CAREER: Developing Robust Longitudinal Indicators and Early Warnings of Cybercrime

网络犯罪的激增为研究人员创造了一个机会，可以使用数据驱动的、最终是科学的方法来研究网络安全。该项目力求改进网络犯罪数据的收集和分析过程，以减少其危害。基于努力的指标衡量了防御者行动的影响，如清理受损资源所需的时间，正在构建中，用于分析收集的多个类别的网络犯罪的数据。在整个项目期间都在收集指标，以便进行纵向分析，例如，衡量传播所带来的任何改进。还在调查设计和部署一个原型预警系统是否可行，该系统能够足够快地主动向捍卫者发出警报，以阻止网络犯罪活动的集中激增。该项目的教育目标是通过提供网络犯罪活动的公共数据集，与其他研究人员共享并纳入课程模块，从而促进网络安全科学的发展。教学举措包括改进现有课程和出版可供其他人采用的独立资源。该项目正在增进对如何构建可靠的网络犯罪指标的理解。基于努力的指标有助于缓解信息不对称，因此任何人都可以看到哪些捍卫者正在更加努力地清理受损的资源。这反过来又可以通过解决个别辩护人推卸责任的协调问题，从整体上改善对网络犯罪的反应。该项目还通过收集几年的数据，促进了对网络犯罪的反应如何随着时间的推移而变化的理解。如果被广泛分享，这些指标可以帮助激励捍卫者从长远来看打击网络犯罪。该项目不仅要确定如何构建指标，而且要确定分享这些指标的最有效方式。预警系统如果成功，可以帮助防御者抢在攻击者使用的转移战术之前，极大地提高对策的效率。在该项目支持的教育项目中，正在将数据集添加到教授网络安全科学方法的课程模块中。不仅正在为研究生和本科学位课程设计模块，而且还为初中生和高中生设计模块，由PI联合开发的免费在线课程，以及正在开发的安全经济学教科书。

The proliferation of cybercrime has created an opportunity for researchers to study cybersecurity using a data-driven, and ultimately scientific, approach. This project seeks to improve the process of cybercrime data collection and analysis for the purpose of reducing its harm. Effort-based indicators, which measure the impact of defender actions such as the time taken to clean a compromised resource, are being constructed for use in analyzing data gathered on multiple categories of cybercrime. Indicators are being collected throughout the duration of the project in order to enable longitudinal analysis, for example, to measure any improvements that result from dissemination. It is also being investigated whether it is feasible to devise and deploy a prototype early-warning system that proactively alerts defenders quickly enough to arrest concentrated spikes in cybercriminal activity. The project's educational objective is to advance the science of cybersecurity by contributing public datasets of cybercriminal activity to be shared with other researchers and incorporated into curriculum modules. Instructional initiatives include improving existing curricula and publishing stand-alone resources that can be adopted by others.The project is advancing understanding of how to construct reliable cybercrime indicators. Effort-based indicators help mitigate information asymmetries, so that anyone can see which defenders are working harder to clean up compromised resources. This could in turn improve the response to cybercrime overall by solving coordination problems in which individual defenders shirk responsibility. The project is also advancing understanding of how the response to cybercrime changes over time by collecting data for several years. If widely shared, the indicators can help incentivize defenders to fight cybercrime over the long term. The project seeks to identify not only how to construct the indicators, but also what is the most effective way to share them. The early-warning system, if successful, could greatly enhance the efficiency of countermeasures by helping defenders get ahead of the shifting tactics used by attackers. In the education program supported by the project, datasets are being added to curriculum modules that teach scientific approaches to cybersecurity. Modules are being designed for not only graduate and undergraduate degree programs, but also for middle and high school students, free online courses co-developed by the PI, and a security economics textbook under development.