No plan survives contact: experience with cybercrime measurement

Authors:
Chris Kanich;Neha Chachra;Damon McCoy;Chris Grier;David Y. Wang;Marti Motoyama;Kirill Levchenko;Stefan Savage;Geoffrey M. Voelker
Affiliations:
Department of Computer Science and Engineering, University of California, San Diego;Department of Computer Science and Engineering, University of California, San Diego;Department of Computer Science and Engineering, University of California, San Diego;Computer Science Division, University of California, Berkeley;Department of Computer Science and Engineering, University of California, San Diego;Department of Computer Science and Engineering, University of California, San Diego;Department of Computer Science and Engineering, University of California, San Diego;Department of Computer Science and Engineering, University of California, San Diego;Department of Computer Science and Engineering, University of California, San Diego
Venue:
CSET'11 Proceedings of the 4th conference on Cyber security experimentation and test
Year:
2011

Citing 16
Cited 3

Detecting semantic cloaking on the web

Proceedings of the 15th international conference on World Wide Web
Understanding the network-level behavior of spammers

Proceedings of the 2006 conference on Applications, technologies, architectures, and protocols for computer communications
A case study of the rustock rootkit and spam bot

HotBots'07 Proceedings of the first conference on First Workshop on Hot Topics in Understanding Botnets
Spamscatter: characterizing internet scam hosting infrastructure

SS'07 Proceedings of 16th USENIX Security Symposium on USENIX Security Symposium
On the spam campaign trail

LEET'08 Proceedings of the 1st Usenix Workshop on Large-Scale Exploits and Emergent Threats
The heisenbot uncertainty problem: challenges in separating bots from chaff

LEET'08 Proceedings of the 1st Usenix Workshop on Large-Scale Exploits and Emergent Threats
Spamming botnets: signatures and characteristics

Proceedings of the ACM SIGCOMM 2008 conference on Data communication
Spamalytics: an empirical analysis of spam marketing conversion

Proceedings of the 15th ACM conference on Computer and communications security
Dynamics of Online Scam Hosting Infrastructure

PAM '09 Proceedings of the 10th International Conference on Passive and Active Network Measurement
Studying spamming botnets using Botlab

NSDI'09 Proceedings of the 6th USENIX symposium on Networked systems design and implementation
Spamcraft: an inside look at spam campaign orchestration

LEET'09 Proceedings of the 2nd USENIX conference on Large-scale exploits and emergent threats: botnets, spyware, worms, and more
Temporal correlations between spam and phishing websites

LEET'09 Proceedings of the 2nd USENIX conference on Large-scale exploits and emergent threats: botnets, spyware, worms, and more
Re: CAPTCHAs: understanding CAPTCHA-solving services in an economic context

USENIX Security'10 Proceedings of the 19th USENIX conference on Security
Click Trajectories: End-to-End Analysis of the Spam Value Chain

SP '11 Proceedings of the 2011 IEEE Symposium on Security and Privacy
Dirty jobs: the role of freelance labor in web service abuse

SEC'11 Proceedings of the 20th USENIX conference on Security
Show me the money: characterizing spam-advertised revenue

SEC'11 Proceedings of the 20th USENIX conference on Security

Show me the money: characterizing spam-advertised revenue

SEC'11 Proceedings of the 20th USENIX conference on Security
Priceless: the role of payments in abuse-advertised goods

Proceedings of the 2012 ACM conference on Computer and communications security
Spamming for science: active measurement in web 2.0 abuse research

FC'12 Proceedings of the 16th international conference on Financial Cryptography and Data Security

Quantified Score

Hi-index	0.00

Visualization

Abstract

An important mode of empirical security research involves analyzing the behavior, capabilities, and motives of adversaries. By definition, such measurements cannot be conducted in controlled settings and require "engagement" directly with adversaries, their infrastructure or their ecosystem. However, the operational complexities required to successfully carry out such measurements are significant and rarely documented; blacklisting, payment instruments, fraud controls and contact management all represent real challenges in such studies. In this paper, we document our experiences conducting such measurements over five years (covering a range of distinct studies) and distill effective operational practices for others who might conduct similar experiments in the future.