{'fraction_non_alphanumeric': 0.02327173169062286, 'fraction_numerical': 0.0, 'mean_word_length': 5.194915254237288, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
The Botnet Revenue Model

Botnets have always been an insidious threat. The development of the "Internet Of Things" and its for-profit exploitation contributed to botnets spread and sophistication, but also to the rise of maturity of both organizations and business models behind them. Cybercrime market had a recent major leap in quality, starting from payload development (malware), sophisticated enough to allow a high degree of customization and polymorphism, subsequently used by organizations more and more structured and specialized to provide real, efficient and profitable criminal cyberservices. The purpose of this paper is to describe the pillars of the supply chain of botnets, in order to highlight that the criminal market behind their spread is mature enough to prefer a revenue model based on service rentals, instead of direct monolithic implementation. We also describe a possible measure of botnets effectiveness in order to identify vulnerabilities. As we will see, an extension of the Pay-Per-Install business model (widely used) throughout the whole supply chain, is the natural evolution of what has already happened in the spread of many botnets, allowing the low-risk growth of other productive borderline sectors. This should be considered, in our opinion, as one of the major concern about the future trends of botnets diffusion and would simply confirm the maturity of this market in its recent meaning of "Cybercrime-As-a-Service".