Booting the booters: Evaluating the effects of police interventions in the market for denial-of-service attacks

Ben Collier, Daniel Thomas, Richard Clayton, Alice Hutchings

Research output: Chapter in Book/Report/Conference proceedingConference contribution

Abstract

Illegal booter services offer denial of service (DoS) attacks for a fee of a few tens of dollars a month. Internationally, police have implemented a range of different types of intervention aimed at those using and offering booter services, including arrests and website takedown. In order to measure the impact of these interventions we look at the usage reports that booters themselves provide and at measurements of reflected UDP DoS attacks, leveraging a five year measurement dataset that has been statistically demonstrated to have very high coverage. We analysed time series data (using a negative binomial regression model) to show that several interventions have had a statistically significant impact on the number of attacks. We show that, while there is no consistent effect of highly-publicised court cases, takedowns of individual booters precede significant, but short-lived, reductions in recorded attack numbers. However, more wide-ranging disruptions have much longer effects. The closure of HackForums' booter market reduced attacks for 13 weeks globally (and for longer in particular countries) and the FBI's coordinated operation in December 2018, which involved both takedowns and arrests, reduced attacks by a third for at least 10 weeks and resulted in lasting change to the structure of the booter market.
Original languageEnglish
Title of host publicationIMC '19
Subtitle of host publicationProceedings of the Internet Measurement Conference
Place of PublicationNew York
PublisherAssociation for Computing Machinery (ACM)
Pages50-64
ISBN (Print)9781450369480
DOIs
Publication statusPublished - 31 Oct 2019
EventACM Internet Measurement Conference 2019 - Amsterdam
Duration: 21 Oct 201923 Oct 2019
https://conferences.sigcomm.org/imc/2019/

Publication series

NameProceedings of the ACM Internet Measurement Conference
Publisher Association for Computing Machinery (ACM)

Conference

ConferenceACM Internet Measurement Conference 2019
CityAmsterdam
Period21/10/1923/10/19
Internet address

Keywords

  • cybercrime
  • police interventions
  • denial of service attacks
  • DDoS
  • UPD-reflection
  • booter
  • stressor

Fingerprint

Dive into the research topics of 'Booting the booters: Evaluating the effects of police interventions in the market for denial-of-service attacks'. Together they form a unique fingerprint.

Cite this