Collaborative Research: CT-M: Understanding and Exploiting Economic Incentives in Internet-based Scams

计算机安全是一个防御与对手对抗的领域。 因此，如果要计划有效的防御，了解对手的能力和动机至关重要。 然而，现代基于互联网的攻击在很大程度上是由经济因素驱动的，而这些因素只被抽象地理解。 虽然我们知道，大规模僵尸网络已经成为发动攻击的一个引人注目的平台，危害互联网主机是足够便宜的，但我们根本不了解这种活动带来的收入规模。 虽然我们知道每天有数十亿封垃圾邮件被发送，但这些垃圾邮件的转化率呢？发送的消息将导致的概率？销售？?基本上是未知的。 如果没有这些信息，就很难推断攻击者和防御者之间冲突的结构性本质。传统上，获取有关互联网攻击中关键经济因素的信息是困难的，因为这些信息只有攻击者自己才能看到。 我们的研究重点是通过渗透技术基础设施来回避这个问题？僵尸网络本身被网络罪犯利用 我们的技术，叫做？分销渗透提供了一种直接量化垃圾邮件和网络钓鱼活动的关键方面以及衡量防御对经济基础的影响的方法（即，它们对电子犯罪获利能力的影响）。 我们的研究将完善这些方法，并为开发基于经济的计算机安全威胁模型提供具体数据。

Computer security is a field in which defenses are pitted against adversaries. Thus, it is critical to understand the capabilities and motivations of the adversary if one is to plan effective defenses. However, modern Internet-based attacks are largely driven by economic factors that are only understood in the abstract. While we know that it is sufficiently cheap to compromise Internet hosts that large-scale botnets have become a compelling platform for launching attacks, we simply do not understand the scale of the revenue that that such activities bring in. While we understand that billions of spam e-mails are sent per day, the conversion rate of this spam ? the probability that a sent message will result in a ?sale? ? is largely unknown. Absent such information it is difficult to reason about the structural nature of the conflict between attackers and defenders.Traditionally, obtaining information about the critical economic factors in Internet attacks is difficult because such information is only visible to the attacker themselves. Our research is focused on sidestepping this issue by infiltrating the technical infrastructure ? the botnets themselves ? used by Internet miscreants. Our technique, called ?distribution infiltration? provides a means to directly quantify key aspects of spam and phishing campaigns as well as to measure the impact of defenses on an economic footing (i.e., their impact on the profitability of e-crime). Our research will both refine these methodologies and produce concrete data for developing economic-based threat models of computer security.