Student or educator? Sign up with your school email and get 6 months of Pro free.
CoChat
Sign Up
Cited by 112Cybercrime and Law Enforcement StudiesInformation and Cyber SecurityCybersecurity and Cyber Warfare Studies

The DOI matches its Crossref record; 5 of the 5 references it cites were found in a registry or an index.

Systematically Understanding the Cyber Attack Business: A Survey

Open access
Huang, Keman, Siegel, Michael, Madnick, Stuart·2019·ACM Computing Surveys
DOI 10.1145/3199674
Open this paper in CoChat — free accountOpen PDF

Abstract

Cyber attacks are increasingly menacing businesses. Based on the literature review and publicly available reports, this article conducts an extensive and consistent survey of the services used by the cybercrime business, organized using the value chain perspective, to understand cyber attack in a systematic way. Understanding the specialization, commercialization, and cooperation for cyber attacks helps us to identify 24 key value-added activities and their relations. These can be offered “as a service” for use in a cyber attack. This framework helps to understand the cybercriminal service ecosystem and hacking innovations. Finally, a few examples are provided showing how this framework can help to build a more cyber immune system, like targeting cybercrime control-points and assigning defense responsibilities to encourage collaboration.

Overview

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

Crossref · 10.1145/3199674

Cites

5 of 5 references verified0 citation errors · 0 not checkable

Statistics

Verification

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Citations

Cites

Show all 5 references

Research works printed but not linked: 118

  1. Ablon Lillian, 2014, Golay
  2. 10.1109/SP.2016.33 · DOI
  3. Algarni Abdullah M., 2014, Software vulnerability markets: Discoverers and buyers. Int. J. Comput., Electr., Automat., Control Info, Eng., 8, 480
  4. 10.1109/SP.2017.32 · DOI
  5. 10.1145/2946802 · DOI
  6. 10.1007/978-3-642-39498-0_12 · DOI
  7. Avgerinos Thanassis, 2011, Proceedings of the 18th Annual Network and Distributed System Security Symposium, 14
  8. 10.1109/SP.2017.67 · DOI
  9. 10.1016/S1353-4858(14)70059-5 · DOI
  10. 10.1109/SP.2008.17 · DOI
  11. Bryans Danton, Bitcoin and Money Laundering: Mining for an Effective Solution, 10.2307/j.ctv5cg8z1.9 · DOI
  12. Caballero Juan, 2011, Proceeddings of the USENIX Security Symposium. 13:1--13:16
  13. 10.1109/TITB.2008.923773 · DOI
  14. 10.1007/978-3-319-45719-2_15 · DOI
  15. Canali Davide, 2013, Proceedings of the 20th Annual Network 8 Distributed System Security Symposium.
  16. 10.1145/2872427.2883056 · DOI
  17. 10.1145/3019612.3019796 · DOI
  18. 10.1145/2501654.2501663 · DOI
  19. Cho Chia Yuan, 2011, Proceedings of the USENIX Security Symposium. 139--154
  20. 10.1016/j.cose.2011.08.004 · DOI
  21. 10.1145/2488388.2488408 · DOI
  22. 10.1145/3038912.3052715 · DOI
  23. 10.2139/ssrn.2032124 · DOI
  24. Conrad Bernd, 2014, Proceedings of the 9th International Conference on Internet Monitoring and Protection. 22--28
  25. 2015, An Overview of Exploit Packs
  26. DEEPDOTWEB., 2018, Updated: List of Dark Net Markets.
  27. DEEPWEBADMIN., Build a black market in dark web only for $4500
  28. Donilon Thomas, 2016, Keith Alexander, Ana Antón, Ajay Banga, Steven Chabinsky, Patrick Gallagher, Peter Lee, Herbert Lin, Heather Murren, Joseph Sullivan, Maggie Wilderotter, and Kiersten Todt.
  29. 10.1080/17440572.2016.1157480 · DOI
  30. 10.1145/2089125.2089126 · DOI
  31. Esteves Jose, 2017, To improve cybersecurity, think like a hacker. MIT Sloan Manage, Rev., 58, 71
  32. Felt Adrienne Porter, Web 2.0 Security and Privacy
  33. Kristin, Cybercrime: Conceptual Issues for Congress and U.S. Law Enforcement. Technical Report. Congressional Research Service, R42547
  34. 10.1109/MC.2013.445 · DOI
  35. 10.1145/2342441.2342457 · DOI
  36. Max Goncharov. 2012. Russian Underground 101. Technical Report. Trend Micro. 1--29. Max Goncharov. 2012. Russian Underground 101. Technical Report. Trend Micro. 1--29. · DOI
  37. Graziano Mariano, 2015, Proceedings of the 24th USENIX Security Symposium. 1057--1072
  38. 10.1145/2857705.2857720 · DOI
  39. 10.1109/ICITST.2009.5402538 · DOI
  40. 10.1007/s10458-016-9342-8 · DOI
  41. Ashley Harris. 2016. Cyber Ethics: An assessment of government and private industry. Ph.D. Dissertation. Utica College. Ashley Harris. 2016. Cyber Ethics: An assessment of government and private industry. Ph.D. Dissertation. Utica College.
  42. Haslebacher Andreas, All your cards are belong to us: Understanding online carding forums. CoRR abs/1607.00117 · arXiv
  43. Herley Cormac, Economics of Information Security and Privacy
  44. 10.1080/17440572.2016.1235821 · DOI
  45. Holt Thomas J., 2012, Examining the social networks of malware writers and hackers, Int. J. Cyber Criminol., 6, 891
  46. Holz Thorsten, Proceedings of the Network and Distributed System Security Symposium (NDSS’08)
  47. 10.1145/2063176.2063197 · DOI
  48. 10.1145/3038912.3052590 · DOI
  49. 10.1007/978-3-319-46295-0_16 · DOI
  50. Huang Keman, 2016, Proceedings of the IEEE Symposium on Security and Privacy. 2.
  51. 10.1109/TSC.2016.2646687 · DOI
  52. 10.1287/mnsc.2015.2309 · DOI
  53. 10.1145/2872427.2883004 · DOI
  54. 10.1145/2785956.2787494 · DOI
  55. 10.1109/MSP.2006.27 · DOI
  56. 10.1145/2831270 · DOI
  57. Leukfeldt E. R., 2014, Cybercrime and social ties: Phishing in amsterdam, Trends Organ. Crime, 17, 231
  58. Leukfeldt Rutger, 2015, Organised cybercrime and social opportunity structures: A proposal for future research directions, Eur. Rev. Organ. Crime, 2, 91
  59. 10.1109/SP.2011.24 · DOI
  60. 10.1080/07421222.2016.1267528 · DOI
  61. 10.1145/2872427.2883008 · DOI
  62. Loy Vincent, 2015, Bahgya Perera, Jimmy Sng, and Maggie Leong.
  63. Lu Yong, 2010, Social network analysis of a criminal hacker community, J. Comput. Infor. Syst., 51, 31
  64. 10.1007/s11416-016-0273-3 · DOI
  65. Madnick Stuart, 2016, Dark Web: Hackers trump good guys in sharing information.
  66. Madnick Stuart, 2017, What executives get wrong about cybersecurity. Sloan Manage. Rev. January
  67. Maillart Thomas, 2016, Proceedings of the Workshop on the Economics of Information Security (WEIS’16)
  68. 10.1016/S1361-3723(13)70053-8 · DOI
  69. Mansfield-Devine Steve, 2016, The imitation game: How business email compromise scams are robbing organisations, Comput. Fraud Secur., 11, 5, 10.1016/S1361-3723(16)30089-6 · DOI
  70. 10.1007/978-3-540-70630-4_5 · DOI
  71. Melicher William, 2016, Proceedings of the Usenix Security Conference. 239
  72. Moore Tyler, 2010, Proceedings of the Workshop on Deterring Cyberattacks: Informing Strategis and DEveloping Options for U.S. Policy. 3--23
  73. Nakamoto Satoshi, 2008, Bitcoin: A Peer-to-Peer Electronic Cash System. Bitcoin.org. https://bitcoin.org/bitcoin.pdf.
  74. Nawrocki Marcin, 2016, A survey on honeypot software and data analysis. eprint arXiv:1608.06249 · arXiv
  75. Nourian Arash, 2015, A systems theoretic approach to the security threats in cyber physical systems applied to stuxnet, IEEE Trans. Depend. Secure Comput., 99, 20
  76. 10.1109/MSP.2011.98 · DOI
  77. 10.1109/MIC.2013.16 · DOI
  78. Ozment Andy, 2004, Proceedings of the Workshop on Economics of Information Security (WEIS’04)
  79. Pavkovic N., Proceedings of the 34th International Convention on Information and Communication Technology, Electronics and Microelectronics. 1485--1489
  80. Porter Michael, 1985, Competitive Advantage: Creating and Sustaining Superior Performance
  81. 10.1145/3038912.3052600 · DOI
  82. 10.1145/2996358 · DOI
  83. Reaves Bradley, Proceedings of the IEEE Symposium on Security and Privacy. 339--356
  84. Reuter Peter, 2003, Truman
  85. Holland Rick, 2016, Proceedings of the https://www.digitalshadows.com/blog-and-research/the-hacker-talent-shortage-what-organizations-can-learn-from-the-recruitment-efforts-of-their-attackers/.
  86. 10.1145/2501654.2501659 · DOI
  87. Ellis Ryan, New Solutions for Cybersecurity
  88. Samani Raj, 2013, Cybercrime Exposed: Cybercrime-as-a-Service. Technical Report. McAfee. 1--18.
  89. Schneier Bruce, Secrets and Lies: Digital Security in a Networked World, 10.1002/9781119183631 · DOI
  90. 10.1145/2886012 · DOI
  91. Schwartz E. J., 2011, Proceedings of the USENIX Security Conference, 8
  92. 10.1145/2501654.2501661 · DOI
  93. 10.1109/SP.2016.17 · DOI
  94. 10.1515/jms-2016-0184 · DOI
  95. 10.1016/j.ijcip.2013.01.002 · DOI
  96. 10.1109/MSP.2012.90 · DOI
  97. 10.5555/2831143.2831146 · DOI
  98. 10.1007/s12117-012-9159-z · DOI
  99. Spinello Richard, 2016, Cyberethics: Morality and Law in Cyberspace. Jones 8 Bartlett Learning.
  100. 10.1145/2872427.2882992 · DOI
  101. Stevenson William J., Operations Management
  102. Brett, The underground economy of fake antivirus software
  103. 10.1145/2590296.2590302 · DOI
  104. 10.1016/j.eswa.2013.07.106 · DOI
  105. 10.1145/2733306 · DOI
  106. 10.1145/3017427 · DOI
  107. Thing Vrizlynn L. L., IFIP Advances in Information and Communication Technology
  108. 10.5555/3241094.3241151 · DOI
  109. 10.1109/SP.2011.25 · DOI
  110. Thomas Kurt, 2015, Proceedings of the Workshop on the Economics of Information Security. 1--24
  111. Tyagi Amit Kumar, 2011, A wide scale survey on botnet, Int. J. Comput. Appl., 34, 975
  112. Tzu Sun, The Art of War
  113. 10.1145/2736277.2741658 · DOI
  114. Wustrow Eric, 2016, Proceeddings of the USENIX Workshop on Offensive Technologies.
  115. 10.1145/2736277.2741650 · DOI
  116. 10.1145/2464464.2464524 · DOI
  117. 10.1145/2810103.2813704 · DOI
  118. 10.1109/MSP.2016.46 · DOI

Cited by

Metadata

Authors
Huang, K., Siegel, M., & Madnick, S.
Affiliations
Massachusetts Institute of Technology (US)
ORCID
Venue
ACM Computing Surveys
Publisher
Association for Computing Machinery (ACM)
Published
2018-07-06
Volume
51
Issue
4
Pages
1-36
ISSN
  • 0360-0300 (ISSN-L)
  • 1557-7341
DOI
10.1145/3199674
OpenAlex
W2860610442
Cited by
112
References
5
Citations by year
2026: 6 · 2025: 19 · 2024: 20 · 2023: 18 · 2022: 11 · 2021: 21 · 2020: 6 · 2019: 10
FWCI
14.92
Type
journal article
Language
en
Open access
Licence
www.acm.org/publications/policies/copyright_policy#Background (vor)
Locations
ACM Computing Surveys (publishedVersion)
Funders
  • Cybersecurity at MIT Sloan
  • National Natural Science Foundation of China (61502333)
Topics
  • Social Sciences › Law › Cybercrime and Law Enforcement Studies
  • Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
  • Social Sciences › Political Science and International Relations › Cybersecurity and Cyber Warfare Studies
Keywords
cybercrime, value chain, cyber defense

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review

Data sources

Bibliographic data: Semantic Scholar, OpenAlex, Crossref.

Contains information from the Semantic Scholar Academic Graph Datasets, made available under the ODC Attribution License (ODC-BY 1.0).

Semantic Scholar’s data is described in: Kinney, R., et al. (2023). The Semantic Scholar Open Data Platform. arXiv:2301.10140.