[Paper Review] Analysis of Increasing Malwares and Cyber Crimes Using Economic Approach

Umer Asgher, Fahad Moazzam Dar+2 more|arXiv (Cornell University)|Jan 21, 2014

Cybercrime and Law Enforcement Studies6 references3 citations

TL;DR

This paper applies an economic framework to analyze the growing malware and cybercrime ecosystem, examining underground markets for malware and stolen data. By studying web forums and transaction behaviors, it reveals how cybercrime functions as a profit-driven industry, offering insights into the incentives, structures, and operational dynamics that sustain malicious activities—valuable for law enforcement and cybersecurity professionals.

ABSTRACT

The economics of an internet crime has newly developed into a field of controlling black money. This economic approach not only provides estimated technique of analyzing internet crimes but also gives details to analyzers of system dependability and divergence. This paper will highlight on the subject of online crime, which has formed its industry since. It all started from amateur hackers who cracked websites and wrote malicious software in pursuit of fun or achieving limited objectives to professional hacking. In the past days, electronic fraud was main objective but now it has been changed into electronic hacking. This study focuses the issue through an economic analysis of available web forum to deals in malware and private information. The findings of this survey research provide considerable in-depth sight into the functions of malware economy spinning around computer impositions and compromise. In this regard, the survey research paper may benefit particularly computer security officials, the law enforcement agencies, and in general prospective anyone involved in better understanding cybercrime from the offender standpoint.

Motivation & Objective

• To understand the evolution of cybercrime from amateur hacking to a professionalized, profit-driven industry.
• To examine the economic mechanisms driving the trade of malware and stolen personal information in online forums.
• To provide security and law enforcement officials with insights into the offender's perspective for improved threat mitigation.
• To quantify and model the operational economy of cybercrime, including supply, demand, and transaction behaviors.
• To highlight the systemic dependencies and vulnerabilities in digital systems that enable sustained cybercriminal activity.

Proposed method

• Conducted a survey-based analysis of online forums where malware and stolen data are traded.
• Mapped the structure of cybercrime markets by identifying key actors, transaction types, and pricing mechanisms.
• Applied economic principles such as supply and demand, cost-benefit analysis, and market equilibrium to cybercrime activities.
• Collected and analyzed data on pricing trends, service offerings (e.g., DDoS, ransomware), and buyer-seller interactions.
• Used qualitative and quantitative data from real cybercrime marketplaces to model the economic behavior of threat actors.
• Evaluated the sustainability and scalability of cybercrime operations through economic modeling of incentives and risks.

Experimental results

Research questions

• RQ1 How has cybercrime evolved from amateur activities into a structured, profit-driven industry?
• RQ2 What are the key economic drivers behind the production and distribution of malware and stolen data?
• RQ3 How do pricing and transaction mechanisms function in underground cybercrime markets?
• RQ4 What role do specialized services (e.g., DDoS, ransomware) play in the economic ecosystem of cybercrime?
• RQ5 How can economic modeling improve understanding and response strategies for cyber threats?

Key findings

• Cybercrime has transitioned from individual, non-monetary attacks to a formalized market economy with specialized roles and services.
• Malware and stolen data are traded at predictable price points based on quality, demand, and risk, indicating a mature underground economy.
• The availability of ready-made tools and services (e.g., DDoS-for-hire) lowers the barrier to entry, enabling non-technical actors to engage in cybercrime.
• There is a clear division of labor among cybercriminals, with distinct roles for developers, distributors, and money launderers, mirroring legitimate business models.
• The economic model reveals that cybercriminals optimize for profit and risk reduction, suggesting that financial disincentives could disrupt operations.
• The study confirms that cybercrime markets operate with market-like behaviors, including reputation systems and quality control, despite their illegal nature.