Collaborative Research: CT-M: Understanding and Exploiting Economic Incentives in Internet-based Scams

计算机安全是一个防御与对手对抗的领域。因此，如果要计划有效的防御，了解对手的能力和动机是至关重要的。然而，现代基于互联网的攻击在很大程度上是由经济因素驱动的，这些因素只被抽象地理解。虽然我们知道危害互联网主机的成本足够低，大规模僵尸网络已经成为一个引人注目的攻击平台，但我们根本不了解此类活动带来的收入规模。虽然我们了解每天发送数十亿封垃圾邮件，但这些垃圾邮件的转化率是多少？发送的消息将导致销售的概率。在很大程度上是未知的。没有这样的信息，很难推断攻击者和防御者之间冲突的结构性。传统上，很难获得有关互联网攻击中关键经济因素的信息，因为这些信息只有攻击者自己才能看到。我们的研究重点是通过渗透技术基础设施来规避这个问题？僵尸网络本身？被互联网恶棍使用。我们的技术，叫做？分布渗透？提供一种手段，直接量化垃圾邮件和网络钓鱼活动的关键方面，并衡量防御在经济基础上的影响(即，它们对电子犯罪盈利能力的影响)。我们的研究将完善这些方法，并为开发基于经济的计算机安全威胁模型提供具体数据。

Computer security is a field in which defenses are pitted against adversaries. Thus, it is critical to understand the capabilities and motivations of the adversary if one is to plan effective defenses. However, modern Internet-based attacks are largely driven by economic factors that are only understood in the abstract. While we know that it is sufficiently cheap to compromise Internet hosts that large-scale botnets have become a compelling platform for launching attacks, we simply do not understand the scale of the revenue that that such activities bring in. While we understand that billions of spam e-mails are sent per day, the conversion rate of this spam ? the probability that a sent message will result in a ?sale? ? is largely unknown. Absent such information it is difficult to reason about the structural nature of the conflict between attackers and defenders.Traditionally, obtaining information about the critical economic factors in Internet attacks is difficult because such information is only visible to the attacker themselves. Our research is focused on sidestepping this issue by infiltrating the technical infrastructure ? the botnets themselves ? used by Internet miscreants. Our technique, called ?distribution infiltration? provides a means to directly quantify key aspects of spam and phishing campaigns as well as to measure the impact of defenses on an economic footing (i.e., their impact on the profitability of e-crime). Our research will both refine these methodologies and produce concrete data for developing economic-based threat models of computer security.