Website Defacer Classification: A Finite Mixture Model Approach

Abstract

Hackers often engage in website defacement early in their criminal careers to establish a reputation. Some hackers become increasingly prolific and launch a large number of attacks against their targets, whereas others only launch a few attacks before eventually desisting from a life of crime. A better understanding of why some hackers launch a large number of attacks, while others do not, will assist in the implementation of targeted intervention strategies. Therefore, the current study, using a sample of 119 active hackers, seeks to answer two research questions: (1) Are there different groups of website defacers based on attack volume? (2) Which observed hacker-level characteristics can be used to predict latent class membership? We find that two unique groups of website defacers exist: low-volume defacers (69%) and high-volume defacers (31%). Social media presence, the content of the defacement, and the type of defacement are all predictive of latent class membership. Policy implications are discussed.