We use cookies to ensure that we give you the best experience on our website. By continuing to browse this repository, you give consent for essential cookies to be used. You can read more about our Privacy and Cookie Policy.

Durham Research Online
You are in:

The Work-Averse Cyber Attacker Model: Theory and Evidence From Two Million Attack Signatures

Allodi, Luca and Massacci, Fabio and Williams, Julian 'The Work-Averse Cyber Attacker Model: Theory and Evidence From Two Million Attack Signatures.', Working Paper. UNSPECIFIED.


A common presumption is that the typical cyber attacker is assumed to exploit all possible vulnerabilities with almost equal likelihood. That is, the probability of an attack on a given vulnerability is at maximum entropy, one cannot importance sample which vulnerability will be exploited rst, hence decision making is purely a function of criticality. In this paper we present, and empirically validate, a novel and more realistic attacker model. The intuition of our model is that a mass attacker will optimally choose whether to act and weaponize a new vulnerability, or keep using existing toolkits if there are enough vulnerable users. The model predicts that mass attackers may i) exploit only one vulnerability per software version, ii) include only vulnerabilities with low attack complexity, and iii) be slow at introducing new vulnerabilities into their arsenal. We empirically test these predictions by analysing data collected on attacks against more than one million real systems by Symantec's WINE platform. Our analysis shows that mass attackers' xed costs are indeed signicant. Signicant eciency gains can be made by individuals and organizations by accounting for this effect.

Item Type:Monograph (Working Paper)
Full text:(AO) Author's Original
Download PDF
Publisher Web site:
Date accepted:No date available
Date deposited:No date available
Date of first online publication:No date available
Date first made open access:No date available

Save or Share this output

Look up in GoogleScholar