Cybercrime such as ransomware denies access to valuable data until a ransom is paid. Recent ransomware attacks on organizations such as hospitals, schools, government agencies and private businesses raise public awareness of the severe impact on the society. In this paper, we propose a hypothetical new revenue model for the ransomware, i.e., selling the stolen data. Through a game-theoretical analysis between attackers and victims, we contribute a novel model to understand the critical decision variables between the traditional ransomware (ransomware 1.0) - demanding ransom only and the new type of ransomware (ransomware 2.0) - selling the data as well as demanding ransom. Both theoretical modeling and simulation studies suggest that in general ransomware 2.0 is more profitable than ransomware 1.0. Common defensive measures that may work to eliminate the financial incentives of ransomware 1.0 may not work on ransomware 2.0, in particular the data backup practice and the never-pay-ransom strategy. Nevertheless, the uncertainties created by this new revenue model may affect attackers' reputation and users' willingness-to-pay. In turn, ransomware 2.0 may not always increase the profitability of attackers. Another finding of the study suggests that reputation maximization is critical in ransomware 1.0 but not in ransomware 2.0, where attackers should seek imperfect reputation for profit maximization.

Zero-day vulnerabilities pose significant threats in computer and network security, and have attracted attentions in recent years not only to malicious attackers but government and law enforcement users who need to control (e.g., for forensics purpose) the computer systems which otherwise are inaccessible through traditional channels. Based on the observation that vulnerabilities are acquired and traded in a different way than commodities, we study and propose a vulnerability market model by taking into consideration cheating and uncertainty in the market. The paper illustrates the interactions between the vulnerability sellers and buyers in a game theoretic framework. By modeling the economic aspects of the vulnerability market with a focus on information asymmetry and distinctive incentives of malicious and defensive buyers, we propose active and strategic market participation by defenders to obtain vulnerability information from the marketplace in a cost-effective way. Rather than killing the market, defenders can take advantage of the incomplete information feature of the vulnerability market to improve cyber-security. To further maximize the uncertainty, defenders may also play in the supply side of the vulnerability market to provide low or no value vulnerabilities to dilute the market.

Internet Service Providers (ISPs) face increasing bandwidth pressure from rising access demand by users, especially P2P and VoD applications. Traditionally, P2P has been viewed as tremendously negative from the perspective of the ISP. In this paper, we question this assumption and study the impact of P2P applications on the effective ISP functionality. We perform an economic analysis to show that a higher P2P penetration rate does not necessarily lead to increased ISP bottleneck link bandwidth pressure. Our results show that the local serving rate is critical for the sustainability of the ISP business model as well as for the benefit of P2P users.

Abstract Firewalls are among the most important components in network security. Traditionally, the rules of the firewall are kept private under the assumption that privacy of the ruleset makes attacks on the network more difficult. We posit that this assumption is no longer valid in the Internet of today due to two factors: the emergence of botnets reducing probing difficulty and second, the emergence of distributed applications where private rules increase the difficulty of troubleshooting. We argue that the enforcement of the policy is the key, not the secrecy of the policy itself. In this paper, we demonstrate through the application of game theory thatpublicfirewall rules when coupled with false information (lying) are actually better than keeping firewall rules private, especially when taken in the larger group context of the Internet. Interesting scenarios arise when honest, public firewalls are socially insured by other lying firewalls and networks adopting public firewalls become mutually beneficial to each other. The equilibrium under multiple‐network game is socially optimal because the percentage of required lying firewalls in social optimum is much smaller than the percentage in single‐network equilibrium and the chance of attacking through firewalls is further reduced to zero. Copyright © 2011 John Wiley & Sons, Ltd.

Abstract Botnets have become an increasing security concern in today's Internet. Since current technological defenses against botnets have failed to produce results, it has become necessary to think about different strategies. Given that money is perhaps the single determining force driving the growth in botnet attacks, we propose an interesting economic approach to take away the root cause of botnet, i.e., the financial incentives. In this paper, we model botnet‐related cyber crimes as a result of profit‐maximizing decision‐making optimization problem from the perspective of botmasters. By introducing theuncertaintylevel created by thevirtual bots, we make determining the optimal botnet size infeasible for the botnet operators, and consequently the botnet profitability can fall dramatically. The theoretical model presented here has a large potential to fight off botnet‐related attacks of varying revenue patterns. Copyright © 2010 John Wiley & Sons, Ltd.