Cybersecurity is widely understood as a technical problem--one in which imperfect software platforms or configurations allow systems to be subverted--but this is only one layer of the overall challenge. While the technical mechanisms by which cyberattacks might be launched are critical, so too is understanding how real attackers are motivated and incentivized.

Our project has focused on placing this larger framing in a scientific context; we have introduced methodologies and techniques for empirically assessing different kinds of cyberattacks across the Internet. We have conducted large, carefully-designed case studies validating this approach to measurement (e.g., for account hijacking, ad fraud, malware distribution, ransomware, DDoS). Further, we have shown how these attacks can be placed into an economic context that motivates their particular technical approach; most online cybercriminals are profit-seeking and their underlying cost structure dictates the kinds of criminal activities that they are willing to pursue. We have not only reasoned about this abstractly but have empirically shown how to identify attacker revenues and follow the flow of criminal payments, including some of the first work demonstrating how to deanonymize Bitcoin transactions. Finally, we have shown how this level of insight allows us to design interventions that "de-monetize" attacks and thus remove incentives to mount them. We have been able to explore large-scale case-studies where these interventions have been put into effect and empirically demonstrated what kinds of actions are effective at redirecting attackers. Together, this work has validated our core idea that empirically-grounded analysis of both threats and their associated economic context can significantly improve how we address a range of security threats.

We have been able to conduct our work an unprecedented scale due to a combination of methodological techniques (e.g., Internet-wide scanning, botnet infiltration) coupled with close research partnerships with industry researchers (e.g., at Google, Microsoft, Facebook, Twitter, and Yahoo, among others). As a consequence, we have both been successful academically and also had a direct impact on how a broad array of Internet companies address online abuse. We have been able to collaborate effectively with law enforcement, enabling our work on Bitcoin payment tracing, underground stylometry, bulletproof hosting, and breach detection to reap concrete operational benefits.

In broad terms, we originated this project with the fundamental thesis that by considering security in "ecosystem" terms, including the many complex and disparate human elements of modern digital life, we could potentially obtain significantly deeper insights, and stronger and/or more cost-effective defenses, than by viewing security problems as solely technical concerns. Our undertakings have repeatedly affirmed this thesis. Our work developed sound, empirically grounded illumination of the support systems that make modern cybercrime possible; of how attackers frequently manipulate people rather than computers; of the flow of money including through nominally anonymous networks; of how individuals and organizations respond to threats, perceived problems, and victimization; and of the global scales at which these tussles and conflicts play out. We have examined security issues spanning the range from individual users and computers to enterprises to globally deployed services to distribution and financial networks to worldwide social networks to actions undertaken by intelligence services and sovereign nations. Throughout we find recurring themes of interconnections and human-scale considerations overshadowing the technical particulars of a given situation. Fundamentally, what makes security difficult is not (merely) the difficulty of writing correct code, but the much harder challenge of first understanding and then reasoning about interactions among disparate parties with disparate capabilities, motivations, resources, tolerances, and concerns. If however, we can arm ourselves with such insights, then not infrequently we find that a security issue, viewed in-the-large, presents hitherto unrecognized opportunities for improving its ultimate outcomes.

Last Modified: 10/15/2018
Modified by: Damon Mccoy