ENACT ; La cybercriminalité comme éco-système : repenser la modélisation macro/meso/micro et les techniques d'investigation et de prévention des menaces cyber.

Keywords

malware, Cyber-criminality and darkweb, socioeconomics, crypto laundering, ecosystemic modelisation, • AI-driven methodologies

Subject details

The fight against cybercrime has become a matter of national and European security due to the increasing frequency of attacks, the breadth of targets (households, businesses, public administrations, associations), and the diversity of motives (ransom demands, political objectives, and geopolitical interference). Consequently, addressing cybercrime solely from a technological and IT perspective is necessary but no longer sufficient. Cybercrime must be considered as an ecosystem (Dupont, 2024). Integrating an ecosystem framework enriches our understanding by avoiding the reduction of cybercriminal activity to the mere presence of an isolated hacker. Research in the humanities and social sciences dedicated to crime and cybercrime has highlighted social relationships (communities, culture, psychology), organizations providing services essential to criminal activity (technical infrastructures, financial services, advertising, communication, technology), and a broader social (inequalities, education), economic (economic growth, monetary and financial systems, public policies), legal, and political (geopolitics, corruption, cooperation/predation) environment. Research project The doctoral project aims to model this multi-scale ecosystem and then propose suitable technical tools dedicated to the detection and prevention of cybercrime through an ecosystemic approach. The design of an ecosystemic model will serve as a theoretical framework for reasoning about cybercrime. Unlike other works, and in particular (Dupont, 2024), this model will be operational thanks to the development of advanced AI-driven methodologies. In other words, it will be capable of providing analyses of organizational patterns and anticipating operational methods. Special attention will be paid to money laundering networks using crypto-assets. This model will be based on a vast amount of partially heterogeneous data. For example, conversations may be in foreign languages (Russian, Chinese, etc.), actors use a specific language to protect their identity and intentions, and the context is one where these same actors do not necessarily trust each other. All these factors must be taken into account to correctly analyze the different pieces of information. Datasets will be based on concrete cases provided by European police authorities participating in the ENSEMBLE project (see below). These cases will ensure the availability of 'real' data, enabling the proper configuration of the tools being developed. The use of synthetic data presents an alternative, but it falls short in accurately representing both current cyber threats and their anticipated evolution over the near future (18 months to 5 years). This constraint is less pronounced in economic and management sciences, where – between others – econometric research facilitates predictive modeling of cybercrime. The interdisciplinary approach will offer valuable perspectives on the economic and socio-economic dimensions of cybercrime. Ultimately, this holistic strategy seeks to create a more secure and resilient digital environment, addressing both the technical and socio-economic aspects of cybersecurity.