On the relevance of social media platforms in predicting the volume and patterns of web defacement attacks

Abstract

1-Social media platforms are commonly employed by law enforcement agencies for collecting Open Source Intelligence (OSNIT) on criminals, and assessing the risk they pose to the environment the live in. However, since no prior research has investigated the relationships between hackers' use of social media platforms and their likelihood to generate cyberattacks, this practice is less common among Information Technology Teams. Addressing this empirical gap, we draw on the social learning theory and estimate the relationships between hackers' use of Facebook, Twitter, and YouTube and the frequency of web defacement attacks they generate in different times (weekdays vs. weekends) and against different targets (USA vs. non-USA websites). To answer our research questions, we use hackers' reports of web defacement they generated (available on http://www.zone-h.org), and complement with an independent data collection we launched to identify these hackers' use of different social media platforms. Results from a series of Negative Binomial Regression analyses reveal that hackers' use of social media platforms, and specifically Twitter and Facebook, significantly increases the frequency of web defacement attacks they generate. However, while using these social media platforms significantly increases the volume of web defacement attacks these hackers generate during weekdays, it has no association with the volume of web defacement they launch over weekends. Finally, although hackers' use of both Facebook and Twitter accounts increase the frequency of attacks they generate against non-USA websites, the use of Twitter only increases significantly the volume of web defacement attacks against USA websites.

Website defacement and routine activities: considering the importance of hackers’ valuations of potential targets

“…Website defacement originated as a way for hackers to mock system administrators for poor security protocol, and as a way to generate their reputations as skilled hackers (Kilger 2011;Woo et al 2004). Today, website defacement is commonly used to protest social and political injustice around the globe, where hacktivists often rely on website defacement to spread their ideological messages to a wider audience (Maimon et al 2017;Fitri 2011). Although over one million websites were defaced in 2017 alone, the existing literature virtually ignores the correlates of victimization, focusing almost exclusively on the content of the defacements (Holt et al 2017;Zone-H 2018).…”

“…1 Although over one million websites are defaced each year (Zone-H 2018), only a few criminological studies exist that have studied website defacement as a form of cybercrime (i.e. Holt et al 2017;Holt et al 2019;Maimon et al 2017).…”

Forecasting cyberattacks with incomplete, imbalanced, and insignificant data

“…These are potential 'unconventional' signals that may collectively present sufficient predictive power to forecast cyberattacks. Some recent works (Okutan et al 2017b;Maimon et al 2017;Babko-Malaya et al 2017;Sapienza et al 2017;Okutan et al 2018) provide preliminary analysis for the relevance of unconventional signals to forecast cyberattacks. However, extracting these signals from continuously growing big data in a meaningful way requires special treatment (L'Heureux et al 2017;Al-Jarrah et al 2015).…”

Development of Models of Cyber Attacks in the Plane Enterprise Information Security

“…Деякі сигнали призначені для виявлення попередніх кроків у циклі кібератак, що не передбачає залучення фактичної мережевої інфраструктури [19]. Автори показали, що здатність прогнозування сигналів змінюється з часом залежно від типу атаки.…”

“…Автори показали, що здатність прогнозування сигналів змінюється з часом залежно від типу атаки. Крім того, визначення суттєвих відставань автоматизується для відповідних сигналів, щоб включити систему прогнозування, яка має бути адаптивною до різноманітних та змінних характеристик нетрадиційних сигналів [19].…”