What Cybercrime Stats Have In Common With Sexual Braggadocio

← Back to Stories (view on slashdot.org)

What Cybercrime Stats Have In Common With Sexual Braggadocio

Posted by timothy on Thursday June 9, 2011 @07:41AM from the that's-what-it-said dept.

An anonymous reader writes "Microsoft researchers have rubbished figures from cybercrime surveys, deeming them subject to the types of distortions that have long bedeviled sex surveys. All it takes is a few self-styled Don Juans to hopelessly distort the sex-survey figures. Similarly, cybercrime surveys tend to get dominated by a minority of responses, normally those who have or think they have lost a great deal as a result of hacking or malware attack, and are vocal about it. 'Cybercrime surveys are so compromised and biased that no faith whatever can be placed in their findings,' the researchers write."

53 of 69 comments (clear)

Min score:

Reason:

Sort:

outliers? by mayberry42 · 2011-06-09 07:45 · Score: 1

Cant you just exclude the outliers from the analysis?
1. Re:outliers? by Ruke · 2011-06-09 07:56 · Score: 5, Insightful
  
  Firstly: No. Outliers are part of a data set, and it's dishonest to simply dismiss data that does not fit with your expectations.
  Secondly: The over-reporters aren't outliers. There is systematic error in asking people to self-report loss due to security breaches. People either fail to respond to polls due to internal security procedures, or they tend towards overestimating their own loss. It's not simply that there's one guy out there saying he lost $5 billion due to hackers; it's that people who respond to the poll tend to overestimate their real losses by some unknown percentage.
2. Re:outliers? by Anonymous Coward · 2011-06-09 08:22 · Score: 1
  
  Much like Microsoft overestimates their losses from people using their software without paying them?
3. Re:outliers? by FhnuZoag · 2011-06-09 08:35 · Score: 2
  
  It's not dishonest if you *say that you are excluding them*, and explain why you are doing so. It's not like the whole field of robust statistics doesn't exist. Real statisticians filter data for stuff like people misplacing decimal points, and so on, all the time.
4. Re:outliers? by rohitm918 · 2011-06-09 08:41 · Score: 1
  
  Secondly: The over-reporters aren't outliers.
  You don't know that. The fact that soemone says he lost $1000 doesn't mean that he did. The paper actually opens with several examples of over-reporters who's data was shown to be incorrect.
5. Re:outliers? by isoloisti · 2011-06-09 09:05 · Score: 1
  
  Cant you just exclude the outliers from the analysis?
  It depends on whether the outlier data is correct. If you're surveying wealth and some guy claims to be worth $50 billion, you need to figure out if he's telling the truth or not. Outliers have a huge effect on the average, that's the point of the sex-survey. The average number of partners reported by men is 5x higher than reported by women. But if you throw out the outliers among the men the averages are almost the same. Point of the paper is that in cyber-crime surveys they never even examine outlier results carefully.
6. Re:outliers? by david_thornley · 2011-06-09 09:34 · Score: 1
  
  The average number of sex partners by one sex (assuming hetero sex only and a closed population) is going to differ from the average number of sex partners by the other sex in a way that depends only on their relative numbers. To calculate, you sum the number of distinct pairs of people who engaged in sex, and divide either by the number of people of that sex in the population. Therefore, under realistic conditions, the averages should be almost the same. (The distributions may be different, and the average desired number may differ, but the actual averages should be quite similar.)
  
  --
  "When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
7. Re:outliers? by Ruke · 2011-06-09 09:34 · Score: 1
  
  I think we might have a difference in understanding in what "outlier" means. An outlier isn't a data point that is shown to be incorrect; it's a data point that is numerically distant from the rest of the points in a set. The difficulty with this data set is that it's not just the extraordinarily high values that are incorrect, but that the statistically-average values are under suspicion as well. There might very well be one large company who actually did lose $30 million due to a security breach, and 100 small companies who reported losing $25,000 when they actually lost something closer to $2000. The problem is that the incorrect values aren't outliers; there's a whole bunch of them, so they don't look statistically different from the rest of the data.
8. Re:outliers? by Kjella · 2011-06-09 10:00 · Score: 1
  
  Secondly: The over-reporters aren't outliers. There is systematic error in asking people to self-report loss due to security breaches. People either fail to respond to polls due to internal security procedures, or they tend towards overestimating their own loss. It's not simply that there's one guy out there saying he lost $5 billion due to hackers; it's that people who respond to the poll tend to overestimate their real losses by some unknown percentage.
  Well at least a sexual braggart knows (or should know) how many he's really slept with. How much business would we lose if we lost our customer data? We might get a decent figure of the people who'll instantly halt business with us. It might be one of the reasons people leave us later, but nobody really knows if it was the tipping point. Trying to guess what amount of new business we've lost is hopeless. Likewise if some competitor now is sitting on our data and stealing customers left and right. That is if we can determine exactly what they did and didn't get and exactly what systems were compromised or if we just have to assume worst case about what they could have done. We'd just have to guesstimate, in fact we'd probably have to look at our performance the next few months and then try estimating how much of that was due to the data breach. If all we lost was X hours of work and Y dollars of equipment, that'd be easy to calculate but usually that's the last part of your worries.
  
  --
  Live today, because you never know what tomorrow brings
9. Re:outliers? by isoloisti · 2011-06-09 11:05 · Score: 1
  
  I think we might have a difference in understanding in what "outlier" means. An outlier isn't a data point that is shown to be incorrect; it's a data point that is numerically distant from the rest of the points in a set. The difficulty with this data set is that it's not just the extraordinarily high values that are incorrect, but that the statistically-average values are under suspicion as well. There might very well be one large company who actually did lose $30 million due to a security breach, and 100 small companies who reported losing $25,000 when they actually lost something closer to $2000. The problem is that the incorrect values aren't outliers; there's a whole bunch of them, so they don't look statistically different from the rest of the data.
  No, I think we're on the same page as to what constitutes outlier. The point the paper makes is that for some surveys 75% of the average comes from an outlier or two. This is exactly the case with the 2007 ID theft survey they mention in the intro: the answers from 2 people (in a survey of over 4000) made a 3x difference in the average (and were found to be fabricated). It's quite possible that some of the non-outlier answers were fabricated also, but they don't have the same influence on the estimate.
10. Re:outliers? by tehcyder · 2011-06-09 21:34 · Score: 1
  
  Much like Microsoft overestimates their losses from people using their software without paying them?
  If Microsoft say that (made up numbers) a billion people are using pirated copies of Windows for which Microsoft would charge $50 each, then they can legitimately argue that they have lost $50 billion in revenue. It is up to people then to disprove the assumptions made.
  
  --
  To have a right to do a thing is not at all the same as to be right in doing it
11. Re:outliers? by tehcyder · 2011-06-09 21:36 · Score: 1
  
  Well at least a sexual braggart knows (or should know) how many he's really slept with.
  Once you get past a couple of hundred, you sort of lose count. Apparently.
  
  --
  To have a right to do a thing is not at all the same as to be right in doing it
12. Re:outliers? by gnick · 2011-06-10 03:56 · Score: 1
  
  If Microsoft say that (made up numbers) a billion people are using pirated copies of Windows for which Microsoft would charge $50 each, then they can legitimately argue that they have lost $50 billion in revenue. It is up to people then to disprove the assumptions made.
  If Microsoft says that a billion people are using pirated copies of Windows that they would have otherwise paid $50 for, then they have $50B in losses. But if there are a billion people using pirated copies that never would have bought the product were it not free, it just means that there is software out there that Microsoft claims is worth $50B. That's a big distinction.
  
  --
  He's getting rather old, but he's a good mouse.
Press releases, on the other hand... by dna_(c)(tm)(r) · 2011-06-09 07:46 · Score: 1

Press releases by a single company, on the other hand are mostly well balanced views on reality, where distorted views are balanced by having a large population providing information.
1. Re:Press releases, on the other hand... by FhnuZoag · 2011-06-09 08:37 · Score: 2
  
  Turn to page 4 of the associated pdf, and look at the figure. 'Chart title'? 'Axis title'? Yeah, this is real professional looking.
Cybercrime victim here! by Qzukk · 2011-06-09 07:47 · Score: 4, Informative

Hackers emailed me a grenade that blew up my PC!
It's true!

--
If I have been able to see further than others, it is because I bought a pair of binoculars.
Those darn "hackers"!!! by jandrese · 2011-06-09 07:49 · Score: 3, Interesting

Some of the worst offenders of this are outfits like the RIAA and MPAA that grossly overstate the impact of piracy in order to legitimize themselves. When a single kid with Limewire deserves a fine larger than the GDP of the entire world for a decade, you know the metrics have lost all basis in reality.

--

I read the internet for the articles.
Everyone exaggerates by Hatta · 2011-06-09 07:50 · Score: 2

Everyone exaggerates how many systems they've penetrated.

--
Give me Classic Slashdot or give me death!
1. Re:Everyone exaggerates by ArsenneLupin · 2011-06-09 08:01 · Score: 1
  
  A couple of years ago, I tried to penetrate Lustrust, but I didn't manage. Indeed, the security hole that I was aiming for was protected by 2 big phat lunar firewalls. However I still managed to deface it, and the defacement stayed for a couple of days...
2. Re:Everyone exaggerates by Anonymous Coward · 2011-06-09 08:11 · Score: 1
  
  I have penetrated many beautiful systems in my day.
  Oh, you were talking about hacking computers?
3. Re:Everyone exaggerates by FhnuZoag · 2011-06-09 08:40 · Score: 1
  
  Well, when your intrusion fingerprint is so small, who can tell if you've even done it at all?
Yes, I have hacked many beautiful women by elrous0 · 2011-06-09 07:50 · Score: 1

You mean the guy down the hall in my apartment building with the mustard stains on his shirt *may* be exaggerating when he tells everyone he's the world's greatest hacker and that his "I could be a millionaire if I wanted to be, but I don't hack for money, so that's why I live here" claim could *possibly* be bullshit?

--
SJW: Someone who has run out of real oppression, and has to fake it.
English. by mcmonkey · 2011-06-09 07:52 · Score: 1

Do the folks at Microsoft speak it?
Verbing weirds language.
1. Re:English. by artor3 · 2011-06-09 08:10 · Score: 1
  
  I'm pretty sure that it wasn't Microsoft who wrote the summary.
Same for piracy and BSA stats ... by gstoddart · 2011-06-09 07:57 · Score: 4, Insightful

Unverified self-reported numbers that come from such people are used as the basis for calculating losses that are based on, at best, guesstimates.
Unfortunately, this is also how Microsoft comes up with numbers for piracy ... they pull them out of their ass, and build guesstimates to suggest they've lost eleventy trillion dollars to piracy. Same goes for the RIAA/MPAA and the BSA. They have no objective numbers.
Microsoft just doesn't like these ones because their OS is at the heart of much of it.
You can't go dissing the methodology when you don't want them to be true, and using the methodology when it suits you. Although, corporations don't seem concerned by such things as logical inconsistencies.

--
Lost at C:>. Found at C.
1. Re:Same for piracy and BSA stats ... by brainzach · 2011-06-09 08:34 · Score: 2
  
  You can use more accurate numbers to estimate the rate of piracy because they don't rely on self reported surveys. If you can determine how many licenses that Microsoft issued in the region and compare it to computers that are running windows update, you can get fairly accurate statistics.
  The amount of profits lost are subject to more debate because you don't know what percentage of sales are lost as a result of piracy. Microsoft will likely overstate this effect while pirates will understate this effect. They both are guilty here.
  It would be interested to see if economists have found ways to reliably measure the effect of piracy on consumer behavior. If they are able to come up with these numbers, you can give a more accurate estimates on the amount of losses to the industry.
2. Re:Same for piracy and BSA stats ... by Eivind · 2011-06-09 18:51 · Score: 1
  
  Agreed. If you can know with reasonable accuracy how many copies of Windows was sold, and how many was installed - then you can make a reasonably good estimate of piracy.
  But it's -real- tricky to estimate economic losses. The maximum is easy, that's just the standard retail price times the count of pirated copies.
  The minimum however, is negative. It's entirely possible that if everyone had to pay full price, the result would be that Windows lost it's dominant position as an OS, and thus that sales would be lower. than they are with piracy.
  Reality, is somewhere in between.
  Where, exactly, is anybodys guess.
There's a difference by PPH · 2011-06-09 08:09 · Score: 1

Sex surveys can use a large number of samples (up to the entire population if funding permits) which will eliminate the outlier bias problem. Victims of cyber crime are a smaller population from which to sample. And those victims are not representative of the Internet community. They are either attractive targets or too stupid to secure their systems. Its like asking blonds with big tits how many partners they've had and extrapolating.
From TFA:

It's well enough established that men claim to have more female sexual partners in sex surveys than women claim male partners, a discrepancy that can't be explained by sampling error alone.
That can be explained by a few women I know. They can take on three men at a time. So unless you correct the survey for them, the numbers won't match.

--
Have gnu, will travel.
1. Re:There's a difference by Anonymous Coward · 2011-06-09 08:16 · Score: 1
  
  The BBC did a study during one of it's sex ed type shows (don't remember which one). They asked males and females about their sexual partners then asked them the same questions under a lie detector. The males tended to over state a little bit (to impress people) while the females understated more (to not seem like sluts).
  The lie detector checked results came out with males and females having the same amount of partners.
2. Re:There's a difference by PPH · 2011-06-09 08:38 · Score: 1
  
  Not an anonymous survey? Of course people will exaggerate.
  The Kinsey Reports, based on anonymized data are remarkably accurate. Consider that their figures for male homosexuality were collected at a time (1948) when such behavior was not socially acceptable, let alone the basis for bragging.
  
  --
  Have gnu, will travel.
3. Re:There's a difference by Toonol · 2011-06-09 08:47 · Score: 1
  
  Men's distribution of partners follows a fairly simple bell curve, with the peak at around four. Women's is more complicated; it peaks at fewer, but trails off more slowly. At the high end, many dozens of partners or more, there are more women than men.
  
  So, a typical woman may have fewer partners than a typical man, even while it all balances out, due to those wonderful girls at the far end of the spectrum.
4. Re:There's a difference by isoloisti · 2011-06-09 08:53 · Score: 1
  
  It's well enough established that men claim to have more female sexual partners in sex surveys than women claim male partners, a discrepancy that can't be explained by sampling error alone.
  That can be explained by a few women I know. They can take on three men at a time. So unless you correct the survey for them, the numbers won't match.
  No, it can't. Suppose one woman sleeps with 100 guys. One woman increased her count by 100, and 100 guys increased their count by 1 each. The average number of heterosexual sex-partners that men and women have had is the same. Do you need me to draw you a diagram?
5. Re:There's a difference by adelgado · 2011-06-09 09:39 · Score: 1
  
  It peaks at four? (????)
  I'm either a manslut, or you're a priest.
  OK, so I do live in Brazil, we're a more open society etc etc etc but ARE YOU A FUCKING AMISH?
  I'm well past four and I don't even think I'm at MY peak yet.
6. Re:There's a difference by PPH · 2011-06-09 11:13 · Score: 1
  
  Now, think about what happens to a statistical sample if you miss that one woman.
  
  --
  Have gnu, will travel.
7. Re:There's a difference by PPH · 2011-06-09 11:54 · Score: 1
  
  It peaks at four? (????)
  I'm either a manslut, or you're a priest.
  Remember, this is Slashdot. Where everyone's girlfreind's last name is JPEG.
  
  I'm well past four and I don't even think I'm at MY peak yet.
  I hit four when I went to band camp in high school.
  
  --
  Have gnu, will travel.
8. Re:There's a difference by isoloisti · 2011-06-09 12:57 · Score: 1
  
  It can't be a bell curve, since the number can't be less than zero. Can be approximately a bell curve either, since it definitely isn't symmetric.
9. Re:There's a difference by tehcyder · 2011-06-09 21:51 · Score: 1
  
  It peaks at four? (????)
  I'm either a manslut, or you're a priest.
  OK, so I do live in Brazil, we're a more open society etc etc etc but ARE YOU A FUCKING AMISH?
  I'm well past four and I don't even think I'm at MY peak yet.
  For most slashdotters it peaks at one, if they've got a sister who needs help with her maths homework on a regular basis..
  
  --
  To have a right to do a thing is not at all the same as to be right in doing it
10. Re:There's a difference by dreampod · 2011-06-09 21:58 · Score: 1
  
  That might make sense if we were talking about a single study but the data is consistently out, in the same manner, across hundreds of studies over several decades. You can't just accidentally miss the really promiscous women every single time (well you could but it is statistically improbable).
  The only two viable explanations I've ever heard (and I use the term loosely for the second) is that either there is consistent incorrect self reporting or extremely promiscous women have such a higher rate of death that they are able to rack up huge numbers of partners and then throw the reporting off by dying and thus no longer being counted.
11. Re:There's a difference by black+soap · 2011-06-10 03:06 · Score: 1
  
  Maybe they are inaccurate in identifying the GENDER of the person they had sex with? what if 50 guys had sex with a tranny, and all report it as a woman, while that tranny identifies (on the anonymous survey) as a man who had sex with 50 men? Or maybe the women are only reporting the MEN they slept with, but some are excluded because the woman afterwards decides some of her partners didn't deserve to be called men?
Definition of Crime by Anonymous Coward · 2011-06-09 08:16 · Score: 2, Insightful

When Microsoft collects $5 per computer license (MAR - Microsoft Authorized Refurbishers) on used PCs donated small schools and internet cafes in African nations, with incomes below $1,000 per year... for used PCs which already had a licensed version of Microsoft... and the people who copy the old license back on for free are "cybercriminals", and the billionaire people who take the $5 from countries where that money could save a child's life from malaria ... It seems to me to be kind of difficult to describe what the "cybercrime" is in the first place, much less reach consensus on whether the count was accurate.
oh, this is victim's survey by rubycodez · 2011-06-09 08:17 · Score: 1

when I saw the phrase "sexual braggadocio" I thought this would be problem caused by boasting of uber-hackers, vis-a-vis Swordfish : "With a gun pressed to my head, I hacked the defense grid with one hand, the World Bank with the other, and the CIA with voice recognition software, while getting a blowjob from two women"
1. Re:oh, this is victim's survey by krgallagher · 2011-06-09 08:31 · Score: 1
  
  Yeah when I read the headline, "What Cybercrime Stats Have In Common With Sexual Braggadocio 25," I thought they were going to find a link between bragging about sex and committing Cybercrime.
  
  --
  Insert Generic Sig Here:
Re:My Hot Girlfriend defused the attack against me by fyngyrz · 2011-06-09 08:24 · Score: 1

I'm the kind of guy who's got a badass girlfriend.
You know, there are females out there with good asses.

--
I've fallen off your lawn, and I can't get up.
So this applies to the RIAA/MPAA as well? by Anonymous Coward · 2011-06-09 08:49 · Score: 1

So this 'over reporting' and overstating and exaggeration of loss applies to the MPAA/RIAA too right? After all, just two months ago they claimed losses in the trillions of US dollars, and yet the sum they quoted was many times more than their entire industries made -adjusted for inflation- worldwide for the entire time of their existence. Yet draconian laws created by them and enacted by bribed corrupt politicians and enforced by punishment-does-in-no-way-fit-the-crime law enforcement agencies happens at an increasing and alarming rate every day. Civil liberties are abolished under these brown-shirts, everyone including all of the customers they have ever had are suddenly all criminals.
1. Re:So this applies to the RIAA/MPAA as well? by isoloisti · 2011-06-09 13:01 · Score: 1
  
  Not sure this work really talks about RIAA. I don't think the RIAA estimates were done from self-report surveys, but they're still just made-up numbers. It seems to be the rule in anything related to cyber-foo that you make up loss estimates, and nobody questions them so long as a) they're big and b) bigger than last year's numbers and c) you use them to claim a "growing crisis."
Ony two? by denzacar · 2011-06-09 08:54 · Score: 1

And three hacks?
Dude! Everyone knows that it's one babe per hack. By accepting such low standards you're screwing up the surveys.

--
Mit der Dummheit kämpfen Götter selbst vergebens
1. Re:Ony two? by rubycodez · 2011-06-09 16:47 · Score: 1
  
  oh......third woman......lesseee...."with the dominatrix pressing the lubed suppressor of her Mac-10 into my rectum,,,,....."
Dateless nerds assume no one is really getting any by Rogerborg · 2011-06-09 21:40 · Score: 1

Microsoft assume no one is really getting hacked.
Sorry nerds, some of us really are sexual tyrannosaurs.

--
If you were blocking sigs, you wouldn't have to read this.
Re:Be Devilled? by tehcyder · 2011-06-09 22:04 · Score: 1

Does anyone REALLY use bedevilled in a negative context these days? It means to de vile or to remove vile people. Just to correct your paranoid lies there ...
No, bedevil means to torment or annoy. The root is be-devil not de-vile.

--
To have a right to do a thing is not at all the same as to be right in doing it
Re:They could as well claim male sparrows brag by tehcyder · 2011-06-09 22:09 · Score: 1

What about African swallows though?

--
To have a right to do a thing is not at all the same as to be right in doing it
Re:Dateless nerds assume no one is really getting by black+soap · 2011-06-10 03:14 · Score: 1

Sorry nerds, some of us really are sexual tyrannosaurs.
Sorry, I'm not getting your metaphor. Does that mean you haven't had a chance to reproduce in millions of years, or that you have stubby almost useless appendages?
I see another connection here... by painehope · 2011-06-11 13:36 · Score: 1

Maybe the people complaining about cybercrime just need to get laid.

--
PC moderators can suck my White pierced, tattooed dick. If you think pride == hate, s/dick/Aryan meat mallet/g.
Speaking of growing crises and sex... by painehope · 2011-06-11 13:38 · Score: 1

I'm going to the bar to get laid and stop discussing people that are vain idiots...

--
PC moderators can suck my White pierced, tattooed dick. If you think pride == hate, s/dick/Aryan meat mallet/g.