8th Annual INTERPA
Conference 11-13 February 2019
Gujarat, INDIA 
Theme: cyber security and combating cyber-crime
Subtheme: Modern Techniques on Combating Cybercrimes 
Mohammed Alfateh Hassouna 
The National Ribat University Khartoum -Sudan m.fateh@ribat.edu.sd 
Abstract. So far, development and enhancement of global communication networks, distribution of software, and continuous updating and upgrading for computer systems are accompanied by the evolution of criminal environment with the latter evolving not only within one particular nation, but throughout the international community. New opportunities in Cybercrimes translate into new threads for global information systems/networks as long as community as a whole. Therefore, preventing and combating Cybercrimes requires substantial strengthening of legislations and regulations in the national, regional and international levels in one hand, and information security controls/measures in the other hand. Hence, Cybercrimes combating requires an approach that is completely diﬀerent from that applied to combating conventional crimes. This paper presents modern and innovative technologies in combating Cybercrimes and ever-increasing signiﬁcance of information security as a system of protecting private, public and even international cyber assets such as information, networks and internet services. Furthermore, the paper addresses the best practices and some recommendations for the national governments/enterprises and international community to combat and overcome Cybercrimes. 
Keywords: 
Cybercrimes, Cyber Security, Cyber Space, Information Security Controls 
1 Introduction 
As information and telecommunication technologies develop and evolve, global availability of the Internet constantly increases, and hardware and software are upgraded and enhanced, criminal environment also evolves in the context of new opportunities for cyber criminals. All these factors determine the need for substantial strengthening of information security measures both within one particular nation and throughout the international community. Today no one is surprised by a steady growth in the news on cyber crime and the related court proceedings. 
As a consequence, Cyber security has become a matter of global interest and importance. Already more than 50 nations have oﬃcially published some form of strategy document outlining their oﬃcial stance on cyberspace, cyber crime, and/or cyber security [2]. The USA Whitehouse [30] has outlined a cyber strategy that provides the stance of the United States of America (USA) on cyber-related issues and outlines a uniﬁed approach to the USA’s engagement with other countries on cyber issues. The United Kingdom (UK) lists cyber security as a top priority and has committed 650£ million over four years for a transformative National Cyber Security Programme[13]. In Russia, liability for cyber crime is stipulated in Chapter 28 and Article 159.6 of the RF Criminal Code[5]. 
In Asia, many countries developed their own laws and legislations, China and India however are two of the ﬁrst countries that stated and implemented cyber crime laws and regulations, China in its Computer Information Network and Internet Security, Protection and Management Regulations that is published in December 1997[24] and India which is explained in The Information Technology Act 2000 and the I.T. Amendment Act 2008[15]. In Arab and Middle East, many Gulf Cooperation Council (GCC) countries developed/updated their laws to be suite with the nature of cybercrimes, countries included are Bahrain, Kuwait, Oman, Qatar, Saudi Arabia and the UAE[16]. Furthermore, several Africa countries also developed their own legislations and regulations, Sudan has special law called Cybercrime Law which is published in 2007[22], South Africa has approved its law since 2002 which is called The Electronic Communications and Transactions ACT[25]. 
At the other side, since the scope of Cybercrime exceed the boundaries of countries, there exists many international conventions and agreements related to Cybercrimes and Cybersecurity that group together several countries in order to combat and ﬁght cross-boundary Cybercrime. On June 1, 2001 in Minsk, Agreement of the Commonwealth Independent States (CIS) countries on cooperation in Cybercrime ﬁghting was concluded, article 1 stating that a Cyber-crime is a criminally punished act where the subject of violence is computer information[20], Budapest Cybercrime Convention(ETS No.185) of the Council of Europe which is signed 23 November 2001[20] which stated that ”cybercrimes are acts against conﬁdentiality, entirety and accessibility of computer systems, networks and computer data and abuse of such systems, networks and data”. Thereafter, many standardised organizations made standard drafts and guidances related to Cybercrime and Cybersecurity and their relations to law, information security and Information and Communication Security (ICT Security). Such drafts are The International Communication Union (ITU)[18], The International Standard Organisation draft (ISO/IEC 27032:2012(E))[12]. 
This paper make a survey of the diﬀerent ways and methods to combat Cybercrimes, it ﬁrst deﬁne the Cybercrime, explain its types and methods, the modern and innovative technical methods and techniques to combat such crimes. 
The structure of the paper as follows, Section 2 shows the backgrounds and basic deﬁnitions of Cybercrime. Section 3 stated the diﬀerent types of Cyber-crimes. Section 4 covers the methods that are used by the cyber criminal to commit Cybercrime. Section 5 addresses the modern techniques for combating Cybercrimes. Finally, Section 6 concludes the paper and state the recommendations relating combating Cybercrimes. 
2 Backgrounds about Cybercrimes 
There are at present a large number of terms used to describe crimes involving computers. Such terms include computer-related crimes, computer crimes, internet crimes, e-crimes, digital crimes and cybercrimes. This section provides some deﬁnition from well known international and standard entities. 
2.1 Cyber Crime Deﬁniton 
One deﬁnition of cyber crime is provided in the Convention on Cyber Crime (ETS No. 185) of the Council of Europe[23], Cyber crime is deﬁned as ”illegal actions committed using electronic operations that violate security of computer systems and that of data processed therein”. It includes solely computer crime in the form of distributing viruses, hidden remote operation of computer systems (spamming, theft of information assets, channel congestion), interception of IP addresses and mobile traﬃc, stepping-up of tactical activities in cyber space, economic and ﬁnancial crime in infosphere. 
According to 2004 Convention on Cybercrime (Budapest), ”Cybercrimes are acts against conﬁdentiality, entirety and accessibility of computer systems, networks and computer data and abuse of such systems, networks and data”. 
According to Keyser[19], the USA Department of Justice deﬁnes computer crime as ”any violations of criminal law that involve a knowledge of computer technology for their preparation, investigation or prosecution”. Symantic Corporation [9] deﬁnes Cybercrime broadly as ”any crime that is committed using a computer or network, or hardware device”. 
The Australian Center for Police Research (ACPR)[11] deﬁnes Cybercrime as ”oﬀences where a computer used as a tool in the commission in an oﬀence, as a target of an oﬀence, or used as storage device in the commission of an oﬀence”. 
All the above deﬁnitions are very similar to the deﬁnitions of crimes related to computer and information security. But, in fact cyber oﬀence is diﬀerent from oﬀences related to the computer and information technology in that it adds another new dimension in the target of the oﬀence, the human and society dimension, and in Cybercrime the information which is considered as the target of attack in information security, be the tool and method of attack in Cybersecurity. To clarify this point, next section deﬁnes the terms information security, information and communication security and Cybersecurity, and discuses the diﬀerent and relations between them. 
2.2 Information Security, ICT Security and Cybersecurity 
The international standard, ISO/IEC 27002 (2005), deﬁnes information security as the preservation of the conﬁdentiality, integrity and availability of information (ISO/IEC 27002, 2005, p. 1). In the context of ISO/IEC 27002 (2005), information can take on many forms. It can be printed or written on paper, stored electronically, transmitted by post or electronic means, shown on ﬁlms, conveyed in conversation, and so forth. 
Whitman and Mattord[31] deﬁned information security as ”the protection of information and its critical elements, including the systems and hardware that use, store, and transmit that information”. It is important to note that there is a diﬀerence between information security and information technology (or information and communication technology) security which is known as ICT security. 
Information and communication technology (ICT) security deals with the protection of the actual technology-based systems on which information is commonly stored and/or transmitted. The international standard ISO/IEC 13335-1 (2004) deﬁnes ICT security as all aspects relating to deﬁning, achieving and maintaining the conﬁdentiality, integrity, availability, non-repudiation, accountability, authenticity, and reliability of information resources[?]. Since information security includes the protection of the underlying information resources, it can be argued that ICT security is a sub-component of information security. 
The deﬁnition of ICT security is thus very similar to that of information security. However, additional characteristics, which in this context could be better described as services that should be provided by secure information resources, are added to the deﬁnition. These include non-repudiation, accountability, authenticity and reliability. 
From the deﬁnitions that mentioned above of information security and ICT security, it should be clear that there is a diﬀerence between securing information resources and securing ICT resources. A secure information resource could include any entity from which information is received or to which information is sent. A secure information technology resource is a secure information resource that happens to reside on an information technology system. It is also important to note that, in terms of ICT-based systems, the information alone cannot be deemed to be secure unless all resources and processes dealing with that information are secure as well. 
The International Telecommunications Union (ITU) [18] deﬁnes cyber security as follows: Cybersecurity is the collection of tools, policies, security concepts, security safeguards, guidelines, risk management approaches, actions, training, best practices, assurance and technologies that can be used to protect the cyber environment and organization and user’s assets. Organization and user’s assets include connected computing devices, personnel, infrastructure, applications, services, telecommunications systems, and the totality of transmitted and/or stored information in the cyber environment. Cybersecurity strives to ensure the attainment and maintenance of the security properties of the organization and user’s assets against relevant security risks in the cyber environment. The general security objectives comprise the following: 
	Availability: Makes sure that authorized users always access the network and its resources 
	Integrity: Assures the accuracy of data. Integrity may include authenticity and non-repudiation 
	Conﬁdentiality: Limits the data access to authorized users only 

This deﬁnition is very similar to that of information security. But, boundaries of cyber security as a concept are wider than those of information security in terms of how it is formally deﬁned. This viewpoint is supported by the international standard ISO/IEC 27032:2012(E)[12]. If cyber security is synonymous with information security it would be reasonable to assume that cyber security incidents could also be described in terms of the characteristics used to deﬁne information security. Thus, a cyber security incident would, for example, also lead to a breach in the conﬁdentiality, integrity or availability of information. 
This is true for the majority of cyber security related threats a user and/or organisation might be exposed to. However, there are cyber security threats that do not form part of the formally deﬁned scope of information security. This section will brieﬂy present a few scenarios as examples. 
The ﬁrst scenario is Cyber bullying: It has become a major concern to modern society. According to Martin and Rice[21], several recent studies have found that technology is increasingly used to bully, ”cause embarrassment, invoke harassment and violence, and inﬂict psychological harm”. This could lead to ”severe and negative impacts on those victimized”. However, being bullied in cyberspace does not constitute a loss of conﬁdentiality, integrity or availability of information. Instead, the target of such activities is the user him/herself. Accordingly, cyber bullying results in direct harm to the person being bullied. 
The second scenario is Cyber Terrorism: Cyber terrorists or enemy specialists may target a country’s critical infrastructure via cyberspace. This could either be indirectly, for example by inﬂuencing the availability of information services using denial-of-service attacks or, more directly, through an attack on the national electricity grid. In the case of attacks against such critical infrastructure, the loss entails not only of that of the integrity or availability of information resources, but also that of access to such critical services. In this case, it is neither the information itself nor the individual information user that is at risk, but rather the wellbeing of society as a whole. 
These scenarios deal with a speciﬁc aspect of cyber security where the interests of a person, society or nation, including their non-information based assets, need to be protected from risks stemming from interaction with cyberspace. This serves to highlight the diﬀerence between information security and cyber security. Figure 1 which is borrowed from Solms and Niekerk comparison paper[28] showed the diﬀerence and interrelation between information security, ICT security and cybersecurity. 
3 Types of Cybercrimes 
As stated in [6] and [1], Cybercrime has the following types. 
1. Cyberviolence: The violence created in real world with the help of a computer system or any device (like mobile) connected to the Internet is known 

Fig. 1. The relationship between information and communication security, information security, and cyber security 
as cyberviolence. Where the word ”violence” is present, its eﬀect in terms of harm will be there and it can be device, software, data, individual or even the whole society. Cyberviolence has many forms: 
	Cyberwar War. It is the maximum level of Cyberviolence which will aﬀect every individual, military, country, hackers, and government and private employees. Its aim is to destroy the infrastructure and resources based on the Internet system of rival or enemy country. 
	Cyberterrorisom. There are some people or groups which have only aim of destroying the humanity known as terrorists. They believe that they are doing this to make their religion more powerful in the world or they have only right to command over the world or no other can be stronger than them.They can use any type of cyberattack to fulﬁl their aim. 
	Cyberstalking. The use of Internet to repeatedly harass another person group, or organization. This harassment could be sexual in nature, or it could have other motivations including anger. 
	Cyberrevenge. The aim of cyberrevenge is to destroy the enemy by various ways like exposing their conﬁdential information, destroying their 

computer-based infrastructure and resources, and making their false image on the Internet system. The cyberrevenger does that by stealing and change the conﬁdential information of enemy for his/her vested interests. 
2. Cyberpeddler: Cyberpeddler is an act of doing something illegal or stealing someone’s conﬁdential data with the help of a computer system connected to the Internet. There are basically two types of cybercrimes in this category: 
	Cyberfraud. The act of making ﬁnancial or personal gain by deception is known as cyberfraud. The main aim of fraud is to gain beneﬁts in terms of money by doing acts in which the hacker can manipulate the users to get their conﬁdential information and then uses this information for his/her vested interests. 
	Cyberactivism. In this type of crime, Internet-based social and communication applications are used to create, operate, and manage the activism like faster communication with people or the distribution of information to a large audience in a few seconds. The communication technologies used in this activism are Twitter, Facebook, YouTube, LinkedIn, Whatsapp, Gmail, and so on. 

3. Cybertrespass: Trespass means crossing boundaries for which someone is not authorized. Cybertrespass is the crime in which cyberlaw is violated by hacking an authorized user system. This type of attack violates the conﬁdentiality and integrity fundamental of cybersecurity and has various types: 
	Cybertheft. Theft means there is a fear of something important that can be damaged or stolen. Cybertheft in the cyberspace can be done by technically hacking someone’s computer system connected to the Internet. In cyberworld, hackers have the aim of stealing/damaging information and data on the cyberspace for ﬁnancial or personal gain. 
	Cyberespionage. It is also known as cyberspying. It is the act of tracking the activity of individual, company, organization, country, enemy, or rival by performing malicious activities on the network. 
	Cyberpornography. It is the attack in which an attacker posts sexual or nude material of his/her target on public websites. The attacker can ﬁnd the private material of his/her target by hacking the target computer system, mobile, security cameras, or tablet. This type of exposure of private pictures or videos makes shame to the target of the attacker. 

4. Cybersquatting: It is the cybercrime in which an attacker illegally registers the name of the trademark of others as domain name so that the owner of the trademark fails to register his/her trademark as domain name. The various types of cybersquatting are: 
	Classic Cybersquatting. It is the same as cybersquatting, but the main aim of the cybersquatter is to get paid. When the cybersquatter gets ransom from his/her target, he/she sells oﬀ or deletes his/her domain name. 
	Derogatory Cybersquatting. In this type, the cybersquatter’s main aim is to destroy the reputation of his/her target. A cybersquatter does this by various means like posting the pornographic material, hate speech, or violated contents on that domain name. 
	Typographical Cybersquatting. In this type of attack, the attacker cannot use the same name as the trademark because the owner of the trademark had already registered for the domain name. So, in this case, the attacker registers with the name very similar to the original trademark name. 

Figure 2 summarises the diﬀerent types of Cybercrime. 

Fig. 2. Cybercrime Types 
4 Methods for Committing Cybercrimes 
Cyberattacks are the techniques used by cybercriminals to disrupt the fundamental principles (conﬁdentiality, integrity, and availability) of cybersecurity. In this section, we classify the methods of cyberattacks regarding the the above mentioned basic security aspects. 
1. Attacks on Conﬁdentiality: It is detected that there are many kinds of attacks on conﬁdentiality of network information: 

	Traﬃc Analysis. In the traﬃc analysis attack, an attacker analyses the information on the network between the sender and the receiver without any tampering in it. The attacker makes analysis of information on the network to ﬁnd some new information to steal conﬁdential information. 
	Eavesdropping. Eavesdropping means secretly listening to a conﬁdential conversation on the network. The attacker can read and capture the information on the network between the sender and the receiver. 
	Snooping. It is the passive form of attack where the attackers attempt to obtain conﬁdential information about network users like login credentials of email, social apps, online banking, and so on or their personal records. The corporate sector or government oﬃcials use the snooping method to track their employees’ activities for various purposes. 
	Password Attacks. Password-based attacks are used to get the username and password of authorized users of an application, website, desktop computers, and laptops. The most known methods of this attack are Brute-force attack and Dictionary attack. 
	Keylogger. Keylogger is a type of malware that runs in the background of a computer system in the hidden mode, it has no icon or entry on desktop, quick launch, all programs, or anywhere else in the computer system. All the information entered by the user is captured by keylogger and transmitted to the attacker without the knowledge of the authorized user of that computer system. 
	Social Engineering. Is a type of attack in which someone with very good interactive skills manipulates others into revealing information about the network that can be used to steal data of authorized users of an organization or an individual. 
	Phishing. Phishing means trying to fool people into parting with their money. Phishing refers to the receipt of unsolicited emails by customers of ﬁnancial institutions, requesting them to enter their username, password or other personal information to access their account. The criminal then has access to the customer’s online bank account and to the funds contained in that account. The customers click on the links on the email to enter their information, and so they remain unaware that the fraud has occurred. 

2. Attacks on Integrity: A huge number of attacks can be found to disrupt the integrity of network information which are: 
– Salami Attacks. These attacks used for committing ﬁnancial crimes. The key here is to make the alteration so insigniﬁcant that in a single case it would go completely unnoticed e.g. a bank employee inserts a program into bank’s servers that deducts a small amount from the account of every customer. 
– Data Diddling Attacks. Is an illegal or unauthorized data alteration. For example, account executives can change the employee time sheet information of employees before entering to the HR payroll application. 
– Cross-Site Scripting (XSS). In this attack, an attacker uses vulnerable websites or applications. The hacker inserts his/her malicious script into 
that website or application that a target user visits. When the target visits that vulnerable website, the hacker’s malicious code is transferred to the victim’s browser, this malicious script can access sensitive information like cookies and session from the victim’s browser. 
– SQL Injection Attack. It is also an injection attack like cross-site scripting. But this attack uses the vulnerabilities of database SQL statements. This attack aﬀects the web application database. 
– Session Hijacking Attacks. Session hijacking is another type of network attack where the attacker alters session between two or more authorized users to gain authorized access to information or services used by authorized users. 

3. Attacks on Availability: There are various methods that can be used to slow down or stop the availability of network resources to the authorized users of the Internet and its resources: 
	DoS. DoS (denial of service) is a very common attack that disrupts the availability of the network and its resources. An attacker can attack his/her target directly or indirectly or both. In direct attack, the attacker generates huge traﬃc by using his/her own computer system, and in indirect attack, the attacker uses bots (a system that is hacked by an attacker and is under his/her control) to generate huge traﬃc for his/her target. 
	DDoS. The larger version of DoS is Distributed DoS or DDoS in which a number of bots or even a server can be used to make an attack on the target to disrupt his/her network services. 

The consequences of a DoS/DDoS attack are either slow network performance or unavailability of network services. 
Table 1 make a map between Cybercrime types and Cybercrime methods. 

Cyberviolence 	Cyberpeddler 	Cybertrespass 	Cybersquatting 	
Denial of service/distributed denial of service 	Keylogger and social engineering 	Traﬃc analysis, eavesdropping, snooping, password attacks, SQL injection, salami attack,and data diddling 	Session hijacking 	

Table 1. Cybercrime Types/Methods Mapping 
5 Techniques for Combating Cybercrimes 
In order to combat Cybercrime, nations and governments need to develop several areas with the same level of important. The ﬁrst area is the legislation, regulations and justice rules and procedures. The second area is the awareness of the community as whole and not just the cyber community (because the attacker may attack some one outside the cyber community). The last area is the capacity building for the professionals that work in this area, the Cybersecurity implementers, investigators, detectors, Cybercrime police and justices. This section will make a survey about the technical controls that are used to prevent, detect and combat Cybercrime. 
5.1 Smart Cards 
Smart cards are pocket-sized cards with an embedded microchip that can store large amounts of data, encrypt data and communicate with other devices. A smart card can take many forms including a credit card or an identity card. In relation to online security, smart cards may be inserted into a reader to authorise and conduct online ﬁnancial transactions[4]. Smart cards can combat Cybercrime several ways include: 
	automatically and randomly encrypting the data transferred in an online transaction to prevent tampering by cyber criminals. 
	providing extra sources of veriﬁcation, such as encrypted card identiﬁers and unique PINs, to increase the diﬃculty of committing identity theft and fraud. 
	automatically verifying that a website is legitimate and can be trusted, and 
	preventing identity fraud by recognising and blocking transactions being made from an unusual location or in excess of a daily spending limit 

5.2 Two-factor Authentication 
Two factor authentication is a procedure that combats online identity theft and fraud through adding an extra layer of veriﬁcation when accessing online services and accounts[27]. It requires the end user to present two factors. The ﬁrst factor is something the person knows, such as a username or password. The second factor is either something the person has in their possession (such as an ID card), or a physical attribute of the user (such as a ﬁngerprint). It can prevent some Cyberattacks like phishing because even the attacker could steel the ﬁrst factor like password, however without the second factor the cyber criminal cannot gain access to the account or service. 
Smart cards may also be used to provide the second category of two factor authentication (something in the user’s possession). Users may be required to scan a smart card in order to conduct a transaction or gain access to a certain system[14]. 
5.3 Identity Metasystem 
Microsoft advocated the creation of a system where all online authorisation procedures would be conducted through a single, standard program[8]. Microsoft observed that in order to gain access to online services, Internet users are required to enter a range of diﬀerent user names and passwords into many diﬀering and unique online systems, and are often asked to provide a range of personal information. Microsoft suggested the risks to users from this process are threefold: 

1	users increase security risks by employing the same passwords and usernames for a range of diﬀerent authentication procedures 
2	users gain authorisation through a range of non-standard webpages and thus may not be able to recognise a phishing webpage, and 
3	users are asked to provide an ever increasing number of personal details to third parties, thus raising privacy issues 

To combat these risks, Microsoft proposed an identity metasystem that would connect, but not replace, all current online authorisation procedures. Every time a user needed to provide authentication they would do so by entering various identiﬁers into a standard interface, instead of arbitrary details through an interface unique to each online service. In turn, this interface would use the identity metasystem to interact with the appropriate webpage or application to notify if the authentication was successful. 
Microsoft envisages that such a system would allow users to employ veriﬁable details to complete a range of diﬀerent authentication procedures through one standard interface. In turn, Microsoft argues that password and username security would be enhanced, susceptibility to phishing schemes would decrease and user privacy would be strengthened[8]. 
5.4 Trusted Networking Infrastructure 
Is is deﬁned as a form of secure network that conceals information from ’outsiders’, which prevents theft[10]. This could be achieved through designating each individual router that would be part of the network, or by designating the ISPs whose customers would be part of the network. Each computer on the trusted network would have its own ’electronic contract’ that would determine how its information is used, encrypted and accessed by other computers on the network. computers outside this trust network would not be able to access the information. 
5.5 Privacy Enhancing Technologies 
Many reports in the literature like [26] recommended to use a range of technologies that may enhance privacy and prevent identity theft, including: 
	data separation and anonymising tools which remove personal identiﬁers from data during transmission and storage 
	privacy metadata which uses an electronic tagging system to control how information can be accessed and used, and 
	privacy management systems which permit individuals to easily determine if the privacy policies of organisations meet their own requirements 

5.6 Back and while Listing 
Currently, many organisations employ black listing to protect themselves from malicious websites and emails. Black listing involves monitoring all sources attempting to access and exchange data with a particular system. The reputation of each source is assessed, and the data from the source is checked for signs of malicious code or content. Any sources that are then deemed to be malicious are placed on a ’black list’ and denied access to the system[3]. On the other hand, white listing is a method whereby all sources attempting to access and exchange data with a system are monitored. Known trusted sources are placed on a ’white list’ which permits access to the system, while all other sources (even benign but unknown sources) are denied access[17]. While listing has many drawbacks such as potentially blocking legitimate sources; restricting ﬂexible access to systems (such as remote access). However, both black and while listing has one common limitation which is increasing the complexity of already complex systems. 
5.7 Domain Name System Security Extensions 
Cybercriminal can use DNS to divert users to malware, phishing or scam web-site. The Internet Corporation for Assigned Names and Numbers (ICANN), advocated the implementation of DNS Security Extensions (DNSSEC) as a means of addressing this risk. DNSSEC requires each genuine IP address in the DNS to be given a series of unique digital signatures that must match up in order to verify a website’s authenticity[29]. Several areas of the DNS have already implemented the technology for their country code, including Sweden, Brazil, Bulgaria and the Czech Republic. However, ICANN argued that wider implementation of DNSSEC would reduce the capacity for hackers to subvert the DNS[29]. 
5.8 Black hole and sinkhole Routing 
Black hole and sinkhole routing are two diﬀerent techniques for diverting and combating malicious web traﬃc, particularly Distributed Denial of Service (DDoS) attacks. Black hole routing is the practice of, when a computer is under attack, redirecting all traﬃc attempting to access the computer to a null inactive router, a ’black hole’. This Internet traﬃc, including the malicious elements, then has nowhere to go and drops oﬀ. This prevents the attack on the computer, but also blocks any legitimate traﬃc that may be present[7]. Sinkhole routing refers to the practice of, when a computer comes under attack, redirecting all web traﬃc ﬂowing towards that computer through a router which evaluates the traﬃc, a ’sinkhole’. This sinkhole router analyses, blocks and traces any malicious trafﬁc while permitting benign web traﬃc to continue on to its destination. Unlike black hole routing, sinkhole routing permits a computer to continue to receive web traﬃc during a web attack, but may be less able to eﬀectively handle web attacks involving large amounts of data[7]. 
6 Conclusion and Recommendations 
This paper made a survey about the diﬀerent ways and methods to combat Cybercrimes, it showed that in order to combat Cybercrimes, nations (national, regional and international scope) need parallel development in laws and legislations, technical security controls and countermeasures following best practices and standards, and building capacity for the professionals who belonging to law enforcement bodies as long as the society itself. 
References 
1. D. S. M. 1Alpna. Cyber crime-its types, analysis and prevention techniques. International Journal of Advanced Research in Computer Science and Software Engineering, 6(5):145–150, 2016. 
2. K. A. National cyber security framework manual. NATO CCD COE Publications, December 2012, 2012. 
3. A. B. A. (ABA). Submission 7.1. Submission 7.1, p.2; Sophos Pty Ltd, Submission 66, p.5. 
4. AusCERT. Smart card alliance, smart card primer. Smart Card Alliance, 2010, viewed 28 January 2010, 2010. http://www.smartcardalliance.org/pages/ smart-cards-intro-primer. 
5. N. A. N. Azernikov A. D.1 and M. E. R. Innovative technologies in combating cyber crime. volume 2018 of in III Network AML/CFT Institute International Scientiﬁc and Research Conference, page 248252, 2018. FinTech and RegTech: Possibilities, Threats and Risks of Financial Technologies. 
6. H. S. Brar and G. Kumar. Cybercrimes: A proposed taxonomy and challenges. Journal of Computer Networks and Communications, 2018, 2018. 
7. M. M. C Patrikakis and O. Zouraraki. Distributed denial of service attacks. Internet Protocol Journal, 7(4), 2004. 
8. M. Corporation. Microsoft’s vision for an identity metasystem. Web services technical articles, Microsoft Corporation, May 2005, viewed 28 January 2009, 2009. http://msdn.microsoft.com/en-us/library/ms996422.aspx. 
9. S. Corporation. What is cybercrime? Cited 2007 5 February, 2007. http://www. symantec.com/avcenter/cybercrime/index_pag2.html. 
10. CSIRO. Submission 26, pp.12-14. 

11. T. A. C. for Police Research. Cybercrime. Cited 2008 15 January, 2004. http://www.aph.gov.au/senate/committee/acc_ctte/completed_ inquiries/2002-04/cybercrime/report/report.pdf. 
12. I. O. for Standardization. Guidelines for cybersecurity, so/iec 27032:2012, 2012. https://www.iso.org/standard/44375.html. 
13. M. for the Cabinet Oﬃce and P. General. The uk cyber security strategy: protecting and promoting the uk in a digital world, 2012. 

http://www.cabinetoffice.gov.uk/sites/default/files/resources/WMS_ The_UK_Cyber_Security_Strategy.pdf. 
14. M. J. Geurts. Commonwealth bank of australia, transcript of evidence, 2009. 
15. T. I. Government. The informtion technology act, 2000, 2000. http://www. cybercrimelaw.net/China.html. 
16. J. Hakmeh. Cybercrime legislation in the gcc countries ﬁt for purpose? International Security Department, Chatham House, 2018. Chatham House. 
17. ICANN. Submission 40.1. ICANN, Submission 40.1, p.3. 
18. I. T. U. (ITU). Itu-tx.1205: series x: data networks, open system communications and security: telecommunication security: overview of cybersecurity 2008, 2008. https://www.itu.int/rec/T-REC-X.1205-200804-I. 
19. M. Keyser. The council of europe convention on cybercrime. Transnational Law and Policy Journal, pages 287–326, 2003. 
20. lzhas B. Murashbekov. Methods for cybercrime ﬁghting improvement in developed countries. Journal of Internet Banking and Commerce, 20(S1), 2015. 
21. R. J. Martin N. Cybercrime: understanding and addressing the concerns of stakeholders. Computers and Security, 30:803–814, 2011. 
22. S. Ministry of Justice. Sudan computer crimes act 2007, 2007. https://www. unodc.org/res/cld/document/sdn/Sudan_computer_crimes_act_2007.pdf. 
23. C. of Europe. Convention on cybercrime, ets no.185, 2001. https: //rm.coe.int/CoERMPublicCommonSearchServices/DisplayDCTMContent? documentId=0900001680081561. 
24. T. M. of Information Industry. Criminal law of the people’s republic of china, 1997. http://www.cybercrimelaw.net/China.html. 
25. R. of South Africa. The electronic communications and transactions act of july 31 2002 (act no. 25, 2002), 2002. http://www.cybercrimelaw.net/South-Africa. html. 
26. O. of the Privacy Commissioner. Submission 3. OPC, Submission 3, pp.13-14. 
27. Z. Ramzan. Phsihing and two-factor authentication. blog entry, Symantec Security Blogs, July 11 2006, viewed 28 January 2009, 2009. http://www.symantec.com/ connect/blogs/phishing-and-two-factor-authentication. 
28. J. v. N. Rossouw von Solms. From information security to cyber security. Computer and Security, Elsevier Ltd, 38:97–02, 2013. 
29. D. P. Twomey. 7 things you should know about dns. Internet Corporation for Assigned Names and Numbers (ICCAN), Educause, January 2010, viewed 1 February 2010, 2010. http://net.educause.edu/ir/library/pdf/EST1001.pdf. 
30. T. Whitehouse. International strategy for cyberspace: prosperity, security, and openness in a networked world, 2011. http://www.whitehouse.gov/sites/ default/files/rss_viewer/international_strategy_for_cyberspace.pdf. 
31. M. H. Whitman ME. Principles of information security. 3rd ed. Thompson Course Technology, 2009.