- The paper develops STRIKE through a four-phase literature review and framework-mapping process, organizing eight cybercrime categories around attack vectors, targets, impacts, adversary behavior, detection, and mitigation.
- STRIKE connects threats such as ransomware, phishing, supply chain attacks, cryptojacking, CSAM, cyberbullying, APTs, and deepfake fraud to practical controls including MFA, offline backups, monitoring, content hashing, SBOMs, and provenance tools.
- The taxonomy offers an adaptable reference for researchers, defenders, and policymakers, but requires empirical validation because it reports no classification-accuracy, inter-rater-reliability, or operational-triage benchmarks.
Motivation and positioning
STRIKE (Structured Taxonomy for Risk, Impact, Knowledge, and Emerging Threats) is a multi-dimensional classification framework for cybercrime developed at Troy University. The authors argue that existing taxonomies and ontologies are largely static and definitional: they predate the current threat landscape dominated by Ransomware-as-a-Service (RaaS), double extortion, deepfake-enabled social engineering, cryptojacking, and supply chain compromises, and they rarely connect categories to concrete detection, mitigation, and response practices. STRIKE's distinguishing claim is that impact analysis, adversary behavior, and mitigation strategies are treated as integral classification dimensions rather than afterthoughts, and that underrepresented crimes—CSAM, synthetic identity fraud, deepfake-based impersonation—are incorporated alongside conventional threats such as ransomware, phishing, and network intrusion.
The paper is motivated by well-documented escalation: the WannaCry outbreak detected over 213,000 times across 112 countries, Europol's 2023 IOCTA identifying ransomware as the dominant threat, and the COVID-19 pandemic's expansion of the attack surface through remote work and cloud dependence.
Methodology
The framework was constructed through a four-phase process. First, a structured literature review spanning IEEE Xplore, ACM Digital Library, SpringerLink, and arXiv (primarily 2017–2024) categorized sources by cybercrime domain and analyzed them along consistent dimensions: attack vectors, adversarial techniques, targets, impact, detection, and mitigation. Second, extracted characteristics were synthesized into two artifacts—an attack-profile view linking techniques, vectors, attackers, targets, and impacts, and a defense-oriented table mapping each category to detection, mitigation, and prevention strategies. Third, the taxonomy was mapped against established frameworks including the NIST Cybersecurity Framework, MITRE ATT&CK, Europol IOCTA, Verizon DBIR, and GAO's SolarWinds report. Fourth, real-world scenarios were integrated to contextualize each category.
A notable limitation of this methodology is that validation is by cross-mapping to existing frameworks rather than by empirical evaluation; no quantitative measure of inter-rater reliability, coverage completeness, or classification accuracy is reported.
Taxonomy structure and per-category findings
STRIKE covers eight categories: ransomware, network intrusions/APTs, phishing and social engineering, CSAM, cyberbullying, supply chain attacks, cryptojacking, and deepfake-enabled fraud. Each is profiled across delivery method, impact profile, attacker motivation, and countermeasures. Several findings carry strong numerical or otherwise notable claims:
- Ransomware: only approximately 2.9% of victims ultimately pay the ransom, yet with typical demands of $50–$200 at scale, one economic estimate places monthly attacker earnings as high as $394,400 after laundering costs. The paper also concedes that supervised-learning detectors lack the ability to generalize to novel ransomware families.
- Phishing: over 15,000 phishing websites are created daily, roughly 95% automatically generated by attacker infrastructure; phishing remains the most common initial access vector for ransomware.
- Cyberbullying: surveys estimate up to 35% of adolescents have experienced online harassment, and victims are reported to be twice as likely to attempt suicide compared to non-victims—a claim drawn from prior psychological literature rather than established independently here.
- Cryptojacking: Symantec data cited in the paper reports an 8,500% growth in incidents between 2017 and 2018, and a recent measurement study found that more than half of surveyed websites remained malicious, hosting mining scripts such as CoinHive and Webminepool, with infrastructure overlapping phishing and malware distribution.
- CSAM: machine learning-based detection accuracy varies widely between 70% and 85%, with false positives remaining an open problem—an honest concession that limits operational claims for automated content moderation.
- Deepfake-enabled fraud: the paper highlights the "liar's dividend," whereby authentic evidence can be dismissed as fabricated, as an erosion-of-trust effect that detection technology alone cannot reverse.
For each category, the paper consolidates emerging challenges: double/triple extortion and RaaS lowering entry barriers (ransomware); AI-personalized spear phishing and adversarial evasion of spam filters (phishing); living-off-the-land techniques and zero-day exploitation (APTs); encrypted platforms and AI-generated synthetic CSAM; ephemeral messaging and algorithmic amplification (cyberbullying); cloud/IoT targeting and polymorphic malware (cryptojacking); tool accessibility and regulatory gaps (deepfakes); and CI/CD pipeline compromise with widespread downstream impact (supply chain).
Detection and mitigation synthesis
The defensive dimension of STRIKE aggregates mature techniques per category: file-system monitoring, entropy analysis, honeypots, and memory forensics for ransomware; perceptual hashing (PhotoDNA) and CNN-based classifiers for CSAM; NLP toxicity detection for cyberbullying; resource-anomaly and mining-pool traffic monitoring for cryptojacking; frequency-domain analysis, liveness detection, voice biometrics (e.g., ASVspoof), and blockchain/watermarking-based provenance for deepfakes; and SBOM diffing, code signing, and vendor auditing for supply chain integrity. Prevention recommendations are correspondingly conventional but layered: offline backups, MFA, DMARC/SPF/DKIM enforcement, zero-trust architecture, secure development lifecycles, and user education. The paper's contribution here is organizational—binding these practices to taxonomy entries so that a defender can move from category identification directly to a candidate control set—rather than proposing new detection methods.
Limitations and open questions
Several limitations are acknowledged or evident. The taxonomy's validation is qualitative; there is no empirical demonstration that STRIKE improves incident triage, benchmark comparison, or policy formulation relative to existing schemes. Several quantitative claims are inherited from secondary sources of varying rigor (industry reports, blog posts, and non-peer-reviewed estimates), including the ransomware payment economics and cryptojacking growth figures. The paper itself notes that supervised detection approaches fail against novel variants, that end-to-end encryption degrades packet-level visibility for intrusion detection, and that legal and jurisdictional gaps—particularly for synthetic CSAM and cross-border cyberbullying enforcement—remain unresolved. Finally, the authors state that the taxonomy must be extended continuously as new attack manifestations appear, leaving open whether its eight-category structure will remain exhaustive without structural revision rather than mere addition.
Conclusion
STRIKE contributes a unified, extensible classification of eight major cybercrime categories organized around attack vectors, operational and informational impact, adversary profiles, targets, and defenses, explicitly bridging theoretical taxonomy work with operational detection and mitigation practice. Its principal value is integrative: consolidating fragmented literature, industry reporting, and framework mappings into a single reference usable by researchers, practitioners, and policymakers. The open question the authors identify for future work is whether the taxonomy can be used to model the action space of attackers in support of building adaptive defense systems—an empirical program that remains to be carried out.