Banishing Misaligned Incentives for Validating Reports in Bug-Bounty Platforms
Banishing Misaligned Incentives for Validating Reports in Bug-Bounty Platforms
复制标题
消除错误赏金平台中验证报告的不一致激励措施
DOI：
--
复制
发表时间：
2016
期刊：
影响因子：
--
通讯作者：
Jens Grossklags
中科院分区：
文献类型：
--
作者：
Aron Laszka;Mingyi Zhao;Jens Grossklags
漏洞赏金计划有可能收获成千上万的白帽黑客的努力和各种知识。因此，它们作为组织安全文化的关键部分变得越来越受欢迎。然而，漏洞赏金计划可能充斥着无数无效的漏洞报告提交，这在一定程度上是白帽子和组织之间不一致的激励机制造成的。为了进一步提高漏洞赏金计划的有效性，我们引入了一个理论模型来评估减少无效报告数量的方法。我们开发了一个经济框架，并研究了现有规范方法的优点和缺点，以有效地激励白帽子进行更高的验证工作。最后，我们介绍了一种新的方法，它可以通过使不同的白帽子在各自的最佳水平上发挥验证工作来提高效率。
Bug-bounty programs have the potential to harvest the efforts and diverse knowledge of thousands of white hat hackers. As a consequence, they are becoming increasingly popular as a key part of the security culture of organizations. However, bug-bounty programs can be riddled with myriads of invalid vulnerability-report submissions, which are partially the result of misaligned incentives between white hats and organizations. To further improve the effectiveness of bug-bounty programs, we introduce a theoretical model for evaluating approaches for reducing the number of invalid reports. We develop an economic framework and investigate the strengths and weaknesses of existing canonical approaches for effectively incentivizing higher validation efforts by white hats. Finally, we introduce a novel approach, which may improve efficiency by enabling different white hats to exert validation effort at their individually optimal levels.