The Work-Averse Cyber Attacker Model: Theory and Evidence From Two Million Attack Signatures

Allodi, Luca; Massacci, Fabio; Williams, Julian

Abstract

The assumption that a cyber attacker will potentially exploit all present vulnerabilities drives most modern cyber risk management practices and the corresponding security investments. We propose a new attacker model, based on dynamic optimization, where we demonstrate that large, initial, fixed costs of exploit development induce attackers to delay implementation and deployment of exploits of vulnerabilities. The theoretical model predicts that mass attackers will preferably i) exploit only one vulnerability per software version, ii) largely include only vulnerabilities requiring low attack complexity, and iii) be slow at trying to weaponize new vulnerabilities. These predictions are empirically validated on a large dataset of observed massed attacks launched against a large collection of information systems. Findings in this paper allow cyber risk managers to better concentrate their efforts for vulnerability management, and set a new theoretical and empirical basis for further research defining attacker (offensive) processes.

Citation

Allodi, L., Massacci, F., & Williams, J. (2022). The Work-Averse Cyber Attacker Model: Theory and Evidence From Two Million Attack Signatures. Risk Analysis, 42(8), 1623-1642. https://doi.org/10.1111/risa.13732

• Journal Article Type: Article
• Acceptance Date: Feb 3, 2021
• Online Publication Date: May 7, 2021
• Publication Date: Aug 6, 2022
• Deposit Date: Feb 4, 2021
• Publicly Available Date: Dec 20, 2021
• Journal: Risk Analysis
• Print ISSN: 0272-4332
• Electronic ISSN: 1539-6924
• Publisher: Wiley
• Peer Reviewed: Peer Reviewed
• Volume: 42
• Issue: 8
• Pages: 1623-1642
• DOI: https://doi.org/10.1111/risa.13732
• Public URL: https://durham-repository.worktribe.com/output/1252820