RECORD
Revenue Maximizing Markets for Zero-Day Exploits
Computer Science and Game Theory · Submitted 25 Jun 2020
abstract compiled · 2026-09-23 · no language-model review
The authors' main claim Considering the above, our proposed mechanism discloses the details of the exploit to all offenders before the auction.
The compiled record
The paper's own sentences, arranged. Each label is drawn from a closed vocabulary; the number beside it is the probability the classifier gave that label. Numbers in the tables are the authors', checked by code. No sentence in this record was written by a model.
Open the compiled record
The abstract, sentence by sentence
Markets for zero-day exploits (software vulnerabilities unknown to the vendor) have a long history and a growing popularity. We study these markets from a revenue-maximizing mechanism design perspective. We first propose a theoretical model for zero-day exploits markets. In our model, one exploit is being sold to multiple buyers. There are two kinds of buyers, which we call the defenders and the offenders. The defenders are buyers who buy vulnerabilities in order to fix them (e.g., software vendors). The offenders, on the other hand, are buyers who intend to utilize the exploits (e.g., national security agencies and police). Our model is more than a single-item auction. First, an exploit is a piece of information, so one exploit can be sold to multiple buyers. Second, buyers have externalities. If one defender wins, then the exploit becomes worthless to the offenders. Third, if we disclose the details of the exploit to the buyers before the auction, then they may leave with the information without paying. On the other hand, if we do not disclose the details, then it is difficult for the buyers to come up with their private valuations. Considering the above, our proposed mechanism discloses the details of the exploit to all offenders before the auction. The offenders then pay to delay the exploit being disclosed to the defenders.
background contribution method result interpretation main claim
| # | sentence | role | the authors' own work | states the main conclusion | strength |
|---|---|---|---|---|---|
| s0 | Markets for zero-day exploits (software vulnerabilities unknown to the vendor) have a long history and a growing popularity. | background 1.00 | 0.04 | 0.02 | asserted 1.00 |
| s1 | We study these markets from a revenue-maximizing mechanism design perspective. | contribution 0.99 | 0.88 | 0.04 | asserted 0.92 |
| s2 | We first propose a theoretical model for zero-day exploits markets. | contribution 0.61 | 0.93 | 0.03 | asserted 0.99 |
| s3 | In our model, one exploit is being sold to multiple buyers. | method 0.81 | 0.38 | 0.03 | asserted 1.00 |
| s4 | There are two kinds of buyers, which we call the defenders and the offenders. | method 0.75 | 0.62 | 0.02 | asserted 1.00 |
| s5 | The defenders are buyers who buy vulnerabilities in order to fix them (e.g., software vendors). | method 0.51 | 0.12 | 0.02 | asserted 1.00 |
| s6 | The offenders, on the other hand, are buyers who intend to utilize the exploits (e.g., national security agencies and police). | method 0.55 | 0.19 | 0.02 | asserted 1.00 |
| s7 | Our model is more than a single-item auction. | contribution 0.69 | 0.63 | 0.03 | asserted 1.00 |
| s8 | First, an exploit is a piece of information, so one exploit can be sold to multiple buyers. | contribution 0.40 | 0.19 | 0.03 | asserted 1.00 |
| s9 | Second, buyers have externalities. | contribution 0.45 | 0.37 | 0.03 | asserted 1.00 |
| s10 | If one defender wins, then the exploit becomes worthless to the offenders. | method 0.57 | 0.29 | 0.05 | asserted 1.00 |
| s11 | Third, if we disclose the details of the exploit to the buyers before the auction, then they may leave with the information without paying. | background 0.72 | 0.16 | 0.03 | hedged possibility 1.00 |
| s12 | On the other hand, if we do not disclose the details, then it is difficult for the buyers to come up with their private valuations. | background 0.73 | 0.21 | 0.03 | asserted 0.66 |
| s13 | Considering the above, our proposed mechanism discloses the details of the exploit to all offenders before the auction. | method 0.82 | 0.84 | 0.24 | asserted 1.00 |
| s14 | The offenders then pay to delay the exploit being disclosed to the defenders. | method 0.82 | 0.69 | 0.29 | asserted 1.00 |
What was examined, and what was not
- arXiv listing abstract v1
- full text
- figures and tables
- references and citing sentences
- relations to other papers
- P abstract
- S sections
- T body sentences
- C citations
- R cross-paper relations
The paper
Original abstract
Markets for zero-day exploits (software vulnerabilities unknown to the vendor) have a long history and a growing popularity. We study these markets from a revenue-maximizing mechanism design perspective. We first propose a theoretical model for zero-day exploits markets. In our model, one exploit is being sold to multiple buyers. There are two kinds of buyers, which we call the defenders and the offenders. The defenders are buyers who buy vulnerabilities in order to fix them (e.g., software vendors). The offenders, on the other hand, are buyers who intend to utilize the exploits (e.g., national security agencies and police). Our model is more than a single-item auction. First, an exploit is a piece of information, so one exploit can be sold to multiple buyers. Second, buyers have externalities. If one defender wins, then the exploit becomes worthless to the offenders. Third, if we disclose the details of the exploit to the buyers before the auction, then they may leave with the information without paying. On the other hand, if we do not disclose the details, then it is difficult for the buyers to come up with their private valuations. Considering the above, our proposed mechanism discloses the details of the exploit to all offenders before the auction. The offenders then pay to delay the exploit being disclosed to the defenders.
Human review
Discussion
Know something about this paper? Leave a comment, or highlight any passage above to comment on it.