The Evolution of Cyberattack Motives

Sirapat Boonkrong, Kaewrattana Prompunjai, Suwitchayagon Watcharawongbodee, Supisara Chueachantuek

Abstract


A cyberattack can be defined as an action aiming to cause damages and losses to computer networks, information systems, and even personal devices and data. Many professionals and organizations have put a lot of effort and resources into preventing cyberattacks based on how they occur, their targets, and what damages they can cause. However, one of the aspects that are often overlooked and one of the reasons that cyberattacks are successfully carried out is the fact that the nature of attackers' motivations is not fully understood. Therefore, this research examines the main reasons for cyberattacks to be carried out by adversaries and the motives behind cyberattacks. Specifically, we studied over 7,700 cyber records and events between 2006 and 2018, including data breaches, privacy violations, and cyber incidents, to learn how attack motives have evolved over the years. The analyses of the data were mainly carried out using descriptive analysis. Our study found that the early cyberattacks were mainly financially motivated. However, in the later years, the cyberattack motives included espionage, ideology, and skill and knowledge testing. This implies that the motives behind cyberattacks became more varied in terms of types, proportions, and correlations between them. It is hoped and expected that the results of the analyses will be helpful to various stakeholders in such a way that they will better understand the reasons and motivations for cyberattacks.

Keywords


Attack motive; cyberattack; cybersecurity; evolution.

Full Text:

PDF

References


S. Boonkrong, Authentication and Access Control: Practical

Cryptography Methods and Tools, Apress, 2021.

National Institute of Standards and Technology, "Security

Requirements for Cryptographic Modules," National Institute of Standards and Technology, Washington, D.C., 2001.

International Organization for Standardization, "ISO/IEC 27000:2018 Information technology - Security techniques - Information security management systems," International Organization for Standardization, Vernier, Geneva, Switzerland, 2018.

R. Mei, H. B. Yan and Z. H. Han, "RansomLens: Understanding Ransomware via Causality Analysis on System Provenance Graph," Lecture Notes in CompSci, SceSec2021, 13 - 5 Aug 2021.

L. Huang and Q. Zhu, "Duplicity Games for Deception Design with an Application to Insider Threat Mitigation," IEEE Trans. Inf. Forensics Secur., vol. 16, pp. 4843 - 4856, 2021.

R. Chen, D. J. Kim and R. H. Rao, "A study of social networking site use from a three-pronged security and privacy threat assessment perspective," Inf. Mang., vol. 58, no. 5, July 2021.

A.Altalbe and F. Kateb, "Assuring enhanced privacy violation detection model for social networks," Int. J. Intell. Comput., vol.15, no. 1, pp. 75 - 91, 2022.

M. Mahapatra, N. Gupta and R. Kushwaha, "Data Breach in Social Networks Using Machine Learning," Commun. Comput. Inf. Sci., IACC 2021, 18 - 19 December 2021.

Y. Li and Q. Liu, "A comprehensive review study of cyber-attacks and cyber security; Emerging trends and recent developments," Energy Rep., vol. 7, pp. 8176-8186, September 2021.

T. Oyinloye, T. Eze and L. Speakman, "Towards Cyber-User Awareness: Design and Evaluation," in Proc. of Eur. Conf. Inf. Warf. Secur., Reading, UK, 2020.

H. Hamam and D. Abdelouahid, "An OWASP top ten driven survey on web application protection methods," LNCS, pp. 235-252, 2021.

N. K. Singh, P. Gupta, V. Singh and R. Ranjan, "Attacks on Vulnerable Web Applications," CONIT 2021, 25 - 27 June 2021.

T. J. Holt and S. v. d. Weijer, "An Examination of Motivation and Routine Activity Theory to Account for Cyberattacks Against Dutch Web Sites," Crim Justice Behav, vol. 47, no. 4, pp. 487-505, January 2020.

J.W. Welburn and A.M. Strong, "Systemic Cyber Risk and Aggregate Impacts", Risk Anal., In Press, 2021.

R. Gandhi, A. Sharma, W. Mahoney, W. Sousan, Q. Zhu and P. Laplante, "Dimensions of cyber-attacks: Cultural, social, economic, and political," IEEE Technol. Soc. Mag., vol. 30, no. 1, pp. 28-38, Spring 2011.

S.K. Srivastava, S. Das, G.J. Udo and K. Bagchi, "Determinants of Cybercrime Originating within a Nation: A Cross-country Study,"

J. Glob. Inf. Technol., vol. 23, no. 2, pp. 112 - 137, April 2020.

M. Uma and G. Padmavathi, "A Survey on Various Cyber Attacks and their Classification," International Journal of Network Security, vol. 15, no. 5, pp. 390-396, 2013.

S.S. Bhuyan, U.Y. Kabir, J.M. Escareno, K. Ector, S. Palakodeti, D. Wyant, S. Kumar, M. Levy, S. Kedia, D. Dasgupta and A. Dobolian, "Transforming Healthcare Cybersecurity from Reactive to Proactive: Current Status and Future Recommendations," J. Med. Syst., vol. 44, no. 5, May 2020.

V.-L. Nguyen, P.-C. Lin and R.-H. Hwang, "Web attacks: defeating monetisation attempts," Netw. Secur., vol. 2019, no. 5, pp. 11-19, May 2019.

A. Jawad and J. Jaskolka, "Modeling and Simulation Approaches for Cybersecurity Impact Analysis: State-of-the-Art," in Proc of ANNSIM 2021, Virtual Fairfax, 19-22 July 2021.

M. Maasberg, X. Zhang, M. Ko, S. R. Miller and N. L. Beebe, "An Analysis of Motive and Observable Behavioral Indicators Associated With Insider Cyber-Sabotage and Other Attacks," IEEE Eng. Manag. Rev., vol. 48, no. 2, pp. 151-165, June 2020.

M. J. Pappaterra, F. Flammini, V. Vittorini and N. Besinovic, "A Systematic Review of Artificial Intelligence Public Datasets for Railway Applications," Infrastructures, vol. 6, no. 10, pp. 1-28, October 2021.

P. Silva, C. Macas, E. Polisciuc and P. Machado, "Visualisation Tool to Support Fraud Detection," in Proc. of IV, Sydney, 5-9 July 2021.

F. Fong, Z. Qin, L. Xue, J. Zhang, X. Lin and X. Shen, "Privacy-Preserving Keyword Similarity Search over Encrypted Spatial Data in Cloud Computing," IEEE Internet Things J., in Press, 2021.

J. Lu, "Data Analytics Research-Informed Teaching in a Digital Technologies Curriculum," ITE, vol. 20, no. 2, pp. 57-72, 2020.

Barclays, "IoD Policy Report - Cyber Security Underpinning the Digital Economy," Barclays, London, UK, 2016.

J. Franco, A. Aris, B. Canberk and A.S. Uluagac, "A Survey of Honeypots and Honeynets for Internet of Things, Industrial Internet of Things, and Cyber-Physical Systems," IEEE Commun. Surv. Tutor., vol. 23, no. 4, pp. 2351-2383, 2021.

R. Aggarwal and P. Ranganathan, "Common pitfalls in statistical analysis: The use of correlation techniques," Perspect Clin Res., vol. 7, no. 4, p. 187, October - December 2016.

N. Saxena, E. Hayes, E. Bertino, P. Ojo, K.-K. R. Choo and P. Burnap, "Impact and Key Challenges of Insider Threats on Organizations and Critical Businesses," Elec., vol. 9, no. 9, pp. 1-29, 2020.

P. Chapman, "Defending against insider threats with network security's eighth layer," Comput. Fraud Secur., vol. 2021, no. 3, pp. 8 - 13, March 2021.




DOI: http://dx.doi.org/10.18517/ijaseit.12.5.16431

Refbacks

  • There are currently no refbacks.


Published by INSIGHT - Indonesian Society for Knowledge and Human Development