Accounting for Variation in Spam Effectivness

Cybercrime today is a profit-driven enterprise. Viewing computer security through the lens of business incentives in this way helps guide the efforts of policy-makers and researchers, since the effectiveness of countermeasures is directly related to their effect on cybercriminals’ profit motives, the root causes of cybercrime. In this respect, understanding the structure of the cybercrime marketplace is a crucial task for the security community. Recent work provides some insight into different aspects of this so-called “underground economy”, such as PPI pricing factors [1], as well as the supply [2] and demand [3, 4] for spam. One striking finding from this line of work is that the value placed on various resources used in cybercrime – e.g. infected zombie machines or spam targets – appears to vary by the level of economic development of the country where the resource is located. For example, PPI prices cited in [?] indicate that the price of a bot machine in the United States costs 1-2 orders of magnitude more than a bot located in “Asia”1. Understanding what drives this variation is vital to understanding the cybercrime underground economy. Variation in pricing could be due to supply-side factors, such as increased availability, or it could be due to demand-side factors, such as targets in certain locations being more lucrative; the final market price of a resource is driven by both. Untangling the significance of supply-side and demand-side factors from this market price is a fundamentally challenging problem without access to cybercriminals’ accounting information. Unable to directly measure the influence of each of these factors, the research community has turned to an indirect approach to this problem. For example, price variation in PPI prices driven by supply-side factors can be corrolated with the density of vulnerable computers in a given geographic region. In this paper, we attempt to use this indirect measurement approach to analyze one facet of cybercrime: spam.