The Work-Averse Cyber Attacker Model: Theory and Evidence From Two Million Attack Signatures

Allodi, Luca; Massacci, Fabio; Williams, Julian

doi:10.1111/risa.13732

The Work-Averse Cyber Attacker Model: Theory and Evidence From Two Million Attack Signatures

Allodi, Luca; Massacci, Fabio; Williams, Julian

Authors

Luca Allodi

Fabio Massacci

Professor Julian Williams julian.williams@durham.ac.uk
Head of Department

Abstract

The assumption that a cyber attacker will potentially exploit all present vulnerabilities drives most modern cyber risk management practices and the corresponding security investments. We propose a new attacker model, based on dynamic optimization, where we demonstrate that large, initial, fixed costs of exploit development induce attackers to delay implementation and deployment of exploits of vulnerabilities. The theoretical model predicts that mass attackers will preferably i) exploit only one vulnerability per software version, ii) largely include only vulnerabilities requiring low attack complexity, and iii) be slow at trying to weaponize new vulnerabilities. These predictions are empirically validated on a large dataset of observed massed attacks launched against a large collection of information systems. Findings in this paper allow cyber risk managers to better concentrate their efforts for vulnerability management, and set a new theoretical and empirical basis for further research defining attacker (offensive) processes.

Citation

Allodi, L., Massacci, F., & Williams, J. (2022). The Work-Averse Cyber Attacker Model: Theory and Evidence From Two Million Attack Signatures. Risk Analysis, 42(8), 1623-1642. https://doi.org/10.1111/risa.13732

Journal Article Type	Article
Acceptance Date	Feb 3, 2021
Online Publication Date	May 7, 2021
Publication Date	Aug 6, 2022
Deposit Date	Feb 4, 2021
Publicly Available Date	Dec 20, 2021
Journal	Risk Analysis
Print ISSN	0272-4332
Publisher	Wiley
Peer Reviewed	Peer Reviewed
Volume	42
Issue	8
Pages	1623-1642
DOI	https://doi.org/10.1111/risa.13732
Public URL	https://durham-repository.worktribe.com/output/1252820

Files

Published Journal Article (713 Kb)
PDF

Publisher Licence URL
http://creativecommons.org/licenses/by/4.0/

Copyright Statement
© 2021 The Authors. Risk Analysis published by Wiley Periodicals LLC on behalf of Society for Risk Analysis

This is an open access article under the terms of the Creative Commons Attribution License, which permits use, distribution and reproduction in any medium, provided the original work is properly cited.