Averages don’t characterise the heavy tails of ransoms

Abstract

The Bitcoin block-chain is the scoreboard of Ransomware. By mining the data in it and within the malware itself, we can understand the distribution of ransoms and characterise ransomware risk. Ransoms follow the power-law distribution in their amounts. The alpha parameter (α) of those power laws suggest they do not have a well defined average for most years in our study. Indeed, there has not been an α above 2 since 2015 and so there has not been a stable ransomware average since that time. The changing α has strong implications for cyber risk management and policy responses to ransomware attacks.