The Work-Averse Cyberattacker Model: Theory and Evidence from Two Million Attack Signatures.

Area of Science:

• Cybersecurity
• Information Security
• Computer Science

Background:

• Current cyber risk management assumes attackers exploit all vulnerabilities.
• This assumption influences security investments and practices.
• A new attacker model is needed to reflect realistic attacker behavior.

Purpose of the Study:

• To propose a novel attacker model based on dynamic optimization.
• To investigate how initial exploit development costs influence attacker decisions.
• To provide a more accurate understanding of mass attacker strategies.

Main Methods:

• Developed a theoretical model using dynamic optimization principles.
• Analyzed the impact of large, initial, fixed costs for exploit development.
• Empirically validated model predictions using a large dataset of mass cyberattacks.

Main Results:

• Attackers prefer to exploit only one vulnerability per software version due to costs.
• Mass attackers tend to target vulnerabilities with low complexity.
• There is a delay in weaponizing newly discovered vulnerabilities.

Conclusions:

• Findings challenge the assumption of attackers exploiting all vulnerabilities.
• Cyber risk managers can better focus vulnerability management efforts.
• Establishes a new theoretical and empirical basis for studying attacker processes.