DOI: 10.32702/2307-2105-2020.5.11
УДК: 330.46:004.7.056.5
O. Kuzmenko, N. Pilina, R. Pilin
TRENDS OF FRAUD OPERATIONS ON THE BANKING MARKET AND APPROACHES OF CYBERSECURITY AS-SESSMENT
Summary
The article emphasizes the identification of current trends in fraudulent transactions in the banking market. It is revealed the critical factors of cybercrime development in the financial sector. To ana-lyze research on trends in fraudulent transactions in the banking market and approaches to assess-ing cybersecurity, a map of scientific bibliography is formed using the software product VOS-viewer, based on Scopus database publications in terms of the intersection of queries in such cate-gories as "banking" and "cybersecurity." Cybersecurity problems in banks, types of cyber fraud, and types of software that have been developed and implemented in recent years. It is presented a graphical visualization of the main risks, the growth of which is expected soon. It is formed the rat-ing of the most common types of fraud in banks. The article is stressed on a structural analysis of priority sources of cyberattacks in the banking market. It is described options for malicious soft-ware to interfere with banking programs. The relevant requirements for building a system of coun-teraction within the internal processes of the bank are considered. Emphasis is placed on incidents of making an adequate organizational structure, educational work with staff in the field of informa-tion security and risk management, the use of modern technologies, creating an effective manage-ment system and decision-making. It is conducted a comprehensive analysis of the bank's customer service channels, most prone to cybercrime attacks. The investigation is stressed on restrictions designed to protect bank accounts from unauthorized access. The article contains a list of problems that may arise in the bank's customers when using the affected software, which forces banks to im-plement anti-fraud systems. It is considered the latest approaches to countering bank account at-tacks. The article contains malicious software (Ramnit, Trickbot, Ursnif, Gustuff, IcedID, IcedID, Panda, Zevs), which has affected banks in recent years, causing significant material damage. Mod-ern approaches to the assessment of the information protection system in general and cybersecu-rity, in particular, are identified.
Keywords: cybercrime; cyber fraud; cybersecurity; anti-fraud systems; malware.
References
1. Goldsmith, D. Grauer, K. and Shmalo, Y., (2020), “Analyzing hack subnetworks in the bitcoin transaction graph”, Applied Network Science, vol. 5.
2. Protiviti Inc. (2020), “Executive perspectives on top risks for 2020”, available at: https://www.protiviti.com/CA-en/insights/protiviti-top-risks-survey (Accessed 15 May 2020).
3. Bormann, C. Castellani, A.P. and Shelby, Z. (2012), “CoAP: An application protocol for billions of tiny internet nodes”, IEEE Internet Computing, art. no. 6159216, pp. 62-67., doi: 10.1109/MIC.2012.29.
4. Pons, P. (2013) “Computing communities in large networks using random walks”, Internet measurement conference, Barcelona, Spain, pp. 127-140.
5. Nwankwo, W. and Ukaoha, K.C. (2019), “Socio-technical perspectives on cybersecurity: Nigeria’s cyber-crime legislation in review”, International Journal of Recent Technology and Engineering, Vol. 8, no. 10, pp. 47-58, available at: https://www.researchgate.net/publication/337033615_Socio-Technical_Perspectives_On_Cybersecurity_Nigeria's_Cybercrime_Legislation_In_Review (Accessed 15 May 2020).
6. Sharma, K. Bhasin, S. and Bharadwaj Nalini, P. (2019), “A worldwide analysis of cyber security and cyber crime using twitter”, International Journal of Engineering and Advanced Technology, Vol. 8,no. 6 Special Issue 3, pp. 1051-1056, available at: https://www.ijeat.org/wp-content/uploads/papers/v8i6S3/F13330986S319.pdf, (Accessed 12 May 2020).
7. Insurance Information Institute (2020), “Facts + Statistics: Identity theft and cybercrime”, available at: https://www.iii.org/fact-statistic/facts-statistics-identity-theft-and-cybercrime (Accessed 15 May 2020).
8. Shalaginov, A. Kotsiuba, I. and Iqbal, A. (2019), “Cybercrime Investigations in the Era of Smart Applica-tions: Way Forward Through Big Data”, IEEE International Conference on Big Data, Los Angeles, United States; 9-12 December 2019, Category number CFP19BGD-ART; Code 157991.
9. NetGuardians (2020), “Digital banking fraud: Best practice for technology-based prevention”, available at: https://netguardians.ch/digital-banking-fraud/ (Accessed 15 May 2020).
10. Shishkova, T. (2018), “The rise of mobile banker Asacub”, Kaspersky, available at: https://securelist.com/the-rise-of-mobile-banker-asacub/87591/ (Accessed 15 May 2020).
11. Thejas, G.S. Boroojeni, K.G. Chandna, K. Bhatia, I. Iyengar, S.S. and Sunitha, N.R. (2019), “Deep learn-ing-based model to fight against Ad click fraud”, ACM Southeast Conference, ACMSE 2019, Kennesaw State Univer-sity Kennesaw; United States, Code 147761, available at https://dl.acm.org/doi/pdf/10.1145/3299815.3314453?download=true (Accessed 12 May 2020).
12. Carin, M. M. Reep-van den Bergh and Junger, M. (2018), “Victims of cybercrime in Europe: a review of victim surveys”, Crime Science, Vol. 7, no. 1, available at: https://crimesciencejournal.biomedcentral.com/articles/10.1186/s40163-018-0079-3, (Accessed 12 May 2020).
13. Cimpanu, C. (2020), “Gustuff Android banking trojan targets 125+ banking, IM, and cryptocurrency apps”, Zero Day, available at: https://www.zdnet.com/article/gustuff-android-banking-trojan-targets-100-banking-im-and-cryptocurrency-apps/, (Accessed 15 May 2020).
14. Huang, D.Y. Aliapoulios, M.M. Li, V.G. Invernizzi, L. Bursztein, E. McRoberts, K. Levin, J. and McCoy, D. (2018), “Tracking Ransomware End-to-end”, IEEE Symposium on Security and Privacy, art. no. 8418627, pp. 618-631, ISBN: 978-153864352-5, doi: 10.1109/SP.2018.00047.
15. The official site of Kaspersky antivirus (2020), “Geografyja rasprostranenyja semejstva Trojan-Banker.AndroidOS.Asacub”, [Online], available at: https://threats.kaspersky.com/ru/threat/Trojan-Banker.AndroidOS.Asacub/ (Accessed 15 May 2020)
16. Singh, A. and Kaur, M. (2019), “Detection Framework for Content-Based Cybercrime in Online Social Networks Using Metaheuristic”, Arabian Journal for Science and Engineering, Volume 45, no. 4, pp. 2705-2719.
17. Rohith, C. and Batth, R.S. (2019), “Cyber Warfare: Nations Cyber Conflicts, Cyber Cold War between Nations and its Repercussion”, International Conference on Computational Intelligence and Knowledge Economy, ICCIKE 2019; Amity University Dubai, United Arab Emirates, 11-12 December 2019, Category number CFP19U42-ART; Code 157936, available at: https://ieeexplore.ieee.org/abstract/document/9004236, (Accessed 15 May 2020).
18. The official site of MalwareBytes (2020), “Emotet”, [Online], available at: https://www.malwarebytes.com/emotet/ (Accessed 15 May 2020).
19. Azeez, S.N. Shivashankaran, T. and Gururaj, H.L. (2019), “A research on cyber security awareness based on big data”, International Journal of Recent Technology and Engineering, Volume 8, no. 2 Special Issue 8, August 2019, pp. 1798-1802.
20. The official site of MalwareBytes (2020), “Trojan.TrickBot”, [Online], available at: https://www.f-secure.com/v-descs/trojan_w32_ursnif.shtml, (Accessed 15 May 2020).
21. Ferguson, S. (2019), “Ursin banking Trojan variant steals more than Financial Data”, Bank info Security, [Online], available at: https://www.bankinfosecurity.com/ursnif-banking-trojan-variant-steals-more-than-financial-data-a-12165 (Accessed 15 May 2020).
22. Whitty, M.T. (2019), “Predicting susceptibility to cyber-fraud victimhood”, Journal of Financial Crime, vol. 26, no. 1, available at: https://www.emerald.com/insight/content/doi/10.1108/JFC-10-2017-0095/full/html (Ac-cessed 12 May 2020)
23. De Arruda, G.F. Costa, L.D.F. and Rodrigues, F.A. (2012), “A complex networks approach for data clus-tering”, Physica A: Statistical Mechanics and its Applications, vol.391 (23), pp. 6174-6183, Cited 14 times, doi: 10.1016/j.physa.2012.07.007.
24. Somech, N. (2019), “IcedID Banking Trojan Spruces Up Injection Tactics to Add Stealth”, Security Intel-ligence, [Online], available at: https://securityintelligence.com/icedid-banking-trojan-spruces-up-injection-tactics-to-add-stealth/, (Accessed 15 May 2020)
25. Agus, Y.M. Falih, M.D. and Satrya, G.B., (2020), “On the possibilities of cybercrime in IoT devices”, Test Engineering and Management, Vol. 83, pp. 8231-8238.
26. Ozborn, C. (2020), “Panda Banker Trojan becomes part of Emotet threat distribution platform”, ZdNet, [Online], available at: https://www.zdnet.com/article/panda-trojan-becomes-part-of-emotet-threat-distribution-platform/ (Access 15 May 2020)
27. Sun Yin, H. and Vatrapu, R. (2017), “A first estimation of the proportion of cybercriminal entities in the bitcoin ecosystem using supervised machine learning”, IEEE International Conference on Big Data, Big Data 2017, January 2018, pp. 3690-3699, ISBN: 978-153862714-3, doi: 10.1109/BigData.2017.8258365
28. Clauset, A. Newman, M.E.J. and Moore, C., (2004), “Finding community structure in very large net-works”, Statistical, Nonlinear, and Soft Matter Physics, art. no. 066111, pp. 1-6.,doi: 10.1103/PhysRevE.70.066111
О. В. Кузьменко, Н. В. Піліна, Р. В. Пілін
ТЕНДЕНЦІЇ ШАХРАЙСЬКИХ ОПЕРАЦІЙ НА БАНКІВСЬКОМУ РИНКУ ТА ПІДХОДИ ДО ОЦІНКИ КІБЕРБЕЗПЕКИ
Анотація
У статті робиться акцент на ідентифікації сучасних тенденції шахрайських операцій на банківському ринку. Розкриваються ключові фактори розвитку кіберзлочинності в фінансовому секторі. Для аналізу досліджень тенденцій шахрайських операцій на банківському ринку та підходів до оцінки кібербезпеки сформовано карту наукової бібліографії за допомогою програмного продукту VOSviewer, що ґрунтується на публікаціях бази даних Scopus в розрізі перетину запитів за такими категоріями як «банківська справа» та «кібербезпека». Розглядається проблема кібербезпеки у банках, різновиди кібершахрайств та види програмних засобів, які розроблялися і впроваджувалися впродовж останніх років. Надана графічна візуалізація основних ризиків, зростання яких очікується в найближчій перспективі. Проведене рейтингування найбільш поширених видів шахрайств у банках. Проведений структурний аналіз пріоритетних джерел кібератак на банківському ринку. Описані варіанти втручання зловмисного програмного забезпечення у банківські програми. Розглядаються ключові вимоги до побудови системи протидії в межах внутрішніх процесів банку. Акцентується увага на інцидентах побудови адекватної організаційної структури, освітньої роботи з персоналом у сфері інформаційної безпеки та управління ризиками, використання сучасних технологій, побудови ефективної системи управління та прийняття рішень. Проведено комплексний аналіз каналів обслуговування клієнтів банку, найбільш схильних до атак кіберзлочинців. Розглядаються обмеження, покликані захистити банківські акаунти від незаконного доступу. Представлено перелік проблем, які можуть виникнути у клієнтів банку при використанні уражених програмних засобів, що змушує банки впроваджувати протишахрайські системи. Акцентується увага на новітніх підходах протидії атаки банківських рахунків. Розглядається зловмисне програмне забезпечення (Ramnit, Trickbot, Ursnif, Gustuff, IcedID, IcedID, Panda, Zevs), яке торкнулося банків останні роки, спричиняючи їм значні матеріальні збитки. Ідентифіковано сучасні підходи до оцінки системи захисту інформації в цілому та кібербезпеки зокрема.
Ключові слова: кіберзлочинність; кібер-шахрайство; кібербезпека; системи протидії шах-райству; зловмисне програмне забезпечення.
Література
1. Goldsmith, D., Grauer, K. & Shmalo, Y., (2020), “Analyzing hack subnetworks in the bitcoin transaction graph”, Applied Network Science, vol. 5.
2. Protiviti Inc., “Executive perspectives on top risks for 2020”,[Електронний ресурс]. – Режим доступу: https://www.protiviti.com/CA-en/insights/protiviti-top-risks-survey ,(Accessed 15 May 2020).
3. Bormann, C., Castellani, A.P., Shelby, Z. (2012), “CoAP: An application protocol for billions of tiny inter-net nodes”, IEEE Internet Computing, art. no. 6159216, pp. 62-67., doi: 10.1109/MIC.2012.29.
4. Pons, P., (2013) “Computing communities in large networks using random walks”, Internet measurement conference, Barcelona, Spain, pp. 127-140.
5. Nwankwo, W., Ukaoha, K.C. (2019), “Socio-technical perspectives on cybersecurity: Nigeria’s cybercrime legislation in review”, International Journal of Recent Technology and Engineering, Volume 8, Issue 10, Pages 47-58, [Електронний ресурс]. – Режим доступу: https://www.researchgate.net/publication/337033615_Socio-Technical_Perspectives_On_Cybersecurity_Nigeria's_Cybercrime_Legislation_In_Review, (Accessed 15 May 2020).
6. Sharma, K., Bhasin, S., Bharadwaj Nalini, P. (2019), “A worldwide analysis of cyber security and cyber crime using twitter”, International Journal of Engineering and Advanced Technology, Volume 8, Issue 6 Special Issue 3, Pages 1051-1056, [Електронний ресурс]. – Режим доступу: https://www.ijeat.org/wp-content/uploads/papers/v8i6S3/F13330986S319.pdf, (Accessed 12 May 2020).
7. Insurance Information Institute, (2020), “Facts + Statistics: Identity theft and cybercrime”, [Електронний ресурс]. – Режим доступу: https://www.iii.org/fact-statistic/facts-statistics-identity-theft-and-cybercrime, (Accessed 15 May 2020).
8. Shalaginov, A., Kotsiuba, I., Iqbal, A. (2019), “Cybercrime Investigations in the Era of Smart Applica-tions: Way Forward Through Big Data”, IEEE International Conference on Big Data, Los Angeles; United States; 9-12 December 2019, Category number CFP19BGD-ART; Code 157991.
9. NetGuardians, (2020), “Digital banking fraud: Best practice for technology-based prevention”, [Електронний ресурс]. – Режим доступу: https://netguardians.ch/digital-banking-fraud/, (Accessed 15 May 2020).
10. Shishkova T., (2018), “The rise of mobile banker Asacub”, Kaspersky, [Електронний ресурс]. – Режим доступу: https://securelist.com/the-rise-of-mobile-banker-asacub/87591/, (Accessed 15 May 2020).
11. Thejas, G.S., Boroojeni, K.G., Chandna, K., Bhatia, I., Iyengar, S.S., Sunitha, N.R. (2019) “Deep learning-based model to fight against Ad click fraud” ACM Southeast Conference, ACMSE 2019, Kennesaw State University Kennesaw; United States, Code 147761, [Електронний ресурс]. – Режим доступу:https://dl.acm.org/doi/pdf/10.1145/3299815.3314453?download=true, (Accessed 12 May 2020).
12. Carin M. M. Reep-van den Bergh & Marianne Junger (2018), “Victims of cybercrime in Europe: a review of victim surveys”, Crime Science, Volume 7, Issue 1, [Електронний ресурс]. – Режим доступу: https://crimesciencejournal.biomedcentral.com/articles/10.1186/s40163-018-0079-3, (Accessed 12 May 2020).
13. Catalin Cimpanu, (2020), “Gustuff Android banking trojan targets 125+ banking, IM, and cryptocurrency apps”, Zero Day, [Електронний ресурс]. – Режим доступу: https://www.zdnet.com/article/gustuff-android-banking-trojan-targets-100-banking-im-and-cryptocurrency-apps/, (Accessed 15 May 2020).
14. Huang, D.Y., Aliapoulios, M.M., Li, V.G., Invernizzi, L., Bursztein, E., McRoberts, K., Levin, J., McCoy, D. (2018), “Tracking Ransomware End-to-end”, IEEE Symposium on Security and Privacy, art. no. 8418627, pp. 618-631, ISBN: 978-153864352-5, doi: 10.1109/SP.2018.00047.
15. The official site of Kaspersky antivirus, (2020), “Geografyja rasprostranenyja semejstva Trojan-Banker.AndroidOS.Asacub”, [Online], [Електронний ресурс]. – Режим доступу: https://threats.kaspersky.com/ru/threat/Trojan-Banker.AndroidOS.Asacub/, (Accessed 15 May 2020)
16. Singh, A., Kaur, M. (2019), “Detection Framework for Content-Based Cybercrime in Online Social Net-works Using Metaheuristic”, Arabian Journal for Science and Engineering, Volume 45, Issue 4, Pages 2705-2719.
17. Rohith, C., Batth, R.S. (2019), “Cyber Warfare: Nations Cyber Conflicts, Cyber Cold War between Na-tions and its Repercussion”, International Conference on Computational Intelligence and Knowledge Economy, ICCIKE 2019; Amity University Dubai; United Arab Emirates; 11-12 December 2019, Category number CFP19U42-ART; Code 157936, [Електронний ресурс]. – Режим доступу: https://ieeexplore.ieee.org/abstract/document/9004236, (Accessed 15 May 2020).
18. The official site of MalwareBytes, (2020), “Emotet”, [Електронний ресурс]. – Режим доступу: https://www.malwarebytes.com/emotet/, (Accessed 15 May 2020).
19. Azeez, S.N., Shivashankaran, T., Gururaj, H.L. (2019), “A research on cyber security awareness based on big data”, International Journal of Recent Technology and Engineering, Volume 8, Issue 2 Special Issue 8, August 2019, Pages 1798-1802.
20. The official site of MalwareBytes, (2020), “Trojan.TrickBot”, [Електронний ресурс]. – Режим доступу: https://www.f-secure.com/v-descs/trojan_w32_ursnif.shtml, (Accessed 15 May 2020).
21. Scott Ferguson, (2019), “Ursin banking Trojan variant steals more than Financial Data”, Bank info Secu-rity, [Електронний ресурс]. – Режим доступу: https://www.bankinfosecurity.com/ursnif-banking-trojan-variant-steals-more-than-financial-data-a-12165, (Accessed 15 May 2020).
22. Whitty, M.T. (2019) “Predicting susceptibility to cyber-fraud victimhood”, Journal of Financial Crime, vol 26, issue 1, [Електронний ресурс]. – Режим доступу: https://www.emerald.com/insight/content/doi/10.1108/JFC-10-2017-0095/full/html (Accessed 12 May 2020)
23. De Arruda, G.F., Costa, L.D.F., Rodrigues, F.A. (2012), “A complex networks approach for data cluster-ing”, Physica A: Statistical Mechanics and its Applications, 391 (23), pp. 6174-6183. Cited 14 times, doi: 10.1016/j.physa.2012.07.007.
24. Nir Somech, (2019), “IcedID Banking Trojan Spruces Up Injection Tactics to Add Stealth”, Security Intel-ligence, [Електронний ресурс]. – Режим доступу: https://securityintelligence.com/icedid-banking-trojan-spruces-up-injection-tactics-to-add-stealth/, (Accessed 15 May 2020)
25. Agus, Y.M., Falih, M.D., Satrya, G.B., (2020), “On the possibilities of cybercrime in IoT devices”, Test Engineering and Management, Volume 83, Pages 8231-8238.
26. Charlie Ozborn, (2020), “Panda Banker Trojan becomes part of Emotet threat distribution platform”, ZdNet, [Електронний ресурс]. – Режим доступу: https://www.zdnet.com/article/panda-trojan-becomes-part-of-emotet-threat-distribution-platform/,(Access 15 May 2020)
27. Sun Yin, H., Vatrapu, R. (2017), “A first estimation of the proportion of cybercriminal entities in the bit-coin ecosystem using supervised machine learning”, IEEE International Conference on Big Data, Big Data 2017, Janu-ary 2018, pp. 3690-3699, ISBN: 978-153862714-3, doi: 10.1109/BigData.2017.8258365
28. Clauset, A., Newman, M.E.J., Moore, C., (2004), “Finding community structure in very large networks”, Statistical, Nonlinear, and Soft Matter Physics, art. no. 066111, pp. 1-6.,doi: 10.1103/PhysRevE.70.066111
№ 5 2020
Дата публікації: 2020-05-28
Кількість переглядів: 11595
