
Ezra Caltum, Web Application Threat Research
Martin McKeay, Senior Editor

Design
Shawn Doughty, Creative Direction
Brendan OHara, Art Direction/Design

Contributors
Dave Lewis, Editor
Jon Thompson, Threat Data Modeling
Patrick Laverty, Research
Larry Cashdollar, Research
Chad Seaman, Research

Contact
stateoftheinternet@akamai.com
Twitter: @akamai_soti / @akamai
www.stateoftheinternet.com

Design
Shawn Doughty, Creative Direction
Brendan OHara, Art Direction/Design
Contact
stateoftheinternet@akamai.com
Twitter: @State_Internet / @akamai
www.stateoftheinternet.com

Download the Full Reports

[state of the internet] report

[state of the internet] / security report

Q3 2015

Q3 2015

As the global leader in Content Delivery Network (cdn) services, Akamai makes the Internet fast, reliable and secure for its customers. The companys advanced web
performance, mobile performance, cloud security and media delivery solutions are revolutionizing how businesses optimize consumer, enterprise and entertainment
experiences for any device, anywhere. To learn how Akamai solutions and its team of Internet experts are helping businesses move faster forward, please visit www.akamai.com
or blogs.akamai.com, and follow @Akamai on Twitter.

Akamai is headquartered in Cambridge, Massachusetts in the United States with operations in more than 57 offices around the world. Our services and renowned customer
care are designed to enable businesses to provide an unparalleled Internet experience for their customers worldwide. Addresses, phone numbers and contact information for all
locations are listed on www.akamai.com/locations.
2015 Akamai Technologies, Inc. All Rights Reserved. Reproduction in whole or in part in any form or medium without express written permission is prohibited. Akamai and
the Akamai wave logo are registered trademarks. Other trademarks contained herein are the property of their respective owners. Akamai believes that the information in this
publication is accurate as of its publication date; such information is subject to change without notice. Published 12/15.