Repository logo
 

Booting the booters: Evaluating the effects of police interventions in the market for Denial-of-Service attacks

Accepted version
Peer-reviewed

Type

Conference Object

Change log

Abstract

Illegal booter services offer denial of service (DoS) attacks for a fee of a few tens of dollars a month. Internationally, police have implemented a range of different types of intervention aimed at those using and offering booter services, including arrests and website takedown. In order to measure the impact of these interventions we look at the usage reports that booters themselves provide and at measurements of reflected UDP DoS attacks, leveraging a five year measurement dataset that has been statistically demonstrated to have very high coverage. We analysed time series data (using a negative binomial regression model) to show that several interventions have had a statistically significant impact on the number of attacks. We show that, while there is no consistent effect of highly-publicised court cases, takedowns of individual booters precede significant, but short-lived, reductions in recorded attack numbers. However, more wide-ranging disruptions have much longer effects. The closure of HackForums' booter market reduced attacks for 13 weeks globally (and for longer in particular countries) and the FBI's coordinated operation in December 2018, which involved both takedowns and arrests, reduced attacks by a third for at least 10 weeks and resulted in lasting change to the structure of the booter market.

Description

Keywords

police interventions, denial of service attacks, DDoS, UDP-reflection, booter, stresser, cybercrime

Journal Title

Internet Measurement Conference (IMC '19)

Conference Name

ACM Internet Measurement Conference

Journal ISSN

Volume Title

Publisher

ACM

Rights

All rights reserved
Sponsorship
Engineering and Physical Sciences Research Council (EP/M020320/1)
This work was supported by the Engineering and Physical Sciences Research Council (EPSRC) [grant number EP/M020320/1].