Bow-Tie Structure in Hacking Networks Core and Periphery positions in hackers’ networks

• In Event: The Effect of Computing Environments and Network Configurations on Hackers’ Illegitimate Online Behaviors During the Progression of System Trespassing Events

Abstract

For over 30 years cybercrime and hacking have been worldwide ubiquitous malicious phenomena. Though many studies have explored hacking communities, only few have investigated hacking networks on the country level. Our study focuses on the global topology of a hackers’ network, in a country-level resolution. We collected data of successful brute-force attacks (BFAs) and system-trespassing incidents (Sessions) on Honey-pots (HP). Mapping their IP addresses, we depict the exchange of data between BFAs hackers and Sessions hackers. Using Social Network analysis (SNA) we built a global network of hackers and hacked data and found it to have a Bow-Tie structure, with a dense core and sparsely connected periphery. We examined the network’s topology in accordance with the speculated purpose of this network and found a match between purpose and topology. Our contribution is in studying the dynamics of hacking activity on the country level and in suggesting insights into the network’s formation and goal to establish better defense policies.

Authors

• Amit Rechavi, University of Haifa

• Tamar Berenblum, Hebrew University

• David Maimon, University of Maryland

• Wuling Ren, Zhejiang Gongshang University