A Small World of Bad Guys: Investigating the Behavior of Hacker Groups in Cyber-Attacks

TL;DR

This paper uses Social Network Analysis to empirically investigate the structure and behavior of hacker groups, revealing a small world network phenomenon that facilitates their coordinated cyber-attacks.

Contribution

It provides the first empirical analysis of hacker group networks, demonstrating their small world properties and interconnectedness in cyber-attack coordination.

Findings

Hacker groups form close-knit, cooperative networks.

The networks exhibit small world characteristics.

Interconnectedness facilitates efficient attack coordination.

Abstract

This paper explores the behaviour of malicious hacker groups operating in cyberspace and how they organize themselves in structured networks. To better understand these groups, the paper uses Social Network Analysis (SNA) to analyse the interactions and relationships among several malicious hacker groups. The study uses a tested dataset as its primary source, providing an empirical analysis of the cooperative behaviours exhibited by these groups. The study found that malicious hacker groups tend to form close-knit networks where they consult, coordinate with, and assist each other in carrying out their attacks. The study also identified a "small world" phenomenon within the population of malicious actors, which suggests that these groups establish interconnected relationships to facilitate their malicious operations. The small world phenomenon indicates that the actor-groups are densely connected, but they also have a small number of connections to other groups, allowing for efficient communication and coordination of their activities.