论文标题
收入最大化零日漏洞的市场
Revenue Maximizing Markets for Zero-Day Exploits
论文作者
论文摘要
零日漏洞利用（供应商未知的软件漏洞）的市场历史悠久，而且越来越受欢迎。我们从收入最大化机制设计的角度研究这些市场。我们首先为零日利用市场提出了一个理论模型。在我们的模型中，一个利用正在出售给多个买家。有两种买家，我们将其称为捍卫者和罪犯。捍卫者是购买漏洞以修复漏洞的买家（例如，软件供应商）。另一方面，罪犯是打算利用漏洞利用的买家（例如国家安全机构和警察）。我们的模型不仅仅是单项拍卖。首先，利用是一条信息，因此可以将一个利用出售给多个买家。第二，买家有外部性。如果一个防守者获胜，那么对罪犯的漏洞将一文不值。第三，如果我们在拍卖会之前向买家披露了剥削的详细信息，那么他们可能会在不付款的情况下离开信息。另一方面，如果我们不透露细节，那么买家很难提出他们的私人估值。考虑到上述情况，我们提出的机制在拍卖前向所有罪犯披露了剥削的细节。然后，罪犯付费以推迟被披露给辩护人的剥削。
Markets for zero-day exploits (software vulnerabilities unknown to the vendor) have a long history and a growing popularity. We study these markets from a revenue-maximizing mechanism design perspective. We first propose a theoretical model for zero-day exploits markets. In our model, one exploit is being sold to multiple buyers. There are two kinds of buyers, which we call the defenders and the offenders. The defenders are buyers who buy vulnerabilities in order to fix them (e.g., software vendors). The offenders, on the other hand, are buyers who intend to utilize the exploits (e.g., national security agencies and police). Our model is more than a single-item auction. First, an exploit is a piece of information, so one exploit can be sold to multiple buyers. Second, buyers have externalities. If one defender wins, then the exploit becomes worthless to the offenders. Third, if we disclose the details of the exploit to the buyers before the auction, then they may leave with the information without paying. On the other hand, if we do not disclose the details, then it is difficult for the buyers to come up with their private valuations. Considering the above, our proposed mechanism discloses the details of the exploit to all offenders before the auction. The offenders then pay to delay the exploit being disclosed to the defenders.
