Show simple item record

dc.contributor.authorCollier, Ben
dc.contributor.authorThomas, Daniel
dc.contributor.authorClayton, Richard
dc.contributor.authorHutchings, Alice
dc.date.accessioned2019-09-20T13:43:34Z
dc.date.available2019-09-20T13:43:34Z
dc.date.issued2019
dc.identifier.isbn9781450369480
dc.identifier.urihttps://www.repository.cam.ac.uk/handle/1810/297004
dc.description.abstractIllegal booter services offer denial of service (DoS) attacks for a fee of a few tens of dollars a month. Internationally, police have implemented a range of different types of intervention aimed at those using and offering booter services, including arrests and website takedown. In order to measure the impact of these interventions we look at the usage reports that booters themselves provide and at measurements of reflected UDP DoS attacks, leveraging a five year measurement dataset that has been statistically demonstrated to have very high coverage. We analysed time series data (using a negative binomial regression model) to show that several interventions have had a statistically significant impact on the number of attacks. We show that, while there is no consistent effect of highly-publicised court cases, takedowns of individual booters precede significant, but short-lived, reductions in recorded attack numbers. However, more wide-ranging disruptions have much longer effects. The closure of HackForums' booter market reduced attacks for 13 weeks globally (and for longer in particular countries) and the FBI's coordinated operation in December 2018, which involved both takedowns and arrests, reduced attacks by a third for at least 10 weeks and resulted in lasting change to the structure of the booter market.
dc.description.sponsorshipThis work was supported by the Engineering and Physical Sciences Research Council (EPSRC) [grant number EP/M020320/1].
dc.languageEnglish
dc.publisherACM
dc.rightsAll rights reserved
dc.subjectpolice interventions
dc.subjectdenial of service attacks
dc.subjectDDoS
dc.subjectUDP-reflection
dc.subjectbooter
dc.subjectstresser
dc.subjectcybercrime
dc.titleBooting the booters: Evaluating the effects of police interventions in the market for Denial-of-Service attacks
dc.typeConference Object
prism.publicationNameInternet Measurement Conference (IMC '19)
dc.identifier.doi10.17863/CAM.44045
dcterms.dateAccepted2019-07-18
rioxxterms.versionofrecord10.1145/3355369.3355592
rioxxterms.versionAM
rioxxterms.licenseref.urihttp://www.rioxx.net/licenses/all-rights-reserved
rioxxterms.licenseref.startdate2019-07-18
dc.contributor.orcidCollier, Benjamin [0000-0002-9207-3068]
dc.contributor.orcidThomas, Daniel [0000-0001-8936-0683]
dc.contributor.orcidClayton, Richard [0000-0002-1673-918X]
dc.contributor.orcidHutchings, Alice [0000-0003-3037-2684]
rioxxterms.typeConference Paper/Proceeding/Abstract
pubs.funder-project-idEngineering and Physical Sciences Research Council (EP/M020320/1)
cam.issuedOnline2019-10-21
pubs.conference-nameACM Internet Measurement Conference
pubs.conference-start-date2019-09-21
pubs.conference-finish-date2019-09-23


Files in this item

Thumbnail

This item appears in the following Collection(s)

Show simple item record