# A Small World of Bad Guys: Investigating the Behavior of Hacker Groups in
Cyber-Attacks

Giampiero Giacomello1 Corresponding Author Antonio Iovanella2 Luigi Martino1

###### Abstract

This paper explores the behaviour of malicious hacker groups operating in
cyberspace and how they organize themselves in structured networks. To better
understand these groups, the paper uses Social Network Analysis (SNA) to
analyse the interactions and relationships among several malicious hacker
groups. The study uses a tested dataset as its primary source, providing an
empirical analysis of the cooperative behaviours exhibited by these groups.
The study found that malicious hacker groups tend to form close-knit networks
where they consult, coordinate with, and assist each other in carrying out
their attacks. The study also identified a ”small world” phenomenon within the
population of malicious actors, which suggests that these groups establish
interconnected relationships to facilitate their malicious operations. The
small world phenomenon indicates that the actor-groups are densely connected,
but they also have a small number of connections to other groups, allowing for
efficient communication and coordination of their activities.

Keywords: Cyberattacks; cybersecurity; hacker groups; black-hat hackers;
hackers’ behavior; network analysis; Advanced Persistent Threats (APT).

1 Department of Political and Social Sciences
University of Bologna
Strada Maggiore 45 - Bologna, Italy.
<EMAIL_ADDRESS>
ORCID: 0000-0002-7053-9752
<EMAIL_ADDRESS>
2 Department of International Humanistic and Social Sciences
Università degli Studi Internazionali di Roma - UNINT
Via Cristoforo Colombo, 200 - 00147, Rome, Italy.
<EMAIL_ADDRESS>
ORCID: 0000-0001-8147-3747

##  1 Introduction

In popular culture, movies, and fiction, ‘bad guys’ are often portrayed as
loners, or, at most, tightknit groups of a few individuals, who distrust and
avoid outsiders and strangers. Such tight communities of ‘bad guys’ are indeed
‘small worlds’. The concept of a small world is based on the well-known idea
of ‘six degrees of separation’ that emerged from an experiment performed by
the psychologist Stanley Milgram in the 1960s, and which states that the
social distance between any two individuals is quite small [41].

Given obvious organizational and behavioral differences, are isolationist/no-
cooperation tendencies of organized crime families and terrorist groups also
present in malicious hacker groups (i.e., black-hat hackers), who may work for
criminal organizations or sovereign governments? Because of their trade (that
is, stealing, spying, or worse), do black-hat hackers stay away from others,
keep themselves isolated or not? Even in the ‘common’ space, namely
cyberspace, do they keep to themselves, or do they reach out to other ‘bad
guys’?

Throughout the development of computing, collaboration and rivalry have been
key characteristics of hardware and software developers and innovators, who
are highly competitive but also eager to demonstrate their expertise by
assisting others in achieving similar success (e.g. [26, 30]). This demeanor,
however, is also explained by the fact that pushing the boundaries of machines
and software often leads to apparently insurmountable problems, from which the
only escape seems to be to ‘ask around’, via specialized chats and Web sites
(such as StackOverflow). Furthermore, informal information-sharing is often
the recommended solution for a multitude of information technology (IT)
problems (e.g. [17]). It is this “tribal culture” widely share, hence? [54].
Indeed, the literature review in the next section shows that hackers, in
general, value helping and sharing with their peers.

It is also entirely plausible that the same behavior and tendencies are
displayed by ‘bad guys’ for the above-mentioned reasons, thus replicating a
‘tribe’, or the enclaves of a ‘small world’. It is also likely that malicious
hackers111The correct term would be “crackers”, as hackers are also those who
work to improve networking or software., whether operating independently or in
the pay of organized crime or sovereign governments [40], retain their
penchant for ‘showing off’ or ‘asking for help’, and overall share their
knowledge and expertise, especially with those that they see as fellow ‘bad
guys’ (or on the ‘same side’).

The cyber-attack environment is a highly complex and dynamic system that is
generally influenced by a large number of variables and evolutionary paths,
for example, the interactions between actor-groups (individual agents) and
their social structures. Thus, such actor-groups are driven to their final
outcomes by the unpredictable patterns that have emerged from these
interactions [2].

These characteristics of hacker groups make them socially complex systems.
Hence, investigating their dynamics through the lens of network science is a
valuable and still underexplored research approach [55, 60].

Network science is an interdisciplinary branch of research which aims to
comprehend the structure, growth, and dynamic of networks by using different
methods and tools from a variety of disciplines, including computer science,
physics, mathematics, and statistics [10]. Since it correlates form with
function and structure with behavior, it can be seen as an abstraction of
observable reality that explains how real systems behave [12, 35].

From these perspectives, the paper poses the following research questions. Do
actor-groups (in the dataset) interact with each other (i.e., do they show
links)? If so, do most of them substantially cooperate (i.e. show a high
degree of interactions) or only a handful of them? Are the most dangerous
actor-groups (i.e., those that attack most industries and most of the time)
those with a high degree of network centrality, or is the contrary the case?

This study analyses the various ways in which network science and social
network analysis [5, 46, 51] are applied to cyberspace. We specifically draw
attention to the potential advantages of network science-enabled analysis, and
we encourage discussions of the potential future implications and challenges
associated with cyberspace environments.

This study analyzes the collective behavior of hacker groups while taking data
from an official framework into consideration. In this it differs from the
previous literature [11], which is often focused on identifying the most
active players [18] or communities of hackers in a certain cyberspace [28,
38]. This study also tries to shed light on the applications and potential
impacts – in terms of efficiency and effectiveness – of network analysis in
cyberspace. By highlighting potential benefits and identifying the
difficulties and dangers of such an approach, the goal is to pave the way for
further investigation in this area.

Relying on small-world theory, a review of the existing literature on hackers’
behavior, and a dataset on cyberattacks assembled by a highly-respected
research institution, this paper shows not only that some black-hat hacker
groups tend to attack the same types of targets, but also that they probably
cooperate with each other in this endeavor and end up establishing a ‘small
world of bad guys’. The choice of common targets, as well as the sharing of a
common hackers’ culture, with its ‘rites’ and established behaviors, probably
explain the patterns emerging from the analysis of the dataset in this paper.

Given the data currently available, it would be rather difficult to reach
plausible definitive conclusions. Hence, this paper is more a preliminary
inquiry than a definitive study. It is nonetheless crucial to start mapping
the boundaries of these malicious actor-groups cooperation. More importantly,
this paper aims to provide better evidence for the literature on hackers’
behaviors (in our case black-hat ones), which thus far has prevalently relied
on anecdotal evidence or interviews.

The paper is organized as follows. Section 2 introduces the context and the
current literature; Section 3 discusses the conceptual framework and the
methods; Section 4 reports empirical evidence from the network analysis
applied to explore issues of cyberspace. Finally, Section 5 concludes the
paper and discusses the practical contributions of this study, as well as
acknowledging its possible limitations and considering further developments.

##  2 Context and Literature Review

This section of the paper contains a review of the literature on the behavior
of hacker groups, as well as that of government-affiliated, malicious
attackers. It considers, in particular, the behavior consolidated in the form
of ‘Advanced Persistent Threats’ (APT). Some of the main elements of hackers’
‘culture’, namely “technology, secrecy, anonymity, membership fluidity, male
dominance and motivations”, were identified quite early on [31], and most of
such features have been confirmed by publications outside the field of
sociology [25, 26].

In addition to the above features, the majority literature on hackers’
behavior in general confirms a tendency to ask for advice and/or share views
and tricks with ‘respected peers’ in various hacker communities [3, 8, 54].
The specific literature on malicious groups is not extensive, given the well-
known problems of collecting data and evidence on such subjects [32, 33].
Nonetheless, black-hats and white-hats (‘ethical’ hackers) follow similar
learning paths, so that it is completely reasonable to ‘extend’ the
conclusions of the current literature on general attitudes and tendencies to
malicious hacker groups as well.

Of all the black-hat hacker groups, APTs are among the major threats to
cybersecurity, and they have been responsible for some of the highest-profile
cyberattacks in recent years. This literature review aims to provide an
overview of existing APT research and to identify possible gaps in the
literature that may be addressed by future research. We identify different
schools of thought on APTs, focusing, in particular, on the technical aspects
of graph theory and international relations or security studies. As regards
methodology, this literature review was conducted using a systematic search
strategy which involved searching multiple databases of peer-reviewed
articles, reports, and other sources of APT information. The search terms used
included ‘advanced persistent threats’, ‘APT attacks’, ‘cyber espionage’, and
‘APT mitigation strategies’.

The literature on APTs is extensive, and it can be classified into different
schools of thought. A first school of thought focuses on the technical aspects
of APTs, including the tools and techniques used by attackers to gain access
to target systems. Notable works in this area include Mandiant’s APT1 first
report [39], which describes the activities of a Chinese hacking group. The
report revealed that the group had been responsible for a massive cyber
espionage campaign against the United States and other countries. It also
provided details on the group’s tactics, techniques, and procedures, as well
as its infrastructure and tools. Other important works on APTs are the MITRE
ATT&CK framework [43], which provides a comprehensive overview of the APT
tactics, techniques, and procedures, and “The APT Paradigm: A Framework for
Analysing and Predicting Advanced Persistent Threats” in [49] and [53]. The
latter proposes a framework for APT analysis and prediction based on the
phases of the attack life cycle, from the initial reconnaissance, to data
exfiltration, and it identifies a number of technical, organizational, and
human factors enabling APTs to succeed.

A second school of thought focuses on the organizational and strategic aspects
of APTs, including the motivations and goals of the attackers, as well as the
ways in which they infiltrate target organizations or exfiltrate vital
information. Relevant authors in this area include [14], who argue that APTs
are a new form of war which represents a serious threat to national security,
and [1], who claims that APTs are motivated by economic espionage and the
theft of intellectual property.

A third school of thought focuses on the human aspects of APTs, including the
role of insiders and the importance of social engineering to gain access to
target systems. One of the main authors in this area is [15], who argues that
the human element is often the weakest link in the security chain, and Mitnick
[42], who provides a detailed account of his experiences as a hacker and
social engineer.

Although each of these schools of thought has furnished valuable insights,
further interdisciplinary research considering all these perspectives is
needed, as highlighted in this study. Indeed, despite the above-mentioned
extensive literature on APTs, there are several gaps in existing research. One
of the main gaps is the lack of empirical research on the effectiveness of the
different strategies employed to detect and mitigate APTs. Although there are
several theoretical works on this topic (e.g. [31]), little empirical evidence
has been provided to support the theory. Other gaps are the lack of research
on the psychological and sociological factors influencing the behaviour of
attackers and defenders in the context of APTs, as well as the geopolitical
implications of APTs and the relation between APTs and global security.

Finally, also needed is further research on the impact of APTs on different
sectors and industries, and on how organizations can best prepare for such
attacks. One of the main findings of the review is that APTs are highly
sophisticated and targeted attacks, typically involving a range of different
tactics and techniques. These may include social engineering, spear-phishing,
malware, and command and control infrastructure. APTs are often designed to
evade detection by security systems. They may involve long-term surveillance
and reconnaissance of the organization or individual targeted, and they can
have an impact on international relations [34].

According to scholars that study the impacts on international relations of
APTs, the main concern is to understand the motivations and objectives of APT
attackers and to analyse the impact of APTs at geopolitical level. For
example, [14] argued that APTs are a new form of war that poses a serious
threat to national security. Similarly, Lin and colleagues analysed the impact
of APTs on US-China diplomatic relations. Other studies have focused on the
political and economic motivations behind APT attacks [27].

Another important approach to the study of APTs is based on graph theory.
Researchers in this field try to model relationships between different
entities in a network, including attackers, victims, and the associated
infrastructure. There are recent studies that are focused on the relevance of
graph theory on APT detection, who proposed a method to identify key actors in
a network on the basis of their centrality and influence [48]. Other studies
have focused on the use of social network analysis to identify patterns of
behaviors among APT attackers [6]. Graph theory can be applied to the study of
APTs in different ways, especially in relation to network analysis that
conducts ‘Anomaly Detection’ to detect anomalies in network traffic, such as
the presence of unusual activity patterns or new nodes in the network, in
order to identify potential APT attacks before they become fully operational.
At the same time, graph theory can be applied to conduct attribution analysis
which seeks to identify the relationships between APT attacks and their
sources, including the use of common infrastructure, malware, or tactics. In
this way it is possible to identify the likely source of APT attacks, as well
as to attribute responsibility to specific actors or organizations.

While each of these schools of thought provides valuable insight into the
nature of APTs, further research integrating the different approaches is
needed. For example, graph theory can be used to model relationships between
different entities involved in APT attacks, while technical analysis can be
used to identify specific tools and techniques used by attackers. The
international relations analytical framework can be used to provide the
context of the motivations and objectives of APT attackers and to analyze the
impact of these attacks on international relations [19, 36].

Overall, the combination of graph theory and international relations theory
can provide a powerful framework within which to analyze complex international
networks, including those involved in APT attacks. In other words, by using
the multidisciplinary approach based on the combination of network analysis
and international relations, analysts can better understand the dynamics of
power, influence and cooperation within these networks, and develop defense
and deterrence strategies.

According to the literature review, APTs represent a significant threat to
organizations and individuals and they require a proactive and multifaceted
approach to their mitigation. One of the main challenges for APT mitigation is
the difficulty of detecting and responding to the attacks. APTs can be
executed for a period of months or even years and may involve multiple steps
and techniques. Effective mitigation strategies for APTs may involve the
combination of technical measures (such as intrusion detection and prevention
systems, network segmentation, and endpoint protection) and organizational
measures (such as employee education and training, incident response planning,
and supply chain management) [34].

The increasing sophistication and complexity of APTs suggests that these
attacks are likely to continue and evolve in the coming years, making it
essential for organizations to keep up to date with the latest developments
and best practices in APT mitigation. However, there is a lack of empirical
research on the effectiveness of different strategies with which to detect and
mitigate APT attacks. Although some studies have proposed machine learning and
artificial intelligence approaches to detect ATPs, as shown in this paper,
further research is needed to assess the effectiveness of these approaches in
real-world contexts. Another caveat provided by the literature review is the
need for further research into the attribution of APT attacks. Although there
have been high-profile cases where APT attacks have been attributed to
specific actors, such as the Chinese hacking group known as APT10 [20], the
attribution process is often difficult and controversial. Future research
should explore new methods for attributing APT attacks, such as the use of
digital forensics and blockchain technologies, or the interaction between
graph theory and geopolitical or security studies.

##  3 Conceptual Framework and Methodology

The conceptual framework introduced in this paper is rooted in network
science, which is “an attempt to understand networks emerging in nature,
technology and society using a unified set of tools and principles. Despite
apparent differences, many networks emerge and evolve, driven by a fundamental
set of laws and mechanisms” [4].

The mathematical description of networks is found in graph theory [58]. A
graph $G=(V,E)$ is composed of a set $V$ of $n$ nodes, which represent the
elements of the system, and a set $E$ of $m$ links that define the
interactions between nodes. We refer to a node by an index $i$, meaning that
we allow a one-to-one correspondence between an index and a node.

The graph representation allows for the calculation of several measures that
reveal the network’s characteristics. Table 1 provides a short glossary of
network measures and their relative meanings, taking advantage of a number of
different contributions in the literature such as, for instance, [5], [21],
[41], [46], [47] and [50] and other references therein.

Measure |  Definition |  Meaning
---|---|---
Density ($d$) |  Portion of connections in the set $E$ compared to the maximum possible number of links between nodes in set $V$. |  Denotes how the communication paths in the system are able to transmit information to the members.
Diameter ($D$) |  Length of the shortest path between the most distanced nodes. |  Shows the ability of any two nodes to communicate with each other.
Average shortest path ($L$) |  The mean of all the shortest paths between all couples of nodes. |  Relates to the possibility of linking any two nodes in the network through few links.
Assortativity ($r$) |  Node-node degree correlation. |  If a network has disassortative mixing, the knowledge flow reaches peripheral nodes straightforwardly.
Average clustering coefficient ($C$) |  The average of the clustering coefficients of all individual nodes. |  The average clustering coefficient is positively related to the establishment of stable groups as well as to the amount of produced efforts and the straightening of transitive relationships.
Small world index ($S$) |  The ratio between the standardized clustering coefficient, and the standardized average shortest path. |  The network has tightly interconnected clusters of nodes. Nodes are also separated, averagely, by path of few steps.
Table 1: A short glossary of network measures.

Real applications inspire other measures such as assortativity and clustering
coefficient, both of which are correlation measures that play an important
role in characterizing network topology and understanding information spread
[21]. A network exhibits assortative mixing if nodes with a high number of
connections tend to link with large degree nodes; otherwise, it displays
disassortative mixing when nodes that have high connections have neighbors
with low connections. The latter feature is typical of many technological
networks [16, 44].

Network assortativity is computed by the Pearson correlation coefficient ($r$)
between two nodes connected by a link with $r$ positive that has a value
between the range $0\leq r\leq 1$; in the case of network disassortativity,
$r$ is negative and has a value that lies in the range $-1\leq r<0$ [44, 45].
Node assortativity can be computed by considering the degree-degree
correlation, or also by considering some node’s attributes [13]. The former
regards the propensity of nodes of a certain degree to connect with nodes of a
different degree (disassortative network) or a similar degree (assortative
network); the latter quantifies the tendency of nodes with the same attribute
values to be connected.

Many real networks exhibit a sophisticated spread of the node organization,
which is a sign that the corresponding systems have dynamic properties
different from those of equivalent random or regular networks. One of the most
important properties is small-worldness, a notion which relies on the idea of
‘six degrees of separation’, a popular concept stemming from the experiment
conducted by the psychologist Stanley Milgram in the 1960s, according to which
the social distance between any two individuals is small [41].

Systems described by small-world networks are often studied using an
equivalent canonical network model introduced by [57]. The level of small-
worldness is measured by the small-world index $S$, which is based on the
trade-off between a high global clustering coefficient and a short average
path length [29]. Specifically, it is defined as the ratio between the
standardized clustering coefficient and the standardized average shortest
path. Standardization is done by comparing the respective values in the
analyzed network with the mean of the corresponding measures over a set of
random graphs. This metric is appropriate to quantifying how well a system is
connected. Specifically, a network is considered to display a small-world
structure if $S>1$ [29].

Because the network science approach includes SNA, this paper focuses on the
centrality values, which represent the relative importance of a node within a
graph, with the assertion that the higher the centrality index of a node, the
higher its perceived centrality in the graph. Moreover, centrality measures
assess the involvement of nodes in contributing to the cohesiveness of the
network [9, 59].

The concept of centrality has an inherent ambiguity; it is pointless to
include all measures in one method [50]. Deciding which option to choose
requires consideration of the specificity of the measures and the requirements
of different applications. There are several quantities describing the
centrality that depend on the type of statistics on which they are based; the
ones most commonly used are reported in Table 2.

Measure |  Definition |  Meaning
---|---|---
Degree centrality ($k_{i}$) |  The number of links incident upon a node, which can be interpreted as the neighbourhood size of each member within the network. |  This highlights the immediate risk of a node catching whatever is flowing through the network. It quantifies how well it is connected to the other elements of the graph. Degree centrality is an indicator of the spread of node connectivity along the graph, and it is a gauge crucial for defining the network’s organisation.
Clustering coefficient ($C_{i}$) |  For any node $i$, is the fraction of the connected neighbours of $i$. |  This determines the capacity of link creations among neighbors, i.e. the tendency in the network to create stable groups.
Closeness centrality ($C_{C}$) |  The natural distance between all pairs of nodes defined by the length of their shortest paths. Thus, the more central a node is, the lower its distance is to all other nodes. |  This value measures how long it takes to spread information from a member to all others sequentially.
Betweenness centrality ($C_{B}$) |  The number of times a node acts as bridge along the shortest path between two other nodes. |  This measure reveals the intermediary members that are essential for connecting different regions of the network.
Eigenvector centrality ($C_{E}$) |  The influence of a node in a network according to the number and the quality of its connections. |  Indeed, a node with a smaller number of high quality links has more power than one with a larger number of mediocre contacts.
Table 2: A short glossary of centrality measures. Please refer to [51] for a
complete description and formulation.

##  4 Description of results and their implementation

This section details the results achieved after using the MITRE ATT&CK
framework as a starting dataset. We describe each step we followed in the
research design in Figure 1, with reference to the identification of the
dataset, the relationships extraction, the analysis and, finally, the
information retrieval.

Figure 1: The research design.

###  4.1 Dataset description

Because of the pervasive digitalization of the world, cybersecurity has become
a critical component of it. Hence, it would be better to identify who the
attackers are and their behaviors. Unfortunately, research on cyber-attacks is
plagued by the same limitations that afflict all research on ‘difficult’
topics like organized crime or terrorism: that is, such subjects actively
oppose being investigated and/or interviewed. They seek to leave no traces of
their activities or block the gathering of any information about them by
researchers.

The drawback – the lack of reliable data – of doing research on such ‘bad
guys’ (’guys’, because most hackers/coders appear to be male, but there is a
growing female minority [54] has been convincingly described by, for example,
[22], who specifical referred to cybercrime, but the same conclusions could be
extended to cyberterrorists and other malicious actors. Unsurprisingly,
finding and collecting data on cybersecurity (and related topics such as
cyberwarfare) is a complex endeavor, one that is perhaps plagued even more
than collecting data on organized crime and/or in intelligence studies. Such
data, however, is one of the most daunting hurdles for research on
cybersecurity issues. In [52], for example, it is noted that: “Industry and
academia have also been unable to fill the gap. Academic researchers generally
study cyber incidents reported in the press, but much of cyber conflict
remains covert or is never publicly reported. Companies providing cyber
security services have a wealth of incident data, and insurance companies
gather details from cyber-related claims. However, this data is proprietary,
which has limited its use and access”.

Given the technical and logistical problems that must be overcome in IT and
cyberspace, it is inevitable that many malicious actors operate in (more or
less) formal and (more or less) structured groups. Such actor-groups are,
among other things, social entities. Their interactions and relationships are
an ideal object for social network analysis. Even a casual search for
“cyberattacks databases” (on the main search engines (e.g., Google or Bing)
yields as its top result “MITRE ATT&CK”, which is also the database selected
for analysis in this paper.

The MITRE ATT&CK® is a knowledge base of cyber adversary behavior and taxonomy
for adversarial actions across their lifecycle, as reported in their FAQs
222https://attack.mitre.org/resources/faq/. As an organization, MITRE began
operating in 1958, sponsored by the U.S. Air Force as a not-for-profit company
advising government agencies, both military and civilian, on systems
engineering 333https://www.mitre.org/who-we-are/our-story. As such, it has
always operated within the area of advanced technologies for the U.S. federal
government. One of its first involvements with computer networks came in 1995,
when MITRE began investigating “Y2K” implications for Defense Department
systems. In 1999, it contributed to the creation of “CVE”, the first public
dictionary of computer vulnerabilities 444https://cve.mitre.org.

In 2013, MITRE developed “ATT&CK®”, the (freely) accessible knowledge base of
adversary tactics and techniques, based, as the organization indicates, “on
real-world observations”. In the following year (2014), the National Institute
of Standards and Technology (NIST) sponsored the National Cybersecurity FFRDC
(NCF) one of the six “Federally Funded Research and Development Centers”
(FFRDC) now managed by MITRE. The NIST is, in itself, one of the best known
(and respected) sources of research on cybersecurity 555For example, in
February 2014, NIST released its ”Framework for Improving Critical
Infrastructure Cybersecurity”, with its guidelines to fight off serious
cyberattacks to the United States critical infrastructures.. In regard to the
NIST [56], one of the quantitative cybersecurity scholars, observed that
“[t]he National Institute of Standards and Technology (NIST) is usually the
go-to guide for cybersecurity values and metrics thus this organisation
deserves its own section in reviewing guidance for producing information
security metrics and data”.

On the MITRE Web site it is also possible to find a basic description of the
dataset: the “MITRE ATT&CK® is a globally accessible knowledge base of
adversary tactics and techniques based on real-world observations. The ATT&CK
knowledge base is used as a foundation for the development of specific threat
models and methodologies in the private sector, in government, and in the
cybersecurity product and service community.” The specific dataset used for
this work is labelled “Groups”, where groups “are activity clusters that are
tracked by a common name in the security community”
666https://attack.mitre.org/groups/.

It is also possible to gain from the website
777https://attack.mitre.org/datasources/ a basic understanding of what the
MITRE’s staff conceives to be “data” [7]: “Data sources represent the various
subjects/topics of information that can be collected by sensors/logs. Data
sources also include data components, which identify specific
properties/values of a data source relevant to detecting a given ATT&CK
technique or sub-technique.” Overall, the number of “Data Sources” reported is
39, ranging from application logs to DNS (Domain Name Systems) to Windows
registry, so that it is one of the largest databases on cyber-operations. Also
present is an “Update” section containing the most recent changes to all
sections.

In addition to the institutional respectability of NCF/NIST, MITRE ATT&CK’s
data output on cybersecurity has already been used in the specialized
literature (e.g. [33]). The most serious limitation on using this database and
dataset is that NIST-MITRE focuses on threats entirely outside the United
States. All APTs, for example, are considered linked to non-U.S. entities.
These conditions exclude the impact and significance of cybercrimes from
within the United States, which are widespread and ponderous. They thus impose
some restrictions on generalizations from this research. Another inadequacy of
the dataset is that it is not frequently updated, thus making it impossible to
conduct longitudinal studies with it. On the other hand, collecting the
observation points of the dataset, namely cyber-attacks, is a rather difficult
and unpredictable endeavor because it is not always possible to obtain
reliable information about the attacks.

Aware of such limitations, this paper focuses its attention on the ‘small
worlds of bad guys’ in the form of black-hat groups which attack government
and private sector targets and are (somehow) government-related, thus
excluding those actor-groups that are primarily part of (or work for)
organized crime. The choice of whom to observe based on their target-choice
has been present in the literature for quite some time (e.g. [23]).

###  4.2 Empirical results

Data on the actor-groups considered comes in the form of a table, with columns
listing the groups’ IDs, names and a description of targeted industries and
countries, countries of origin, years of activities and other information.
Such columns are employed in order to construct a bipartite network $G_{B}$ in
which one partition is made up of groups while the other is made up of
targeted industries (see Figure 2). A link between the partitions exists if an
actor-group targeted an industry. The bipartite network is then projected onto
two of its partitions through an operation called ‘one-mode projection’ [46],
thus obtaining two further networks: in the first one ($G_{G}$) two groups are
connected if they targeted the same industry; in the second one ($G_{I}$) two
industries are connected if they were targeted by the same group.

A simple example of the procedure is reported in Figure 3, where a bipartite
network, composed of $7$ actor-groups having interactions with $4$ industries,
has a left projection as in the network in the panel b) and a right projection
as in the network in panel c).

Figure 2: The bipartite graph $G_{B}$. The left partition is composed of
groups, the right partition is composed of industries. Figure 3: An example of
a bipartite graph a) with seven actor-groups $(G_{1},G_{2},\ldots,G_{7})$ and
the corresponding four industries $(I_{1},I_{2},I_{3},I_{4})$ and the
resulting one-mode projections: left projection of the group relationships b),
right projection of the industry relationships c).

Figure 4: The two projections of network $G_{B}$: left figure reports the left projection $G_{G}$ and right figure reports the right projection $G_{I}$. Measure |  $G_{G}$ \- Groups projection |  $G_{I}$ \- Industries projection
---|---|---
Nodes ($n$) | 128 | 29
Links ($m$) | 1875 | 97
Density ($d$) | 0.23 | 0.24
Diameter ($D$) | 3 | 4
Average shortest path ($L$) | 1.65 | 2.35
Assortativity ($r$) | 0.10 | -0.11
Average clustering coefficient ($C$) | 0.66 | 0.76
Small world index ($S$) | 4.11 | 2.91
Table 3: Networks measures

Both networks have weighted links. For $G_{G}$ weights are the number of
targeted industries shared by two groups, while for $G_{I}$ weights are the
number of groups that have targeted the same two industries. For instance, the
$G_{G}$ link between APT1 and APT18 has a weight equal to $2$ because the two
groups both targeted the industries government and manufacturing, while the
$G_{I}$ link between government and media has a weight equal to $3$ because
groups APT12, APT29 and APT32 targeted the two industries.

The bipartite network and the two corresponding one-mode projections are
reported in Figure 4, while their characteristics are reported in Table 3. The
network $G_{G}$ exhibits a small diameter and an even smaller value for the
average shortest path, which is an indication of a cohesive network. This is
confirmed by a relatively high value for the averaged clustering coefficient.

The main confirmation of the cohesiveness of the network is provided by the
small-world index. As said in Section 3, a value of $S>1$ suffices to identify
a small-world network. Since the value is $4.11$, we can state that the
network clearly displays such an organization. Moreover, according to the
network theory [5], a network exhibits an ultra-small world property when the
average shortest path is close to the value of $\ln\ln(N)$. For $G_{G}$ we
obtained $L=1.65$ and $\ln\ln(N)=1.58$, indicating that the hubs radically
shrink the distance between the nodes.

Figure 5: Centrality values distributions for the network $G_{G}$. Figure 6:
Centrality rank comparison for the network $G_{G}$. For each centrality
measure, nodes are sorted by means of their values and their rank is shown on
a heatmap where a darker color represents a higher position in the ranking.

The network $G_{I}$ is smaller than $G_{G}$, which implies that its properties
are less straightforward to interpret. However, the values for the average
shortest path, the clustering coefficient, and the small-world index greater
than one suggest a network where nodes are strictly connected, with the
exception of a small, disconnected component involving four industries, namely
hospitality, gaming, catering and retail (see left network on Figure 4). Note
that some literature erroneously states that the PageRank measure of
undirected graphs is proportional to the degree, so that it is not meaningful.
In fact, in [24] it is shown that this happens very rarely, so we can use the
measure for our purposes.

In terms of assortativity, the network $G_{I}$ is somewhat disassortative,
which means that hub industries prefer to be connected with small-degree
industries, whereas the network $G_{G}$ presents a weak positive value,
demonstrating a tendency for nodes of the same degree to be connected.
Regarding metadata, it would be interesting to observe the assortativity
between countries. However, this is not possible because the data does not
report the origin country for all groups.

The findings of the centrality analysis are shown in Figure 5 and Figure 6.
They include the results for the degree centrality, betweenness centrality,
clustering coefficient (transitivity), closeness centrality, eigenvector
centrality and pagerank centrality. In particular, the first figure displays
the distribution of values for each measure as a boxplot, while the second
compares the rank obtained by sorting the nodes according to the values of the
measures.

As to be expected, the degree distribution shows a few nodes with very high
values (e.g., Tonto team, $77$; APT19, $76$; menuPass and Deep Panda, 74), but
the majority of nodes are scattered across values between $0$ and $54$.

Betweenness centrality displays a different behavior since the great majority
of the nodes have values far from the few high-value nodes. In particular, six
nodes register values greater than 100, with the first in the ranking
(Andariel, $209.47$) having a value greater than those of the other five
(OilRig, $148.21$; Tropic Trooper, $128,214$; APT29, $119.90$; Deep Panda,
$114.14$; APT-C-36, $105.47$). Note that, with the exception of Deep Panda,
all of them are not in the top nodes when considering degree centrality. In
other words, besides the fact that they are not hubs, they represent the main
brokers in the networks.

The clustering coefficient analysis shows that the majority of values are
concentrated on high values, meaning that nodes tend to organize themselves
into cohesive subgroups. In particular, many nodes with a degree in the middle
range have values equal to 1, indicating a very tight relationship between
them and the nodes with which they are connected.

The results of the closeness study support the presence of short paths
connecting each node. Due to their high values of closeness ($0.57$ and
$0.67$, respectively) and low values of degree (3 and 4), two nodes, FINS6 and
FINS5, exhibit a unique behaviour. The reason is the fact that they belong to
the connected components that have gaming, hospitality, catering, and retail
as targeted industries. Eigenvector and PageRank centrality measures display a
small group of very influential nodes, namely APT19, Tonto Team and Fox
Kitten, which obtain the highest values for both the measures. Figure 6 shows
the different node rankings and confirms that different measures could have
different rankings, meaning that the behaviour of the nodes is not simply
stated from its position in the environment; rather, it is strictly related to
the patterns of connection that are established within the network.

We constructed a qualitative matrix with the degree of centrality on the
x-axis and the number of different industries that a single node is used to
target on the y-axis in order to highlight the most involved nodes. The
matrix, shown in Figure 7, is divided into four sections by using two
thresholds that divide the node degree and the number of targeted industries
into low and high values, respectively.

Figure 7: Involvement matrix for the groups. On the x-axis is the node degree
for $G_{G}$; on the y-axis is the number of industries a group is used to
target. The green area indicates a low degree and a low number of industries;
the purple area indicates a high degree and a low number of industries; the
yellow area indicates low values of degree and industries; and the red area
indicates high values of degree and industries.

The matrix shows a small number of actor-groups (the ‘bad guys’ of the paper’s
title) that have the highest degree and are involved in targeting several
industries (red area in the figure). The area with a low degree and few
industries (shown in green in the figure) is the one most represented, while
the area with a high degree and many industries (shown in purple in the
figure) shows a significant number of nodes that are engaged in numerous
connections while they focus on specific industries. Although
counterintuitive, it would be wrong to overlook the yellow area, which is, in
and by itself, quite meaningful. Its emptiness shows that with low node degree
– that is, no cooperation and/or exchange of information and expertise with
other groups of peers – the ‘end result’ is simply no attacks against no
industries: going alone or remaining isolated only result in failure (no
attacks and no gains) or irrelevance. In Table 4 we report the seven groups
that are most involved with the list of the targeted industries. It is
possible to note a clear preference for the defense, energy, government, and
healthcare industries.

Group | Degree | Number of industries |  Industries
---|---|---|---
Tonto Team | 77 | 7 |  Defense, energy, finance, government, healthcare, IT, mining,
APT19 | 76 | 9 |  Defense, energy, finance, government, high-tech, IT, legal, manufacturing, pharmaceutical
menuPass | 74 | 5 |  Defense, energy, finance, government, healthcare
Fox Kitten | 68 | 6 |  Defense, energy, government, healthcare, IT, manufacturing
APT17 | 64 | 6 |  Defense, government, IT, legal, mining, NGOs
Leviathan | 63 | 5 |  Aerospace, defense, government, healthcare, infrastructure
Threat Group-3390 | 63 | 5 |  Aerospace, defense, energy, government, IT
Table 4: The ‘bad guys’, the set of the most involved groups in the network. Industry | $N$ | $M$
---|---|---
Academic | 1 | 0
Aerospace | 2 | 1
Catering | 3 | 3
Cryptocurrency | 5 | 10
Defense | 24 | 276
Energy | 12 | 66
Finance | 23 | 253
Gaming | 2 | 1
Government | 53 | 1378
Healthcare | 10 | 45
High-tech | 3 | 3
Hospitality | 4 | 6
Human-right | 1 | 0
Individual | 1 | 0
Infrastructure | 5 | 10
IT | 13 | 78
Legal | 2 | 1
Manufacturing | 9 | 36
Media | 5 | 10
Medical | 1 | 0
Military | 1 | 0
Mining | 2 | 1
NGOs | 7 | 21
Petroleum | 1 | 0
Pharmaceutical | 1 | 0
Retail | 3 | 3
Telecoms | 9 | 36
Travel | 1 | 0
Table 5: Nodes and links for all the subgraphs related to the involved
industries. Figure 8: Subnetworks of single industries. Reported subnetworks
are those with at least five nodes, while red nodes are those in the set of
most involved nodes (see Figure 7).

In order to focus on the contribution by each industry to the network, we
partitioned the network $G_{G}$ into subnetworks considering only links
involving a certain industry. The result is shown in Figure 8, which combines
all the subnetworks with at least five nodes, while Table 5 summarizes their
main statistics, i.e., number of nodes and links. Note that in the figure we
have used the color red to represent the most involved actor-groups. It is
important to note that the government’s subnetwork is the largest, which
indicates that this industry contributes most to group interconnectivity. To a
lesser extent, defense and finance also demonstrate a significant link
contribution, whereas media, infrastructure, and cryptocurrencies involve only
a few links.

Country | Number of active groups
---|---
China | 78
Iran | 18
Russia | 17
North Korea | 9
South America | 5
Pakistan | 3
Spain | 3
India | 2
Lebanon | 2
Nigeria | 2
Vietnam | 2
Arabia | 1
Middle Eastern | 1
Portugal | 1
South Korea | 1
Table 6: Number of active groups for each country.

As a final analysis, we counted the number of active groups for each country
(see Table 6) and the network of nations where a direct link would exist if an
active group in a particular origin nation targeted particular industries in a
different nation (see Figure 9). The table and the figure clearly evidence a
prevalent role of China, with 78 active groups which have the US as their main
target, as well as France, Canada, Germany and the UK. Finally, the observed
dataset shows that the majority of activities are related to Asian nations,
whereas Europe and America are numerically significant but have fewer
activities, and Africa and Oceania have no data available.

Figure 9: Network of countries. Nodes are the origins or targets of attack.
Node size is a function of the number of groups active in that country. Node
color identifies the continent (yellow, Asia; green, Europe; red, America).
Links indicate direct attacks from an origin to a target and their thickness
is a function of the number of attacks (network restricted to available data).

##  5 Discussion and conclusions

Given the challenges associated with collecting data on ‘bad guys’ such as
criminals and terrorists, as well as the limitations of the dataset used for
the analysis (which only included data on non-U.S. government-affiliated
attackers), this study provides a comprehensive framework in which to draw
some initial generalizations based on empirical evidence. While it may be
considered a ‘theory-confirming’ example within the case-study methodology
(e.g. [37]), this work contributes more quantitative and solid evidence to the
existing literature on hackers’ behaviors, which has traditionally relied
heavily on interviews and participant observations.

Despite the drawbacks of the MITRE ATT&CK dataset, which was collected and
published by the NIST/MITRE organization, the analysis presented in this study
provides a potential solution to the challenges of gathering data on ‘bad
guys’. This solution involves utilizing data from reputable and respected
sources like MITRE/NIST, even if it means accepting certain limitations of the
datasets. This trade-off ensures the quality and reliability of the
institution that collected the data, enabling the generation of original
insights and contributing to the expansion and advancement of research on
cyberattacks and hackers’ behaviors. This constitutes the first significant
conclusion of the paper.

A second important conclusion pertains to the existing literature on hackers’
behavior. The literature indicates that hackers, in general, seek out and
cooperate with their peers. If this observation holds true for white-hat
hackers, there is no logical reason why it should not apply to black-hat
hackers as well. Black-hat hackers may have their own peers, which could
include other malicious hackers operating within different actor-groups or
Advanced Persistent Threats (APTs) affiliated, to varying degrees, with
sovereign governments. These governments may provide financial assistance,
make requests or issue directives that cyber attackers incorporate, to
different extents, into their operations. The analysis conducted in this paper
reveals the emergence of clusters of ‘bad guys’ interacting with each other,
even across different countries. These clusters demonstrate link, particularly
concerning their selected targets. The actor-groups identified in the dataset
tend to target the same entities, leading to shared problems and obstacles.
Consequently, these ‘bad guys’ naturally form enclaves within their ‘small
world’, harboring mistrust towards outsiders due to concerns about betrayal to
the authorities or the theft and replication of their techniques, methods, and
expertise by competitors or adversaries. As regards the specific research
questions posed at the beginning of this paper, we can provide some answers.

  * •

Do actor-groups (in the dataset) interact with each other? Indeed, they do and
they display multiple links with each other.

  * •

Do most of them substantially cooperate (show high degree?) or do only a
handful of them? According to the analysis, most nodes cooperate and only a
small percentage of nodes have a small number of links.

  * •

Are the most dangerous actor-groups (i.e., those that attack most industries
and most of the time) those with a high node degree or the contrary? The
analysis reveals that other factors also play a role in identifying the most
dangerous groups, although the degree is still one of the key indicators.

Overall, a small number of groups are highly active with each other and attack
most industries. The really ‘bad’ ones, even from different countries, tend to
link with each other, thereby confirming that it is indeed a small world of
bad guys.

## References

  * [1] Alperovitch, D., 2011. Revealed: operation shady RAT, vol 3. McAfee.
  * [2] Andersson, C., Törnberg, P., 2018. Wickedness and the anatomy of complexity. Futures, 95, 118–138.
  * [3] Back, S., Soor, S., LaPrade, J., 2018. Juvenile hackers: An empirical test of self-control theory and social bonding theory. International Journal of Cybersecurity Intelligence & Cybercrime, 1(1), 40–55.
  * [4] Barabási, A. L., 2013. Network science. Philosophical Transactions of the Royal Society A: Mathematical, Physical and Engineering Sciences, 371(1987):20120375.
  * [5] Barabási, A. L., 2016. Network science. Cambridge University Press.
  * [6] Barik, M. S., Sengupta, A., Mazumdar, C., 2016. Attack graph generation and analysis techniques. Defence Science Journal, 66(6), 559–567.
  * [7] Barnum, S., 2014. Standardizing cyber threat intelligence information with the Structured Threat Information eXpression ($STIX^{TM}$). Tech. Rep. 11, MITRE, URL http://stixproject.github.io/about/STIX_Whitepaper_v1.1.pdf.
  * [8] Benjamin, V., Chen, H., 2012. Securing cyberspace: Identifying key actors in hacker communities. In: 2012 IEEE international conference on intelligence and security informatics, IEEE, 24–29.
  * [9] Borgatti, S. P., Everett, M. G., 2006. A graph-theoretic perspective on centrality. Social networks, 28(4), 466–484.
  * [10] Börner, K., Sanyal, S., Vespignani, A., et al., 2007. Network science. In: Cronin B (ed) Annual Review of Information Science & Technology, vol 41, Medford, NJ: Information Today, Inc./American Society for Information Science and Technology, Chapter 12, 537–607
  * [11] Bright, D., Brewer, R., Morselli, C., 2021. Using social network analysis to study crime: Navigating the challenges of criminal justice records. Social Networks, 66, 50–64.
  * [12] Cerqueti, R., Ferraro, G., Iovanella, A., 2018. A new measure for community structures through indirect social connections. Expert Systems with Applications, 114, 196–209.
  * [13] Cinelli, M., Peel, L., Iovanella, A., Delvenne, J. C., 2020. Network constraints on the mixing patterns of binary node metadata. Physical Review E, 102(6):062310.
  * [14] Clarke, R. A., Knake, R. K., 2012. Cyber War: The next threat to national security and What to do about it. Ecco Pr.
  * [15] Cole, E., 2013. Advanced persistent threat: understanding the danger and how to protect your organization. Elsevier Inc.
  * [16] D’Agostino, G., Scala, A., Zlatić, V., Caldarelli, G., 2012. Robustness and assortativity for diffusion-like processes in scale-free networks. EPL (Europhysics Letters), 97(6):68006.
  * [17] De Bruijne, M., Van Eeten, M., 2007. Systems that should have failed: critical infrastructure protection in an institutionally fragmented environment. Journal of contingencies and crisis management, 15(1), 18–29.
  * [18] Décary-Hétu, D., Dupont, B., 2012. The social network of hackers. Global Crime 13(3), 160–175.
  * [19] DeVore, M.R., Lee, S., 2017. APT(Advanced Persistent Threat)s and influence: Cyber weapons and the changing calculus of conflict. The Journal of East Asian Affairs, 31(1), 39–44.
  * [20] FBI, 2018. 2018 internet crime report. Tech. rep., Federal Bureau of Investigation, URL https://www.ic3.gov/Media/PDF/AnnualReport/2018_IC3Report.pdf.
  * [21] Ferraro, G., Iovanella, A., 2016. Revealing correlations between structure and innovation attitude in inter-organisational innovation networks. International Journal of Computational Economics and Econometrics 6(1), 93–113.
  * [22] Florêncio D, Herley C (2013) Sex, lies and cyber-crime surveys. In: Economics of information security and privacy III, Springer, pp 35–53.
  * [23] Giacomello, G., 2014. Security in cyberspace: Targeting nations, infrastructures, individuals. Bloomsbury Publishing, USA.
  * [24] Grolmusz, V., 2015. A note on the pagerank of undirected graphs. Information Processing Letters, 115(6-8), 633–634.
  * [25] Hafner, K., Lyon, M., 1998. Where wizards stay up late: The origins of the Internet. Simon and Schuster.
  * [26] Hafner, K., Markoff, J., 1995. Cyberpunk: outlaws and hackers on the computer frontier, revised. Simon and Schuster.
  * [27] Hathaway, M., 2017. When violating the agreement becomes customary practice. In: Hampson FO, Sulmeyer M (eds) Getting beyond Norms. New Approaches to International Cyber Security Challenges, Centre for International Governance Innovation, URL https://www.cigionline.org/static/documents/documents/Getting%20Beyond%20Norms.pdf.
  * [28] Holt, T. J., Strumsky, D., Smirnova, O., Kilger, M., 2012. Examining the social networks of malware writers and hackers. International Journal of Cyber Criminology, 6(1), 891–903.
  * [29] Humphries, M. D., Gurney, K., 2008. Network ‘small-world-ness’: a quantitative method for determining canonical network equivalence. PloS One 3(4):e0002051.
  * [30] Isaacson, W., 2014. The innovators: How a group of inventors, hackers, geniuses and geeks created the digital revolution. Simon and Schuster.
  * [31] Jordan, T., Taylor, P., 1998. A sociology of hackers. The Sociological Review, 46(4), 757–780.
  * [32] Kwon, K. H., Shakarian, J., 2018. Black-hat hackers’ crisis information processing in the darknet: A case study of cyber underground market shutdowns. In: Networks, Hacking, 32 and Media–CITA MS@ 30: Now and Then and Tomorrow, vol 17, Emerald Publishing Limited, pp. 113–135.
  * [33] Kwon, R., Ashley, T., Castleberry, J., Mckenzie, P., Gourisetti, S. N. G., 2020. Cyber threat dictionary using mitre ATT&CK matrix and NIST cybersecurity framework mapping. In: 2020 Resilience Week (RWS), IEEE, pp. 106–112.
  * [34] Legoy, V., Caselli, M., Seifert, C., Peter, A., 2020. Automated retrieval of ATT&CK tactics and techniques for cyber threat reports. arXiv preprint arXiv:200414322.
  * [35] Lewis, T. G., 2011. Network science. Wiley and Sons.
  * [36] Li, Y., Zhang, T., Li, X., Li, T., 2019. A model of APT attack defense based on cyber threat detection. In: Cyber Security: 15th International Annual Conference, CNCERT 2018, Beijing, China, August 14–16, 2018, Revised Selected Papers, 15, Springer, pp 122–135.
  * [37] Lijphart, A., 1971. Comparative politics and the comparative method. American Political Science Review, 65(3), 682–693.
  * [38] Lu, Y., Luo, X., Polgar, M., Cao, Y., 2010. Social network analysis of a criminal hacker community. Journal of Computer Information Systems, 51(2), 31–41.
  * [39] Mandiant Intelligence Center (2013) APT1: Exposing one of China’s cyber espionage units. Mandiancom.
  * [40] Maurer, T., 2018. Cyber mercenaries. Cambridge University Press.
  * [41] Milgram, S., 1967. The small world problem. Psychology Today 2(1), 60–67.
  * [42] Mitnick, K. D., Simon, W.L., 2003. The art of deception: Controlling the human element of security. John Wiley and Sons.
  * [43] MITRE. (2023). ATT&CK, [Online]. Available: https://attack.mitre.org (visited on July 24, 2023).
  * [44] Newman, M. E. J., 2002. Assortative mixing in networks. Physical Review Letters, 89(20):208701.
  * [45] Newman M. E. J., 2003. The structure and function of complex networks. SIAM Review, 45(2), 167–256.
  * [46] Newman, M. E. J., 2018. Networks. Oxford University Press.
  * [47] Opsahl, T., Colizza, V., Panzarasa, P., Ramasco, J. J., 2008. Prominence and control: the weighted rich-club effect. Physical Review Letters, 101(16):168702.
  * [48] Pavendan, R., Sankar, K., Kumar, K., 2023. A graph theory based self-learning honeypot to detect persistent threats. Intelligent Automation & Soft Computing, 35(3), 3331–3348.
  * [49] Pennington, A., Applebaum, A., Nickels, K., Schulz, T., Strom, B., Wunder, J., 2019. Getting started with ATT&CK. Tech. rep., MITRE CORP MCLEAN, VA.
  * [50] Rowley, T. J., 1997. Moving beyond dyadic ties: A network theory of stakeholder influences. Academy of Management Review, 22(4), 887–910.
  * [51] Scott, J., Carrington, P. J., 2011. The SAGE handbook of social network analysis. SAGE Publications.
  * [52] Shore, J., 2022. Data incoming: How to close the cyber data gap”, War on the rocks, URL https://warontherocks.com/2022/10/data-incoming-how-to-close-the-cyber-data-gap/.
  * [53] Strom, B. E., Battaglia, J. A., Kemmerer, M. S., Kupersanin, W., Miller, D. P., Wampler, C., Whitley, S. M., Wolf, R. D., 2017. Finding cyber threats with ATT&CK-based analytics. Tech. rep., The MITRE Corporation, Bedford, MA, Technical Report No. MTR170202.
  * [54] Thompson, C., 2020. Coders: the making of a new tribe and the remaking of the world. Penguin.
  * [55] Turner, J. R., Baker, R. M., Romine, K., 2019. Complex adaptive team systems (cats): scaling of a team leadership development model. In: Digital Leadership-A New Leadership Style for the 21st Century, IntechOpen.
  * [56] Valeriano, B., 2022. The need for cybersecurity data and metrics: empirically assessing cyberthreat. Journal of Cyber Policy, 7(2), 140–154.
  * [57] Watts, D. J., Strogatz, S. H., 1998. Collective dynamics of ‘small-world’networks. Nature, 393(6684), 440–442.
  * [58] West, D. B., 2001. Introduction to graph theory, Pearson College Div.
  * [59] White, D. R., Harary, F., 2001. The cohesiveness of blocks in social networks: Node connectivity and conditional density. Sociological Methodology, 31(1), 305–359.
  * [60] Zeadally, S., Martinez, G., Chao, H. C., 2013. Securing cyberspace in the 21st century. Computer, 46(04), 22–23.