Analyzing and Modeling Longitudinal Security Data

Abstract

Many cybersecurity problems occur on a worldwide scale, but we lack rigorous methods for determining how best to intervene and mitigate damage globally, both short-and long-term. Analysis of longitudinal security data can provide insight into the effectiveness and differential impacts of security interventions on a global level. In this paper we consider the example of spam, studying a large high-resolution data set of messages sent from 260 ISPs in 60 countries over the course of a decade. The statistical analysis is designed to avoid common pitfalls that could lead to erroneous conclusions. We show how factors such as geography, national economics, Internet connectivity and traffic flow impact can affect local spam concentrations. Additionally, we present a statistical model to study temporal transitions in the dataset, and we use a simple extension of the model to investigate the effect of historical botnet takedowns on spam levels. We find that in aggregate most historical takedowns are beneficial in the short-term, but few have long-term impact. Further, even when takedowns are effective globally, they can be detrimental in specific geographic regions or countries. The analysis and modeling described here are based on a single data set. However, the techniques are general and could be adapted to other data sets to help improve decision making about when and how to deploy security interventions.

Empirical analysis of weapons of influence, life domains, and demographic-targeting in modern spam: an age-comparative perspective

“…Our approach extends previous work [4, 2, 16] in its adoption of an analysis of spam from an age-comparative perspective. This perspective allowed us to determine the extent to which spammers in today’s spam emails target young vs older users differently, based on their particular vulnerabilities [17].…”

“…Spam is usually sent by botnets, hired by spammers for their spam campaigns. Thus, many studies have focused on analyzing (i) the operation of such botnets [12, 3]; (ii) how the botnets automatically generate content for spam campaigns [2]; and (iii) the statistical features of large corpuses of spam [16].…”

Risky Business: Assessing Security with External Measurements

“…A variety of methods could be used to construct a mapping of IP space to organizations, but it is crucial to make this mapping as accurate as possible. Given the heavy tailed nature of security incidents [23,24], misc attribution of a security incident could alter the assessment of an organization.…”

“…For example Stone-Gross et al focused on ISPs with persistent malicious behavior [61]. Edwards et al studied the concentration of spam sending IP addresses within Internet Service providers, and examined some risk vectors(including economic, geographic, and connectivity) for high levels of spam concentrations [24]. Other work has focused identifying high concentrations of infected IP addresses in certain parts of the Internet [47,53,13].…”

Information Security and Development Problems eGoverment System in Ukraine

“…They found, that many cybersecurity problems occur at a global scale, involving nations, corporations, or individuals whose actions have impact around the world [10]. Another security problem is related to insecure sharing data.…”