Search

Causality is an intriguing concept that once tamed, can have many applications. While having been widely investigated in other domains, its relevance and usefulness in the cybersecurity domain has received little attention. In this paper, we present a systematic investigation of a particular approach to causality, known as Granger causality (G-causality), in cybersecurity. We propose a framework, dubbed Cybersecurity Granger Causality (CGC), for characterizing the presence of G-causality in cyber attack rate time series and for leveraging G-causality to predict (i.e., forecast) cyber attack rates. The framework offers a range of research questions, which can be adopted or adapted to study G-causality in other kinds of cybersecurity time series data. In order to demonstrate the usefulness of CGC, we present a case study by applying it to a particular cyber attack dataset collected at a honeypot. From this case study, we draw a number of insights into the usefulness and limitations of G-causality in the cybersecurity domain. [ABSTRACT FROM AUTHOR]

In this paper we provide some sufficient conditions to stochastically compare linear combinations of independent random variables. The main results extend those given in Proschan (1965), Ma (1998), Zhao et al. (2011), and Yu (2011). In particular, we propose a new sufficient condition to compare the peakedness of linear combinations of independent random variables which may have heavy-tailed properties. [ABSTRACT FROM AUTHOR]

In this paper, some ordering properties of convolutions of heterogeneous Bernoulli random variables are discussed. It is shown that, under some suitable conditions, the likelihood ratio order and the reversed hazard rate order hold between convolutions of two heterogeneous Bernoulli sequences. The results established here extend and strengthen the previous results of Pledger and Proschan (1971) and Boland, Singh and Cukic (2002). [ABSTRACT FROM AUTHOR]

A parallel system with heterogeneous exponential component lifetimes is shown to be more skewed (according to the convex transform order) than the system with independent and identically distributed exponential components. As a consequence, equivalent conditions for comparing the variabilities of the largest order statistics from heterogeneous and homogeneous exponential samples in the sense of the dispersive order and the right- spread order are established. A sufficient condition is also given for the proportional hazard rate model. [ABSTRACT FROM AUTHOR]

Background: Pharmacy databases are commonly used to assess medication usage, and a number of measures have been developed to measure patients' adherence to medication. An extensive literature now supports these measures, although few studies have systematically compared the properties of different adherence measures. Methods: As part of an 18-month randomized clinical trial to assess the impact of automated telephone reminders on adherence to inhaled corticosteroids (ICS) among 6903 adult members of a managed care organization, we computed eight pharmacy-based measures of ICS adherence using outpatient pharmacy dispensing records obtained from the health plan's electronic medical record. We used simple descriptive statistics to compare the relative performance characteristics of these measures. Results: Comparative analysis found a relative upward bias in adherence estimates for those measures that require at least one dispensing event to be calculated. Measurement strategies that require a second dispensing event evidence even greater upward bias. These biases are greatest with shorter observation times. Furthermore, requiring a dispensing to be calculated meant that these measures could not be defined for large numbers of individuals (17-32 % of participants in this study). Measurement strategies that do not require a dispensing event to be calculated appear least vulnerable to these biases and can be calculated for everyone. However they do require additional assumptions and data (e.g., pre-intervention dispensing data) to support their validity. Conclusions: Many adherence measures require one, or sometimes two, dispensings in order to be defined. Since such measures assume all dispensed medication is used as directed, they have a built in upward bias that is especially pronounced when they are calculated over relatively short timeframes (< 9 months). Less biased measurement strategies that do not require a dispensing event are available, but require additional data to support their validity. Trial registration: The study was funded by grant R01HL83433 from the National Heart, Lung and Blood Institute (NHLBI) and is filed as study NCT00414817 in the clinicaltrials.gov database. [ABSTRACT FROM AUTHOR]

Correlation in cyber risk represents an additional source of concern for utility and industrial infrastructures, where risks may be introduced by connected systems. A major means of reducing risk is to transfer it through insurance. In this paper, we consider a company which has peripheral branches in addition to its headquarters, where risk correlation is present between all of its sites and insurance is adopted to hedge against economic losses. We employ the expected utility principle (which leads to the well-known mean variance premium formula) to derive the insurance premium under risk correlation under several risk scenarios. Under a first-order approximation, a quasi-linear relationship between the premium and the two major risk factors (the number of branches and the risk correlation coefficient) is determined. [ABSTRACT FROM AUTHOR]

Modeling cyber risks has been an important but challenging task in the domain of cyber security, which is mainly caused by the high dimensionality and heavy tails of risk patterns. Those obstacles have hindered the development of statistical modeling of the multivariate cyber risks. In this work, we propose a novel approach for modeling the multivariate cyber risks which relies on the deep learning and extreme value theory. The proposed model not only enjoys the high accurate point predictions via deep learning but also can provide the satisfactory high quantile predictions via extreme value theory. Both the simulation and empirical studies show that the proposed approach can model the multivariate cyber risks very well and provide satisfactory prediction performances. [ABSTRACT FROM AUTHOR]

Modeling cyber threats, such as the computer malicious software (malware) propagation dynamics in cyberspace, is an important research problem because models can deepen our understanding of dynamical cyber threats. In this paper, we study the statistical modeling of the macro-level evolution of dynamical cyber attacks. Specifically, we propose a Bayesian structural time series approach for modeling the computer malware propagation dynamics in cyberspace. Our model not only possesses the parsimony property (i.e. using few model parameters) but also can provide the predictive distribution of the dynamics by accommodating uncertainty. Our simulation study shows that the proposed model can fit and predict the computer malware propagation dynamics accurately, without requiring to know the information about the underlying attack-defense interaction mechanism and the underlying network topology. We use the model to study the propagation of two particular kinds of computer malware, namely the Conficker and Code Red worms, and show that our model has very satisfactory fitting and prediction accuracies. [ABSTRACT FROM AUTHOR]

Modeling cyber-attacks is a very attractive area of research because of its practical importance. However, most of the related research in the literature does not consider the simultaneous (or coordinated) attacks, which, in fact, is an important attack instrument in practice. This is mainly because of the complicated evolution of cyber-attacks over networks. In this paper, we propose a novel model, which can accommodate different types of simultaneous attacks with possible heterogeneous compromise probabilities. Our results show that simultaneous attacks have a significant effect on the reliability/dynamics of network systems. In particular, we present a sufficient condition for the epidemics dying out over the network, and upper bounds for the time to extinction. We also provide upper bounds for compromise probabilities of network systems when the evolution enters the quasi-equilibrium state. The effects of strength of simultaneous attacks and heterogeneity among successful attack probabilities on epidemic spreading are studied as well. The theoretical results are further validated by the simulation evidence. [ABSTRACT FROM AUTHOR]

Each day brings with it a news report about how another company has suffered a data breach. But then what? Victims of data breaches have little or no recourse. Victims often struggle to overcome the constitutional standing requirement. When a legal settlement is reached, the actual compensation that victims receive is minimal. Businesses have weak incentives to strengthen security protocols, and there is no standard for what constitutes acceptable data protection practices. This Note reconceptualizes data breaches, not as isolated events requiring specifically tailored remedies, but as societal harms that are sure to repeat themselves. Using past responses to other widespread risks, this Note outlines a modern solution to the problem of data breaches. By setting clear standards, realigning incentives for organizations that store data, and ensuring that impacted parties obtain meaningful recovery, the incidence of data breaches and their harmful effects can be minimzed. [ABSTRACT FROM AUTHOR]

Order statistics from heterogeneous samples have been extensively studied in the literature. However, most of the work focused on the effect of heterogeneity on the magnitude or dispersion of order statistics. In this paper, we study the skewness of order statistics from heterogeneous samples according to star ordering. The main results extend the corresponding results in Kochar and Xu (J. Appl. Probab. 46:342-352, ; J. Appl. Probab. 48:271-284, ). Examples and applications are highlighted as well. [ABSTRACT FROM AUTHOR]

Cyber insurance ratemaking (CIRM) is a procedure used to set rates (or prices) for cyber insurance products provided by insurance companies. Rate estimation is a critical issue for cyber insurance products. This problem arises because of the unavailability of actuarial data and the uncertainty of normative standards of cyber risk. Most cyber risk analyses do not consider the connection between Information Communication and Technology (ICT) sources. Recently, a cyber risk model was developed that considered the network structure. However, the analysis of this model remains limited to an unweighted network. To address this issue, we propose using a graph mining approach (GMA) to CIRM, which can be applied to obtain fair and competitive prices based on weighted network characteristics. This study differs from previous studies in that it adds the GMA to CIRM and uses communication models to explain the frequency of communications as weights in the network. We used the heterogeneous generalized susceptible-infectious-susceptible model to accommodate different infection rates. Our approach adds up to the existing method because it considers the communication frequency and GMA in CIRM. This approach results in heterogeneous premiums. Additionally, GMA can choose more active communications to reflect high communications contribution in the premiums or rates. This contribution is not found when the infection rates are the same. Based on our experimental results, it is apparent that this method can produce more reasonable and competitive prices than other methods. The prices obtained with GMA and communication factors are lower than those obtained without GMA and communication factors. [ABSTRACT FROM AUTHOR]

The publication offers a note of thanks and lists its reviewers. [ABSTRACT FROM AUTHOR]

A security indicator is a sign that shows us what something is like or how a situation is changing and can aid us in making informed estimations on cyber risks. There are many different breeds of security indicators, but, unfortunately, they are not always easy to apply due to a lack of available or credible sources of data. This paper undertakes a systematic mapping study on the academic literature related to cyber security indicator data. We identified 117 primary studies from the past five years as relevant to answer our research questions. They were classified according to a set of categories related to research type, domain, data openness, usage, source, type and content. Our results show a linear growth of publications per year, where most indicators are based on free or internal technical data that are domain independent. While these indicators can give valuable information about the contemporary cyber risk, the increasing usage of unconventional data sources and threat intelligence feeds of more strategic and tactical nature represent a more forward-looking trend. In addition, there is a need to take methods and techniques developed by the research community from the conceptual plane and make them practical enough for real-world application. [ABSTRACT FROM AUTHOR]

Like how useful weather forecasting is, the capability of forecasting or predicting cyber threats can never be overestimated. Previous investigations show that cyber attack data exhibits interesting phenomena, such as long-range dependence and high nonlinearity, which impose a particular challenge on modeling and predicting cyber attack rates. Deviating from the statistical approach that is utilized in the literature, in this paper we develop a deep learning framework by utilizing the bi-directional recurrent neural networks with long short-term memory, dubbed BRNN-LSTM. Empirical study shows that BRNN-LSTM achieves a significantly higher prediction accuracy when compared with the statistical approach. [ABSTRACT FROM AUTHOR]