Botnet Economics: Uncertainty Matters

Transcription

1 Bone Economics: Uncerainy Maers Zhen Li Deparmen of Economics and Managemen Albion College Qi Liao, Aaron Sriegel Deparmen of Compuer Science and Engineering Universiy of Nore Dame {qliao, Absrac Bones have become an increasing securiy concern in oday s Inerne. Thus far he miigaion o bone aacks is a never ending arms race focusing on echnical approaches. In his paper, we model bone-relaed cybercrimes as a resul of profi-maximizing decision-making from he perspecives of boh bone masers and reners/aackers. From his economic model, we can undersand he effecive renal size and he opimal bone size ha can maximize he profis of bone masers and aackers. We propose he idea of using virual bos (honeypos running on virual machines) o creae uncerainy in he level of bone aacks. The uncerainy inroduced by virual bos has a deep impac on he profi gains on he bone marke. Wih decreasing profiabiliy, bone relaed aacks such as DDoS are reduced if no eliminaed from he roo cause, i.e. economic incenives. I. INTRODUCTION A ho opic nowadays in he Inerne securiy communiy is bones - referring o collecions of compromised compuers, or bos conrolled by bone masers. I is widely acceped ha bones impose one of he mos serious hreas o he Inerne since hey are predominanly used for illegal aciviies. For example, Rajab e al. find ha a major conribuor of unwaned Inerne raffic - 27% of all malicious connecion aemps - can be direcly aribued o bone-relaed spreading aciviy [1]. The aackers or hackers on he Inerne were generally hough o be less financially driven in he pas, i.e. moivaed by self-fulfilmen, fun, and proof of skills. Recenly however, cybercriminals have been moving oward business models ha involve building, exploiing and mainaining bones. These cybercriminals collec, use, ren and rade bones o make economic gains. Bones can be exploied for various purposes, he mos dominan uses including disribued denial-of-service aacks (DDoS), SMTP mail relays for spam (Spambo), ad click fraud, he hef of applicaion serial numbers, login IDs, and financial informaion such as credi card numbers and bank accouns, ec. Almos all hese asks can be used o make money or have he poenial o make money. Researchers and Inerne Service Providers (ISPs) have largely explored sophisicaed echnical only soluions wih limied success. Recen rends noe ha he problems hemselves are only growing, no abaing. Exising echnical approaches aim a eiher o preven infeced machines from reaching he arge, or o redirec he visi of infeced compuers o a differen sie [2], [3]. Such defenses end o be passive and inefficien mainly because curren Inerne archiecure makes i exremely hard if no possible o differeniae a preend-o-be-legiimae reques from a rue legiimae visi. Especially as bones evolve quickly o become a significan par of he Inerne, hey are also increasingly hidden. New direcions of hinking and effecive alernaives are imminenly required o deal wih he problems a he roo cause. Today s bone masers and aackers are seeking money, driven by profis, and moivaed more by a desire o gain financially han o creae havoc. Taking away he financial incenives ha lead hem o join malicious Inerne aciviies in he firs place is hence a promising new line of hinking in fighing he bale agains bone aacks. This sudy explores he worh and benefis by learning from economics and applys economic heories in he analysis of bone-based aacks and aciviies. Raional people hink a he margin, one of he essenial economic principles, suggess ha when making economic decisions, people compare coss and benefis, and will only do hings if he benefi of doing i exceeds he coss. The cos-benefi analysis would guaranee he maximum profi o an

2 economic agen. Applying he principle o for-pay aacks or oher illegal aciviies, boh bone masers and aackers (who ren bos from previous) are by naure economic agens who paricipae in he bone marke seeking for economic reurns. Similar o oher raional behaviors like consumers or firms, bone masers/aackers make economic decisions in order o reach he highes level of saisfacion, i.e., profi-driven bone masers and aackers make heir decisions regarding he opimal size of bones, he effecive size of bo renal, ec. o reap he maximum level of profi. Based upon he above, he conribuion of his sudy is he sysemaic modeling of he bone operaion and uilizaion as a resul of profi-maximizing decision-making from he perspecives of boh bone masers and aackers. The economic model developed in his sudy can help undersanding he ineracion beween bone masers, aackers, and defenders, he effecive renal size and he opimal bone size, cos and benefi, and many oher aspecs. Anoher key conribuion of his paper is o propose an ineresing economic soluion o he bone problem. By inroducing virual bos (honeypos running on virual machines ha are o be compromised by he bone masers), we creae uncerainies and inerference in he bone marke. As shown in his paper, hese uncerainies have a remendous impac on he effecive bone size and herefore he profiabiliy of bone operaors and aackers. Bone masers and aackers, being profi-driven raional economic behaviors, make decisions o seek he maximized profi, whose level depends on facors such as coss of operaing bones, payoff received for successfully disabling vicim web sies, marke renal price of bones, ec. Given raional profi-driven bone masers and aackers, boh he size of renal and he size of bones deermined on a honeypo-free Inerne black marke are economically efficien. A any poin in ime, he capaciy of he server limis he number of compromised machines suppored, furher limiing he number of bos ren and used o aack vicims [4]. Therefore, having virual bos in bones reduces he probabiliy of launching a successful aack and hus reduces he profiabiliy of bone marke. The profi margin of he marke is reduced no only hrough lowering revenue levels of marke paricipans, bu also hrough increasing coss of operaing bones. Wih falling profi margins, bones and he associaed aacks will evenually decrease if no ourigh disappear. The remainder of he paper is organized as follows. Secion II discusses echnical background on bone syle DDoS aacks and defense mechanism, our hrea model and he relaed work. Secion III develops he assumpions, he variables, and profi levels of bone masers and aackers in he benchmark model where virual bos are no around. The profi maximizaion problem is formalized for boh bone masers and aackers. The fac of modeling he bone masers and he aackers decision-making as a profi maximizaion problem allows us o find he opimal sizes of bones, honeypos, and renals used for aacks. Secion IV exends he benchmark model o accommodae he exisence of honeypos. We firs assume he probabiliy for a renal machine o be virual is fixed, and hen relax he assumpion o analyze a more informaive case in which he probabiliy of fake bos is unknown o bone masers and aackers. I also describes how his mehod can be used o undersand and undermine bone aacks from he roo cause, i.e. economic incenives. The impacs on bone masers, aackers, and defenders inroduced by his uncerainy are analyzed in deail. Secion V discusses echnical deploymen feasibiliy and a few challenges. We walk hrough examples wih concree numeric values coupled wih graphical illusraion. Finally, we conclude and propose fuure work in Secion VI. II. BACKGROUND AND RELATED WORK In a bone-syle disribued denial of service (DDoS) aack, he aacker chooses a subse of bones o eiher flood or consume end servers resources. Since hose requess are no spoofed, hey appear all legiimae, bu much more inensely han normal use and causes he sysem o become busy, rendering he sie unavailable o oher legiimae users. Regardless of he ype of DDoS aack, bandwidh depleion or resource depleion schemes, he goal of a DDoS aack is o impair he arge s

3 Web Vicim Server Vicim Server bos bos Server C & C Server P2P Bone / Aacker Maser Fig. 1. A scenario of bone aacks launched by robo compuers (bos) conrolled by he bone maser and aacker. funcioning, effecively shuing down he vicim by forcing i o spend resources handling he aacker s raffic. An example of he bone DDoS aack is illusraed in Figure 1. Defending agains bone DDoS aacks is an exremely challenging problem. Tradiionally, defenses agains hose aacks have focused only on echnical soluions. Approaches include rae limiing/filering he offense hoss [2], [3], racing back [5] [7], or hos-based anomaly filering [8] [10]. These mehods require eiher accuraely idenifying he source as bad or good, consan updaing signaures, or suppor from nework archiecure. This resuls in a never ending arms race beween aackers and defenders, which is an undesirable posiion for a conen provider. We noe ha as researchers become more aware of he economic naure of Inerne securiy problems, recen research has been seeking help from economic principles. To sem he flow of solen credi cards and ideniy hefs, Franklin and Perrig [11] propose wo echnical approaches o reduce he number of successful marke ransacions, aiming a undercuing he cybercriminals verificaion or repuaion sysem. The approach by Xu and Lee [8] uses game heory o model he aackers and defenders. Alhough heir approach is by naure a echnical DDoS defense, i is ineresing o noice ha hey use a game-heoreical framework o analyze he performance of heir proposed defense sysem and o guide he design and performance urning of he sysem. The closes sudy o ours is he sudy by Ford and Gordon [12], which arges a maliciouscode generaed revenue sreams. We boh aim a designing bone-disabling mechanisms from an economic perspecive ha are in he direc conrol of defenders. Neverheless, here are noiceable differences beween he wo sudies. In conrary o he focus on online adverising fraud, our model covers more general bone aacks wih a hrea model focusing more on bone DDoS aacks. Our conribuion is ha we model bone masers and aackers decision-making as solving a profi maximizaion problem. Noably, we also incorporae he diurnal paern and live populaion when modeling he bone behavior. Depending on he opimal sraegies bone masers and aackers adop, we illusrae in deails how honeypos can be deployed o change economic moivaions of illegal Inerne praciioners. In his sense, we are in line wih hese researchers by claiming ha bonerelaed crimes will dramaically decrease if bone masers give up on i - ha is, when mainaining bones becomes more roublesome han worhwhile. We also propose a fresh new mehod of using virual bos o inroduce he uncerainies o he opimizing problem hrough analysis of hose virual bos impac on he bone marke. Alhough he idea of honeypos is no new [13], honeypos have primarily been used for daa collecing o undersand he bone or mapping he infeced machines o rack he conrol channel raher han

4 undermining bones by removing he financial incenives of running and employing he bone. By exending he funcioning of honeypos in he direcion of inerfering wih he money-driven Inerne malicious aciviies, he value of honeypos is fundamenally improved, especially when aking ino accoun he poenial effeciveness of our proposed mehod. III. THE BENCHMARK MODEL In his secion, we consider a benchmark model in which virual machines are no presen o inerfere wih he bone. We presen he assumpions of he model, he variables and consan parameers, and he profi levels of boh bone masers and aackers as a resul of heir profi maximizaion decisionmaking. A. Profi-driven Cybercriminals Inerne-based crimes have been shifing from repuaion economy o cash economy. Today, large fracion of Inerne-based crimes is profi driven and can be modeled roughly as raional behavior. The Inerne underground marke creaes a large forune. The exponenial growh of bone wih millions of infeced compuers bough and raded on an underground marke has evolved ino billion-dollar shadow indusry [14]. Being such a lucraive business, Inerne illegal aciviies have been popular and hard o kill. Any effecive approach aiming a eliminaing such aciviies mus remove he financial incenives ou of hem. Economic heories would help. Bone economics is by naure similar o oher economics whereby raional individuals driven by profis make economic decisions o maximize heir well-being. Applying he cos-benefi principle from economics o Inerne crimes, a bone maser will keep bones if he benefi of doing so is larger han he coss. Similarly, aackers will be beer off if hey commi an acion whose benefis are larger han coss. Evidence has been found ha compromised machines are acually ren on underground markes [11]. I is realisic o model Inerne marke as he rading place where bos are ren o aackers for launching DDoS aacks. We choose o model bone-based DDoS aacks firs because of is sraighforwardness. Moreover, (bone-relaed) DDoS is sill he primary concern for nework securiy operaions [15]. In he res of he secion, we build a heoreical model o illusrae how he wo paries - bone masers and aackers - make economic decisions in order o reap maximum profi. B. Assumpions The key assumpion is he raionaliy of bone masers and aackers. For any marke, here mus be a long-run equilibrium in which all marke forces have been balanced. Suppose he Inerne black marke is in long-run equilibrium, We noe he following assumpive parameers. 1) n e is he minimum number of machines required o achieve a ask (e.g. disable a websie 1 ). We assume ha echnical capabiliy deermines he size of n e, which boh bone masers and aackers ake as given. We refer o n e as he effecive number of renals (and as we will see laer, since i coss money o ren bones, in he seady sae, aackers profi-maximizing size of renal is equal o n e ). 2) An aacker is only paid if he aack successfully disables he arge sie. The paymen received by he aacker is denoed as M. 3) The renal price per bo (denoed as P ) is deermined on Inerne black markes, which boh bone masers and aackers ake as given. 1 Alernaively, we can view n e as he minimum number of accesses required o disable a websie, and furher define he number of accesses per machine o figure ou he size of renal. We do no see i necessary o go ino such deails and believe our conclusions are no affeced.

5 4) Bone masers who manage bos use Command and Conrol (C&C) channel 2 o communicae wih zombie compuers in bones. A ypical C&C channel can hos q machines simulaneously, which is also he live populaion on he C&C channel a any poin in ime. 3 The uni cos of mainaining a C&C channel is given a m. 5) A real bo machine operaes on average hours per day, and d days per week due o owner s diurnal paerns and physical consrains. Of all he live populaion, bone masers randomly selec bos o lease ou. In summary, he exogenous/given variables are he effecive size of renals (n e ), he number of machines a C&C channel can suppor a a poin in ime (q), he average cos of mainaining a C&C channel (m), he uni renal price of compromised machines (P ), he paymen for a successful aack (M), and how ofen a real machine operaes ( and d). C. Model Wihou Virual Machines In he benchmark model, we se up he profi maximizaion problems for a represenaive bone maser and a represenaive aacker where virual machines are no presen o inerfere wih he bone. Profi is he difference beween revenue and coss, boh can be moneary and psychological. Since i is hard o measure or quanify psychological benefis and coss, we jus focus on he moneary aspec of he analysis. The profi maximizaion problems for a represenaive bone maser and a represenaive aacker are as follows. For he aacker: max(p rofi) = M P n n s.. n n e (1) where he subjec condiion requires ha he aacker mus ren a leas he effecive number of machines o launch a successful aack. For he bone maser: max(p rofi) = P n m k a(n) k,n s.. k n q N n where N is he size of a ypical bone, which is simply he number of machines in a bone. N is called he fooprin of he bone. a(n) is he penaly funcion for he bone maser, measuring he economic losses suffered from being deeced and arresed. Since he chance of being idenified and arresed is higher as he size of he bone increases, he penaly funcion is increasing in he size of he bone (a (N) > 0). The second resricion for he bone maser implies ha he acive members in he bone (N ) mus be no smaller han he live populaion (n) because he bone maser can only ren ou acive machines. The firs resricion for he bone maser suggess ha he oal number of C&C channels mus be enough o suppor he n machines being leased. The conrol variable for he aacker is he size of renal (n). The conrol variables for he bone maser are he number of C&C channels (k) and he size of he bone (N) o mainain. Given he consideraion of boh he aacker and he bone maser, he order of he decision making and he firs-bes model soluions are as he following. 2 Alhough we are considering Inerne Relay Cha (IRC), which is dominan C&C channel in oday s bone, he parameer for bone mainenance coss can be defined accordingly based on he underlying echnique adoped o conrol bos, wheher hrough IRC or oher decenralized sysems such as P2P. 3 Similar o he deerminaion of n e, how many bos, q, a C&C channel can hos is deermined by echnological progresses and limied by he capaciy of he channel. Given echnology, q is fixed. (2)

6 1) The aacker rens n machines o launch a successful aack; Afer he vicim is aken down, he aacker receives M paymen. Since i coss money o ren machines, a given M, he aacker s profi is maximized a n = n e. In oher words, in he seady sae, he equilibrium number of renal is equal o he effecive size of renal. 2) Afer observing he number of machines he aacker is willing o ren, he bone maser chooses he size of he bone o mainain ha will saisfy he renal needs of he aacker. Wihou uncerainy, since a ypical machine runs hours a day and d days a week, he seady-sae size of he bone is N = ne. Meanwhile, he bone maser needs o mainain enough C&C d 24 7 channels o hos he n e renal machines. Given he oal revenue P n e, maximizing profi is equivalen o minimizing coss, which is furher equivalen o mainaining he minimum number of C&C channels k = ne q. From above, when he bone maser and he aacker do no have o worry abou virual machines, efficien marke resuls are achieved by realizing effecive levels of renals, number of C&C channels, and size of bones. Wihou uncerainy, he bone maser s and he aacker s benchmark profis are deerminisic. Le π b sand for he profi earned by he bone maser and π a be he profi for he aacker, heir profi levels can be represened as follows, respecively. π b = P n e m ne q a( n e ) (3) π a = M P n e (4) Examining he expressions of seady-sae profis for he bone maser and he aacker, i can be seen ha for he exisence of he business, boh profis mus be non-negaive. Combining he bone maser (seller of he bone) and he aacker (buyer of he bone), he marke is profiable as long as boh sides of he marke are profiable, M P n e (m ne q + a( Adding (3) and (4), he size of he gains on he marke is π a + π b = M m ne q a( n e 24 d n e )) (5) ) (6) On curren Inerne black markes, he chance for a bone maser o be arresed is small. The widespread (and increasing) illegal bone pracices sugges ha he profiabiliy of he business may be quie significan, and hence paricipaing in he marke is aracive and rewarding. One hing we do no ake ino accoun is he idle ime of bones - he ime periods when bones are no leased. The aacks do no happen all he ime. The bone maser canno ren he bones as ofen as he/she would like. When he bone is a idle, i receives no revenue and occurs only coss. The calculaion of profis in he benchmark model is per successful aack. We can accommodae he concern of idle ime sraighforwardly by specifying he profi as he profi reaped in a period of ime. The seup and soluions of he model are unchanged. IV. OPTIMIZATION MODEL WITH VIRTUAL MACHINES In he benchmark model, bone masers and aackers earn profis and hus will remain in he marke. To push hem away from he marke, we ough o reduce heir profi level and make he business less aracive. Economic heory suggess ha uncerainy is cosly. When marke siuaion becomes less clear for some reason, marke paricipans would be relucan o do he business and ask for higher compensaion for he increased risks resuling from ambiguiy. The idea provides a new approach o inerfering wih Inerne underground marke - o make i less efficien and less deerminisic. We propose ha creaing honeypos for bone masers o compromise will do he job.

7 In his secion, we exend he benchmark model o allow he exisence of honeypos in bone. We firs assume ha he probabiliy for a renal machine o be virual is fixed, and laer relax he assumpion o analyze a more realisic and informaive case in which marke paricipans have no idea abou he number of honeypos having been creaed. A. Fixed Probabiliy For A Renal Bo Being Virual The inroducion of virual machines creaes uncerainy o he bone in large. Virual bos will no aack he vicim as ordered. If sill n = n e machines were ren, a number of inacive machines would make he aack unsuccessful. The acual size of renal (n) can no longer be equal o he effecive size of renal (n e ). Wih some of n being virual machines, rening n e is no enough, implying ha he new equilibrium size of renal mus be larger han n e. We model he profi maximizaion problems for he bone maser and he aacker o show wha happens wih he inroducion of virual machines. For he ime being, we assume ha he probabiliy for a renal machine o be virual is fixed. Le p v denoe he probabiliy for a renal machine o be virual, and p v is fixed. The profi maximizaion problem for a ypical aacker now looks as follows. max(p rofi) = M P n n s.. n (1 p v ) n e (7) For he bone maser, he profi maximizaion problem is he same as in he benchmark model since his/her decision-making is based upon he size of renal chosen by he aacker. Solving he problems resuls in wo conclusions: 1) To launch a successful aack, he aacker now has o ren n = ne 1 p v machines, larger han in he benchmark model. 2) To accommodae he n = ne n 1 p v machines leased, he bone maser has o mainain k = e (1 p v ) q C&C channels. In he meanime, he new equilibrium size of bone increases o n e N = (1 p v ) 24 d (8) 7 If everyhing else remains unchanged, he profi for boh he bone maser and he aacker are differen from he benchmark model. For he bone maser, he profi may eiher go up or go down. On one hand, he bone maser s revenue increases due o more machines ren; on he oher hand, he bone maser has o acquire more C&C channels o suppor he increased renal, and he also suffers a higher chance of being arresed. The bone maser s profi margin is now: πb v1 = P ne n e m 1 p v (1 p v ) q a( n e (1 p v ) 24 d ) (9) 7 where πb v1 represens he profi margin for he bone maser when he probabiliy for a renal machine o be virual is fixed a p v. The aacker s profi mus decline. Wih he same paymen for successfully aking down he vicim, he aacker incurs larger coss of rening machines. The new profi level for he aacker is herefore π v1 a = M P ne 1 p v (10) where πa v1 sands for he profi margin for he aacker when he probabiliy for a renal machine o be virual is fixed a p v. Adding (9) and (10), he size of he oal gains on he marke shrinks o π v1 a + πb v1 n e = M m (1 p v ) q a( n e (1 p v ) 24 d ) (11) 7

8 Fig. 2. In he underground marke for bones where bone masers are price-sensiive, a supply and demand model suggess he decreased price and bo renal afer inroducing virual machines. Fig. 3. In he bone underground marke where bone masers are price-akers, a decreased bo renal is suggesed a he presence of virual bos. Obviously, he exisence of virual machines lowers he incenives for aackers o ren machines. For he bone maser, he profi level depends on he renal price of machines P. The profi level decreases as he renal price P falls. If relaxing he assumpion of a given renal price (ha is, if P is allowed o adjus o marke siuaions), he aacker s decreased demand for bones will push down he renal price of machines (ha is, P will fall). Marke price P is furher decreasing in p v, hus a higher p v will lower he bone maser s profi hrough wo channels: lowered revenue due o lower price and higher coss of mainaining more C&C channels (Figure 2). The supply curve illusraes he bone masers willingness o sell a any given marke renal price of bos. As he price rises, price-sensiive bone masers are willing o ren ou more bos, hence he supply curve for price-sensiive bone masers is upward-sloping. The supply and demand model suggess he decreased price and bo renal afer inroducing virual machines. Alernaively, Figure 3 illusraes he bone renal marke where bone masers are price-akers. The demand curve summarizes aackers willingness o pay for each renal bo a any given level of bo renal. The declined qualiy of bos due o he exisence of virual machines reduces aackers willingness o pay. Accordingly, he new demand curve a he presence of virual machines is lower han he demand curve wihou virual machines. The supply and demand model in his case suggess he decreased bo renal afer inroducing virual machines. In he following analysis, we will hold marke price as given. Price changes are no essenial o our analysis because he renal price received by he bone maser is jus he price paid by he aacker. Price flucuaions cause income redisribuion beween bone masers and aackers raher han affecing he combined benefis of he marke. The analysis in his subsecion shows how he inroducion of virual machines may aler economic benefis o ineres paries. By creaing virual bos o disurb bones, we ve seen he possibiliy of reducing profiabiliy of paricipaing in Inerne black markes, and hence reducing he incidence of black marke aciviies. By reducing he poenial profi levels of boh bone masers and aackers, creaing virual machines has a large poenial o reduce unfavorable Inerne pracices. B. Uncerainy For A Renal Bo Being Virual In previous subsecion we demonsrae ha creaing honeypos reduces he araciveness of paricipaing in he black marke for bones. In his secion we relax he assumpion of a fixed p v and inroduce uncerainy o he marke. In oher words, his ime p v becomes unknown o black marke paricipans (bone masers, aackers, ec.). The following analysis shows ha uncerain proporion of virual machines will make he siuaion even harsh for bone masers and aackers. To ha end, he model needs o be modified. We coninue denoing he probabiliy for a renal bo o be virual as p v, bu i is unknown o he marke his ime. We denoe he probabiliy for a bone

9 syle aack o be successful as p s, which depends on p v and he oal number of machines ren, p s = f(p v, n u ) (12) where n u is he size of renal in he uncerain environmen. p s is decreasing in p v and increasing in n u. (12) has a discree forma. p s = 1 if n u (1 p v ) n e ; p s = 0 if n u (1 p v ) < n e. The firs sep of he game is sill for he aacker o deermine he number of machines o ren (n u ), which is he opimal soluion o he aacker s profi maximizaion problem. The chance of launching a successful aack depends on how likely for a bo o be virual. For DDoS aacks, paymen is more likely predicaed upon he arge sies acually being disabled. Therefore, we can model he aacker s profi maximizaion problem as follows. max(p rofi) nu = E P nu = M p s P n u = M f(p v, n u ) P n u s.. n u (1 p v ) n e (13) where we replace he probabiliy of launching a successful aack p s wih is deerminans p v and n u. E sands for he expeced revenue of he aacker. To make he aack successful, he aacker has o ren a leas n u = ne 1 p v machines. As p v 1, n u. Taking he firs order derivaive of he objecive funcion wih respec o n u, we ge he firs order condiion for he maximizing problem, M f (p v, n u ) P = 0, or f (p v, n u ) = P M, which implies ha by observing marke price of rening machines and he paymen o be received afer launching a successful aack, he aacker rens n u such ha he firs order condiion holds rue. n If p v were known o he aacker, he minimum size of renal would be e 1 p v. The unknown probabiliy p v makes i impossible for he aacker o pin down he size of renal. If he rens oo many, he will incur unnecessary coss; if he rens oo few, he aack fails. He receives no paymen and only pays renal coss. Thus, here is a rade off beween renal coss and he odds of a successful aack. We noe ha he probabiliy for a renal bo o be virual (p v ) is differen from he number of virual machines as a percenage of he bone size. Le p b represen he percenage of virual machines in he bone and V be he number of virual machines in he bone. Recall ha N sands for he fooprin of he bone, hen p b = V N. The number of real machines (machines ha are no virual) is hus (N V ). The machines ha he bone maser can ren o he aacker mus be live machines. When he bone maser needs o choose n u machines from he bone, he/she has o choose live machines. A real machine may have idle ime as well as live ime, while a virual machine can run 24/7. The chance for a virual machine o be chosen is likely o be higher han ha of a real machine. If he bone maser selecs machines randomly from he live populaion, he chance for a virual machine o be picked c r and he chance for a real machine o be picked c v have he following relaionship: c v = 24 7 d c r c r. Wihou virual machines, he aacker rens n = n e machines and he bone maser keeps he size of he bone a N =. Wih he exisence of virual machines, he effecive size of he bone is N u = B + V, where N u is he size of bone under uncerainy and B is he number of real machines. To saisfy he need of rening n u machines, V, N u and n u have he relaionship of ne 1 p v. The chance for a real machine o be picked is c r = V + ( ) (N u V ) = n u (14) From (14) we can derive he probabiliy for a machine in he n u renal machines o be virual,

10 p v = V n u = V V + ( )(N (15) u V ) The profi-maximizing size of renal is equal o he minimum number of live machines. Since all virual machines are acive around he clock, V virual machines are all seleced for rening o he aacker. The uncerainy of p v comes from he uncerainy of he number of virual machines in a bone. The uncerainy of p v furher leads o he ambiguiy in he renal marke for bones, which reduces marke efficiency. The uncerainy also affecs bone masers decision-making. A represenaive bone maser s profi maximizaion problem can be wrien as follows. max k,n (P rofi) = P nu m k a(n) s.. k nu q N nu The consrain condiions illusrae ha a any ime, he bone maser mus have enough C&C conrol channels and machines o say in business. The soluions o he problem sill ake he following forma: k = nu q and N = nu. The uncerainy of n u due o he unknown p d v leads o he uncerainy 24 7 of k and N, boh are increasing in n u. Wih uncerain number of virual machines V (and hence p v ) and size of renal, here is no way o deermine he appropriae/effecive size of he bone. The profi margins for he bone maser and he aacker are calculaed as π v2 b (16) π v2 a = M f(p v, n u ) P n u (17) = P n u m nu q a( n u Adding (17) and (18), he size of he gains on he whole marke is now π u = M f(p v, n u ) m nu q a( n u ) (18) ) (19) Since f(p v, n u ) 1, n u > n, and a( ) is increasing in n u, he marke profiabiliy shrinks, meaning ha he oal benefi available for he wo paries is smaller. Indeed, boh paries are only lef wih a smaller profi margin han in he previous wo cases. I is imporan o go over he moivaion and preferences of each ineres pary, and see he effecs of an uncerain p v. The aacker. The aacker decides he minimum/effecive size of renal ha guaranees a successful aack n u, which is deermined according o f (p v, n u ) = P M. Given marke prices of renal and aack, nu is increasing in p v. The aacker s profi is decreasing in p v. The bone maser. By observing he number of machines he aacker is willing o ren, he bone maser decides he minimum/effecive number of C&C channels and he size of bone o mainain ha allow a leas n u machines are alive ensuring here are always enough machines for rening. An uncerain p v increases he bone maser s operaion coss and may evenually reduce his/her profi if he marke renal price of low-qualiy bone drops and he/she furher suffers repuaional losses and an increased chance of being arresed. Noe for boh he aacker and he bone maser, undesirable coss incur.

11 The defenders 4. The sraegy is simply o creae virual slices/images on heir compuers o inerfere wih he bone marke. Boh he bone maser s and he aacker s coss are direcly and posiively relaed o he probabiliy for a bo o be virual among he n u renal machines. Tha is, p v is he essenial facor ha is, if no fully, a leas parially conrolled by he defenders. Higher p v will effecively reduce he profis earned by boh he bone maser and he aacker. If p v is high enough, rening bones o launch aacks or oher illegal aciviies may no longer be profiable. Even some profis remain, he reduced profi margin will cerainly make he business no as aracive as before 5. Alhough we have modeled he profi maximizaion decision-making for he aacker and he bone maser separaely, he model conclusions will be he same if he wo paries are combined o model he opimal resuls on he whole marke. Therefore, if bones are no ren o aackers bu are used by bone masers hemselves o launch aacks, he model predicions work equally well. V. FURTHER DISCUSSION AND CASE STUDY Firs, a few couner-virual measuremens ha migh be adoped by he bone maser are discussed in his secion, for example, wha if he bone maser selecs machines according o lifeime of being a bone member raher han selecing machines randomly (or, wha if he bone maser adops a firsin-firs-ou sraegy). Wha abou insurance, would ha help? Second, we walk hrough examples as case sudy coupled wih graphical analysis of he model. Las, some echnical deploymen feasibiliy is discussed. A. Couner-Virual Sraegies Firs, le us look a firs-in-firs-ou sraegy. Firs-in-firs-ou means ha he bone maser selecs machines according o he lengh of being compromised. Older member bos are more likely o be chosen. This sraegy may seem advanageous han random selecion a he firs sigh, bu i will no nullify our mehod. The firs-in-firs-ou sraegy simply imposes more challenges for researchers o develop approaches for prevening a virual machine from being deeced by he bone maser. Meanwhile, since virual machines are no subjec o he life cycle of a real machine, hey end o have longer lifeime, which can even increase he probabiliy for a virual machine o be seleced. If he bone marke becomes aware of he problems creaed by virual machines, he bone maser may consider offering warrany or insurance o aackers and promises o replace inacive machines. This seems like a good idea bu i would be very difficul for he bone maser o implemen i because 1) All he warrany depends on he capabiliy for he aacker/bone maser o find ou which machine is inacive, which akes ime; 2) Even he previous is possible, having virual machines disribued widely among bones and he fac ha a virual machine is more likely o be picked furher complicae he siuaion; 3) Some ype of aacks (such as DDoS) may be ime-resricing. Once he firs wave of aack fails, he arge sie may have been aware of he aack and iniiaed couner-aacking. To couner he uncerainy creaed by unknown p v, he aacker may ren n u = n machines a n 1 p g v 1 p g v an esimaed level of p v = p g v. If n u = urns ou o be insufficien, he aacker hen increases he inensiy of aacks per (real) machine (upon deecing virual machines). There are again wo major difficulies wih his couner-virual sraegy. The firs is abou he iming, i.e. how likely and quickly is i for he aacker and he bone maser o deec virual machines? The second issue is he increased chance of being blocked if each real bo has o send more access requess. Tha is, i will 4 Defenders refer o whoever has he incenive o run/mainain honeypos such as researchers and governmen agencies. While hese organizaions by law have desire o figh agains cybercriminals, privae paries may also be moivaed o creae honeypos if hey are financially compensaed. For example, a honeypo server may collec daa on he bone o sell o cusomers for developmen of infrasrucure proecion echniques. 5 Furhermore, he increased likelihood for an aack o fail also increases he psychological coss of launching such an aack, which makes he pracice even less ineresing.

12 be harder for he aacker o mimic a human visior. In oher words, he heavier each machine aacks, he more likely will i be deeced and filered. Therefore, i is concluded ha he sraegy of creaing virual machines o blur Inerne black markes is robus o above various possible couner-sraegies ha cybercriminals may adop. Indeed he mos obvious and challenging couner-virual sraegy he bone maser may explore is o improve he deecion of fake bos. For example, he bone maser may monior wheher bos paricipae in he aack or respond o oher malicious commands as insruced. Secion V-C discusses issues relaed o such counermeasure in more deails. B. Examples and Illusraion We now look a a case sudy wih numerical examples and graphical illusraion. From above, he essenial componen of our sraegy is he uncerainy of p v, or he ambiguous number of virual machines ha have been creaed (V ). An ineresing quesion is how large should V be o compleely wipe off he profis reaped from paricipaing he marke. Since modeling bomases and aackers respecively is equivalen o modeling he enire marke, we focus on analyzing how he oal size of he marke profi is affeced by changing he number of virual machines, and figuring ou he cuoff value of i. Subsiuing (8) ino (15), we express he number of virual machines V as a funcion of he probabiliy for a renal machine o be virual p v. n e p v V = (1 p v )(1 p v (1 )) (20) The uncerainy of p v makes i impossible o solve for he bone size N u and he size of marke profi π u. We assign some values o he parameers and show how he wo variables (N u and π u ) change wih p v. For simpliciy, suppose n u ne 1 p v is saisfied, hence f(p v, n u ) = 1. We also drop he penaly funcion from he marke profi funcion 6. The marke profi (19) is simplified as π u = M m n e (1 p v ) q Given he parameers (M, m, n e and q), we can solve for he cuoff p v ha reduces he marke profi o break even (and if p v exceeds he cuoff value, he marke profi becomes negaive). The formula of he cuoff p v is p v,cuoff = 1 m ne (22) M q Based upon he relaionship beween p v and V as shown in (20), we can derive he criical number of virual machines required. For example, if he parameers ake he following values: M = 1, 000, m = 40, n e = 1, 000, and q = The corresponding cuoff value is p v,cuoff = 0.2. Suppose he average hours during which a real machine is alive is = 8. The average days for a real machine o be a work is d = 5. To reach he cuoff p v,cuoff, he number of virual machines ha he researcher needs o creae is V cuoff = 295. The size of he bone is accordingly N = 5, 250. The numerical example suggess ha given he parameers, he marke profi will be lowered down o zero if he chance for a renal bo o be virual is 0.2. For a echnically-deermined effecive size of renal n e = 1, 000, 295 virual machines are required. Wihou virual machines, he bone maser 6 In realiy, he chance for a bone maser o be deeced and arresed is small. Dropping he penaly componen of he coss does no damage he model conclusions. Effecs of non-zero legal punishmen and how legal enforcemen can be combined wih honeypos o figh bones, especially when bones are used o launch aacks wih linearly increasing payoffs such as spams are sudied in a relaed work. 7 The acual values of he parameers can be esimaed from empirical sudies. The numbers assigned here are for illusraive purposes. (21)

13 u ) Profi (π Marke Profi A The Presence Of Virual Bos Probabiliy for a renal machine o be virual (p v ) Fig. 4. Bone marke profi decreases wih increasing chance of fake renal bos. only needs o mainain he bone size a N = ne = 4, 200. The inerference by virual machines 1 enlarges he bone size by he rae of 1 p v. A he cuoff p v = 0.2, he bone size is enlarged by 1.25 imes. Noe he previous numerical example is based upon he assigned parameer values. If hey change, he cuoff probabiliy and he number of virual machines also change. m and n e affec p v negaively, and M and q affec p v posiively. From he perspecive of researchers, a negaive impac on p v is favorable since a lower p v requires fewer virual machines o be in place. Increasing cos of mainaining channels (higher m) 8 and larger number of machines required o disable he arge sie (larger n e ) raise he operaion burden of he bone maser. By conras, more payoff for disabling he vicim (larger M) and more machines a C&C channel can suppor (larger q) enhance he moivaion for aacks and reduce he operaion coss for he bone maser. We now illusrae graphically how he key variables are relaed using he same parameer values specified. Firs of all, he marke profi margin depends on he probabiliy for a renal machine o be virual p v. I is ineresing o know how his profi margin changes wih p v. Figure 4 illusraes he mahemaical relaionship π u = 1, , 000 (1 p v ) 50 Secondly, he number of virual machines (V ) varies wih he probabiliy for a renal bo o be virual (p v ). The relaionship beween V and p v is 1, 000 p v V = (1 p v ) (1 p v ( )) Recall he relaionship beween p v and he bone size N u, we ge he following formula linking he wo a he given parameer values: N u = 1, 000 (1 p v ) = 4, p v The graphical illusraion of how V and N u are relaed o p v is given in Figure 5. The above numerical and graphical illusraion show ha uncerainy maers given he cuoff probabiliy of fake renal bos p v,cuoff. The availabiliy of virual machines largely reduces economic 8 Bone masers may seek for innovaion in response o he increased use of honeypos. For example, hey may develop cheaper means of C&C (i.e., lower m). According o (21) and (22), profi may increase and he cuoff p v has o be larger. Cheaper means of C&C is unfavorable innovaion concerning fighing aacks. Neverheless, i does no affec he naure of model conclusions.

14 18000 Quaniaive Relaionship Beween Bones and Virual Machines Number of machines Number of Virual Machines (Nu) Bone Size (V) Probabiliy for a renal machine o be virual (p v ) Fig. 5. Opimal bone size and renal size increase as he chance for a renal bo o be virual increases. payoffs for paricipaing in he Inerne black marke, which reduces he araciveness of he pracice. Making p v a random number will make he siuaion even more challenging for bone masers and aackers. More likely, he rough ranges of he parameer values are common knowledge. Bone masers and aackers could also figure ou he cuoff value of p v. By increasing he size of he bone, hey may be able o conver a loss ino a profi. To couner reac, researchers may have o increase he number of virual machines, which may furher force he bone masers o expand bones. Consequenly, having p v fixed may resul in an unpleasan siuaion similar o arms race. Our proposed sraegy becomes much more effecive by making p v uncerain. Wihou researchers and defenders commimen o creaing jus he righ number of virual machines o reach he cuoff p v,cuoff, i is difficul if ever possible for he illegal praciioners o guess he acual number of virual machines. Opimal decisions are herefore no way o make. Since he aacker receives no money if he aack fails, one safe be may be jus o ren as many as possible. The bone maser has o expand he size of bones as well. The increased coss for boh paries reduce he profi margins. If he coss increase by oo much, all he profi margins may be disappearing. Noe ha, a he same ime of discouraging bone masers and aackers from enering he marke, he uncerainy helps reduce he operaion coss of defenders. They may reduce he number of virual machines wihou being aware of. The uncerainy (or randomness of creaing virual machines in some sense) faciliaes he implemenaion of he proposed mehodology. C. Technical Challenges We furher discuss a few feasibiliy issues such as he magniude of virual machines and counerdeecion echniques. Firs of all, he number of virual machines does no have o be big. According o previous sudies, he bone size ranges from roughly a few hundreds o hundreds of housands. For example, Dagon e al. esablish ha bone sizes may reach 350,000 members [16]. Rajab e al. indicae ha he effecive sizes 9 of bones rarely exceed a few housand bos [1]. A recen sudy by Rajab e al. revisis he quesion of bone size and draws he disincion beween fooprin (he overall size of he infeced populaion a any poin in he lifeime of a bone) and live populaion (he number of live bos simulaneously presen in he command and conrol channel). They show ha while he fooprins of he bones can grow o several ens of housands of bos, heir effecive sizes usually are limied o a few housands a any given poin in heir lifeime. For example, bone fooprin sizes can exceed 100,000 infecions, heir live populaions are normally in he range of a few 9 The effecive size of a bone is he number of bos conneced o he IRC channel a a specific ime. While he effecive size has less impac on long erm aciviies such as execuing commands posed as channel opics, i significanly affecs he number of minions available o execue imely commands such as DDoS aacks.

15 housand bos [4]. The relaively limied size of bones suggess ha i may no be easy o enlarge bones dramaically and rapidly due o some pracical or echnological barriers. If he probabiliy for a machine o be virual in he renal bone is a a decen level, bones will be significanly affeced. For example, suppose p v = 0.1, hen he bone size has o be 11 percen 10 larger compared wih he siuaion in which virual machines are no around. The aacker has o ren 11 percen more machines and suffers a 11 percen increase in coss. There is also a 11 percen increase in he coss for he bone maser o mainain more C&C channels and more machines, which can by significan. The conras beween he relaive easiness o build virual machines and he difficuly in enlarging bones implies he opporuniies for our plan o work. The funcioning of honeypos is pivoing on camouflaging fake bos. Indeed, bones are no equally complicaed. They diversify in erms of echnological complexiy. Bones can be roughly caegorized ino hree groups, depending on he bone maser s echnological proficiency: Case I. Low: I should no be a big problem for defenders o make virual machines o join a bone. Case II. Medium: Bone masers only check compromised machines a he enry of a bo. If a virual machine passes his enry es, i will no be evaluaed again. Case III. Advanced: The mos challenging siuaion is when a sophisicaed bone maser sends commands o es machines no only a he enry, bu also from ime o ime. In his case, wha requires is some ani-deecing echnique or sraegy. For example, allowing virual machines o fulfill some rivial asks would make virual machines rusworhy o he bone maser. To follow his I-fool-you, cach-me-if-you-can sraegy, i is crucial o find ways for virual machines o judge which orders are innocuous o follow. Wha echnical ools/progresses are necessary o disguise honeypos from being deeced is also a promising furher research opic. The dynamic feaures of bones also faciliae our mehod. According o Karasaridis e al. [17], he bones are very dynamic in naure. Based on long-erm monioring of validaed malicious bones, hey esimae ha he average bo says abou wo o hree days on he same bone conroller, swiching conroller addresses and domains very frequenly. A duraion of a couple of days makes i harder and less producive o conduc es orders frequenly. More likely, bone masers may only command a newly compromised machine o do a simple ask a enry. Bone masers also seal each ohers machines. Honeypos may funcion equally well if being los from one bone o anoher. Furhermore, newer bos can auomaically scan heir environmen and propagae hemselves using vulnerabiliies and weak passwords. Generally, he more vulnerabiliies a bo can scan and propagae hrough, he more valuable i becomes o a bone conroller communiy. Therefore, a virual machine-creaed pseudo-bos can propagae by including more virual machines ino a bone, and enhance he higher weighs and he imporance of he virual machines o bone masers. The bone conroller communiy feaures a consan and coninuous sruggle over who has he mos bones, and he larges amoun of high-qualiy infeced machines, like universiy and corporae machines. I may be economically reasonable for a bone maser o creae larger bones. For example, adverising a larger bone may send a posiive signal o poenial buyers on Inerne underground markes indicaing he bone maser is experienced and ough o have good repuaion. Operaing a larger bone may also faciliae cerain asks ha bones are for. For example, a larger bone may be more effecive o disable a arge by overwhelming i or more spam s can be sen in a shor period of ime by having more machines do he job. Since bone masers have o keep recruiing new machines even hey are fully aware of he exisence of honeypos, he virual bos enry o bones can never be shu down. Meanwhile, he size of a bone is subjec o an upper bound, someime specified by he widh of he C&C channel. Therefore, here is a radeoff beween hacking more machines and increasing C&C channels. The more machines hacked, he larger he size of he bone, and more buffer can be obained, bu more machines require more C&C channels, which increases operaing coss of he 10 The size of he bone is 1 = 1.11 imes of he size in he benchmark case. The increase in size is 11 percen

16 bone and he chance of being deeced. The exisence of honeypos makes mainaining a bone more cosly and risky since he bone maser may have o increase he size of he bone o compensae for he uncerain inacive honeypos. One hing o noe, insead of increasing he size of he bone, he bone maser may raher reduce he size of he bone, and only keep hose safe and acive machines. I is cerainly a sraegy bone masers may use, he risk of ha is a coninuously declining bone due o he life cycle of a comprised machine. Figuring ou he opimal size of bone given he complicaed scenario hen becomes mission impossible. VI. CONCLUSION AND FUTURE WORK Profi-driven bone aacks impose serious hreas o he modern Inerne. Given ha money is perhaps he single deermining force driving he growh in bone aacks, we propose an ineresing economic approach o ake away he financial incenives. By inroducing he uncerainy level, we make he opimal bone size infeasible for he bone operaors. As he chance of uncerainy increases, boh bone masers and aackers profis can fall dramaically. The proposed scheme is advanageous versus exising schemes in ha i srikes a he roo moivaion for he bones hemselves, i.e., he profi moivaion. Regardless of he ype of command and conrol srucure, he sophisicaion of compromising new hoss, or he creaion of new avenues o marke bone services, we believe his paper nicely demonsraes how he applicaion of economic principles can offer significan benefi o combaing bones. The paper is he sepping sone of a series of analyses. In a relaed work, we include non-zero legal punishmen ino he profi maximizaion problem and discuss how he coordinaion of legal engagemen and honeypos works o reduce financial incenives of non-ddos bone-relaed cybercrimes whose payoffs are linearly increasing in he use of bone. Moreover, wih varying qualiies of bones and diversified repuaion of bone masers, Inerne bone markes may be more monopolisic compeiive or price discriminaed. The assumpions of price-aking marke paricipans and a single renal price of bos may be relaxed o sudy price discriminaion, and such modificaion of he problem seup may resul in some ineresing resuls. Legalizing Inerne black markes is anoher aracive and challenging idea. Besides economic facors, echnical, social, ehical and legal consideraions all play cerain roles. A wealh of research can be carried ou along his line of hinking. REFERENCES [1] M. A. Rajab, J. Zarfoss, F. Monrose, and A. Terzin, A mulifaceed approach o undersanding he bone phenomenon, in 6h ACM SIGCOMM conference on Inerne Measurmen, SESSION: Securiy and Privacy, 2006, pp [2] R. Mahajan, S. Bellovin, S. Floyd, J. Ioannidis, V. Paxon, and S. Shenker, Conrolling high bandwidh aggregaes in he nework, ACM SIGCOMM Compuer Communicaion Review, vol. 32, no. 3, pp , July [3] D. K. Y. Yau, J. C. S. Lui, F. Liang, and Y. Yam, Defending agains disribued denial-of-service aacks wih max-min fair server-cenric rouer hroles, IEEE/ACM Transacions on Neworking, vol. 13, no. 1, pp , [4] M. A. Rajab, J. Zarfoss, F. Monrose, and A. Terzis, My bone is bigger han yours (maybe, beer han yours): Why size esimaes remain challenging, in Proceedings of he firs conference on Firs Workshop on Ho Topics in Undersanding Bones, Cambridge, MA, 2007, p. 5. [5] K. Park and H. Lee, On he Effeciveness of Probabilisic Packe Marking for IP Traceback under Denial of Service Aack, in Proc. of INFOCOM 2001, 2001, pp [6] A. Snoeren, C. Parridge, L. Sanchez, C. Jones, F. Tchakounio, S. Ken, and W. Srayer, Hash-Based IP Traceback, in Proc. of SIGCOMM, 2001, pp [7] S. Savage, D. Weherall, A. P. Karlin, and T. Anderson, Pracical Nework Suppor for (IP) Traceback, in Proc. of SIGCOMM, 2000, pp [8] J. Xu and W. Lee, Susaining availabiliy of web services under disribued denial of service aacks, Transacions on Compuers, vol. 52, no. 2, pp , Feb [9] C. Jin, H. Wang, and K. Shin, Hop-Coun Filering: An Effecive Defense Agains Spoofed DoS Traffic, in Proc. of he 10h ACM Conference on Compuer and Communicaions Securiy, 2003, pp [10] S. Jin and D. Yeung, A Covariance Analysis Model for DDoS Aack Deecion, in Proc. of he IEEE Inernaional Conference on Communicaions (ICC), vol. 4, June 2004, pp

17 [11] J. Franklin and A. Perrig, An inquiry ino he naure and causes of he wealh of inerne miscreans, in Proceedings of he 14h ACM conference on Compuer and Communicaions Securiy, SESSION: Inerne Securiy, Alexandria, Virginia, 2007, pp [12] R. Ford and S. Gordon, Cen, five cen, en cen, dollar: Hiing bones where i really hurs, in New Securiy Paradigms Workshop, 2006, pp [13] P. Bcher, T. Holz, M. Ker, and G. Wicherski, Know your enenmy: Tracking bones. The Honeyne Projec & Research Alliance, March [14] Compuer scienis fighs hrea of bones. ScienceDaily, Nov [Online]. Available: hp:// [15] Worldwide infrasrucure securiy repor vol.ii (2006), ARBOR NETWORK. [Online]. Available: hp:// [16] D. Dagon, C. Zou, and W. Lee, Modeling bone propagaion using ime zones, in Proceedings of he 13h Annual Nework and Disribued Sysem Securiy Symposium (NDSS 06), Feb [17] A. Karasaridis, B. Rexroad, and D. Hoeflin, Wide-scale bone deecion and charaerizaion, in USENIX Workshop on Ho Topics in Undersanding Bones (HoBos 07), 2007.