Search

Modeling cyber threats, such as the computer malicious software (malware) propagation dynamics in cyberspace, is an important research problem because models can deepen our understanding of dynamical cyber threats. In this paper, we study the statistical modeling of the macro-level evolution of dynamical cyber attacks. Specifically, we propose a Bayesian structural time series approach for modeling the computer malware propagation dynamics in cyberspace. Our model not only possesses the parsimony property (i.e. using few model parameters) but also can provide the predictive distribution of the dynamics by accommodating uncertainty. Our simulation study shows that the proposed model can fit and predict the computer malware propagation dynamics accurately, without requiring to know the information about the underlying attack-defense interaction mechanism and the underlying network topology. We use the model to study the propagation of two particular kinds of computer malware, namely the Conficker and Code Red worms, and show that our model has very satisfactory fitting and prediction accuracies.

Modeling cyber-attacks is a very attractive area of research because of its practical importance. However, most of the related research in the literature does not consider the simultaneous (or coordinated) attacks, which, in fact, is an important attack instrument in practice. This is mainly because of the complicated evolution of cyber-attacks over networks. In this paper, we propose a novel model, which can accommodate different types of simultaneous attacks with possible heterogeneous compromise probabilities. Our results show that simultaneous attacks have a significant effect on the reliability/dynamics of network systems. In particular, we present a sufficient condition for the epidemics dying out over the network, and upper bounds for the time to extinction. We also provide upper bounds for compromise probabilities of network systems when the evolution enters the quasi-equilibrium state. The effects of strength of simultaneous attacks and heterogeneity among successful attack probabilities on epidemic spreading are studied as well. The theoretical results are further validated by the simulation evidence.

Modeling cyber risks has been an important but challenging task in the domain of cyber security. It is mainly because of the high dimensionality and heavy tails of risk patterns. Those obstacles have hindered the development of statistical modeling of the multivariate cyber risks. In this work, we propose a novel approach for modeling the multivariate cyber risks which relies on the deep learning and extreme value theory. The proposed model not only enjoys the high accurate point predictions via deep learning but also can provide the satisfactory high quantile prediction via extreme value theory. The simulation study shows that the proposed model can model the multivariate cyber risks very well and provide satisfactory prediction performances. The empirical evidence based on real honeypot attack data also shows that the proposed model has very satisfactory prediction performances., 25 pages

Causality is an intriguing concept that once tamed, can have many applications. While having been widely investigated in other domains, its relevance and usefulness in the cybersecurity domain has received little attention. In this paper, we present a systematic investigation of a particular approach to causality, known as Granger causality (G-causality), in cybersecurity. We propose a framework, dubbed Cybersecurity Granger Causality (CGC), for characterizing the presence of G-causality in cyber attack rate time series and for leveraging G-causality to predict (i.e., forecast) cyber attack rates. The framework offers a range of research questions, which can be adopted or adapted to study G-causality in other kinds of cybersecurity time series data. In order to demonstrate the usefulness of CGC, we present a case study by applying it to a particular cyber attack dataset collected at a honeypot. From this case study, we draw a number of insights into the usefulness and limitations of G-causality in the cybersecurity domain.

The computation of the signature of a complex system is often challenging, as it may involve a large number of components and a complex architecture. In this study, we propose a novel approach to computing the signature of a system consisting of subsystems with shared components. The proposed approach relies on a new concept called decomposed survival signatures. This new concept can be efficiently used to compute the signature of a modular system with an arbitrary organizing structure and to provide explicit formulas for computation. Applications in cyber systems, transportation systems, and branched oil pipeline systems are highlighted.

Like how useful weather forecasting is, the capability of forecasting or predicting cyber threats can never be overestimated. Previous investigations show that cyber attack data exhibits interesting phenomena, such as long-range dependence and high nonlinearity, which impose a particular challenge on modeling and predicting cyber attack rates. Deviating from the statistical approach that is utilized in the literature, in this paper we develop a deep learning framework by utilizing the bi-directional recurrent neural networks with long short-term memory, dubbed BRNN-LSTM. Empirical study shows that BRNN-LSTM achieves a significantly higher prediction accuracy when compared with the statistical approach.

It is important to understand to what extent, and in what perspectives, cyber attacks can be predicted. Despite its evident importance, this problem was not investigated until very recently, when we proposed using the innovative methodology of {\em gray-box prediction}. This methodology advocates the use of gray-box models, which accommodate the statistical properties/phenomena exhibited by the data. Specifically, we showed that gray-box models that accommodate the Long-Range Dependence (LRD) phenomenon can predict the attack rate (i.e., the number of attacks per unit time) 1-hour ahead-of-time with an accuracy of 70.2-82.1\%. To the best of our knowledge, this is the first result showing the feasibility of prediction in this domain. We observe that the prediction errors are partly caused by the models' incapability in predicting the large attack rates, which are called {\em extreme values} in statistics. This motivates us to analyze the {\em extreme-value phenomenon}, by using two complementary approaches: the Extreme Value Theory (EVT) and the Time Series Theory (TST). In this paper, we show that EVT can offer long-term predictions (e.g., 24-hour ahead-of-time), while gray-box TST models can predict attack rates 1-hour ahead-of-time with an accuracy of 86.0-87.9\%. We explore connections between the two approaches, and point out future research directions. Although our prediction study is based on specific cyber attack data, our methodology can be equally applied to analyze any cyber attack data of its kind.

Order statistics from heterogeneous samples have been extensively studied in the literature. However, most of the work focused on the effect of heterogeneity on the magnitude or dispersion of order statistics. In this paper, we study the skewness of order statistics from heterogeneous samples according to star ordering. The main results extend the corresponding results in Kochar and Xu (J. Appl. Probab. 46:342–352, 2009; J. Appl. Probab. 48:271–284, 2011). Examples and applications are highlighted as well.

In this paper, the sample range from a heterogeneous exponential sample is shown to be larger than that from a homogeneous exponential sample in the sense of the star ordering. Then, by using this result, some equivalent characterizations of stochastic comparisons of sample ranges with respect to various stochastic orders are established. In this process, two open problems mentioned in Mao and Hu (2010) [16] are solved. The main results established here extend and strengthen several known results in the literature including those of Khaledi and Kochar (2000) [8] , Zhao and Li (2009) [22] and Genest et al. (2009) [7] .

In this paper, a new sufficient condition for comparing linear combinations of independent gamma random variables according to star ordering is given. This unifies some of the newly proved results on this problem. Equivalent characterizations between various stochastic orders are established by utilizing the new condition. The main results in this paper generalize and unify several results in the literature including those of Amiri, Khaledi, and Samaniego [2], Zhao [18], and Kochar and Xu [9].

In this paper we provide some sufficient conditions to stochastically compare linear combinations of independent random variables. The main results extend those given in Proschan (1965), Ma (1998), Zhao et al. (2011), and Yu (2011). In particular, we propose a new sufficient condition to compare the peakedness of linear combinations of independent random variables which may have heavy-tailed properties.

A sufficient condition for comparing convolutions of heterogeneous exponential random variables in terms of right spread order is established. As a consequence, it is shown that a convolution of heterogeneous independent exponential random variables is more skewed than that of homogeneous exponential random variables in the sense of NBUE order. This gives a new insight into the distribution theory of convolutions of independent random variables. A sufficient condition is also derived for comparing such convolutions in terms of Lorenz order.

In this article, mixture representations of survival functions of residual lifetimes of k-out-of-n systems are obtained when the components are independent but not necessarily identically distributed. Then we stochastically compare the residual lifetimes of k-out-of-n systems in one- and two-sample problems. In particular, the results extend some results in Li and Zhao [14], Khaledi and Shaked [13], Sadegh [17], Gurler and Bairamov [7] and Navarro, Balakrishnan, and Samaniego [16]. Applications in the proportional hazard rates model are presented as well.

Let R"n be the range of a random sample X"1,...,X"n of exponential random variables with hazard rate @l. Let S"n be the range of another collection Y"1,...,Y"n of mutually independent exponential random variables with hazard rates @l"1,...,@l"n whose average is @l. Finally, let r and s denote the reversed hazard rates of R"n and S"n, respectively. It is shown here that the mapping [email protected]?s(t)/r(t) is increasing on (0,~) and that as a result, R"n=X"("n")-X"("1") is smaller than S"n=Y"("n")-Y"("1") in the likelihood ratio ordering as well as in the dispersive ordering. As a further consequence of this fact, X"("n") is seen to be more stochastically increasing in X"("1") than Y"("n") is in Y"("1"). In other words, the pair (X"("1"),X"("n")) is more dependent than the pair (Y"("1"),Y"("n")) in the monotone regression dependence ordering. The latter finding extends readily to the more general context where X"1,...,X"n form a random sample from a continuous distribution while Y"1,...,Y"n are mutually independent lifetimes with proportional hazard rates.

A parallel system with heterogeneous exponential component lifetimes is shown to be more skewed (according to the convex transform order) than the system with independent and identically distributed exponential components. As a consequence, equivalent conditions for comparing the variabilities of the largest order statistics from heterogeneous and homogeneous exponential samples in the sense of the dispersive order and the right-spread order are established. A sufficient condition is also given for the proportional hazard rate model.

A parallel system with heterogeneous exponential component lifetimes is shown to be more skewed (according to the convex transform order) than the system with independent and identically distributed exponential components. As a consequence, equivalent conditions for comparing the variabilities of the largest order statistics from heterogeneous and homogeneous exponential samples in the sense of the dispersive order and the right-spread order are established. A sufficient condition is also given for the proportional hazard rate model.

In this paper, we introduce a new copula-based dependence order to compare the relative degree of dependence between two pairs of random variables. Relationship of the new order to the existing dependence orders is investigated. In particular, the new ordering is stronger than the partial ordering, more monotone regression dependence as developed by Avérous et al. [J. Avérous, C. Genest, S.C. Kochar, On dependence structure of order statistics, Journal of Multivariate Analysis 94 (2005) 159–171]. Applications of this partial order to order statistics, k-record values and frailty models are given.

Data-driven understanding of cybersecurity posture is an important problem that has not been adequately explored. In this paper, we analyze some real data collected by CAIDA's network telescope during the month of March 2013. We propose to formalize the concept of cybersecurity posture from the perspectives of three kinds of time series: the number of victims i.e., telescope IP addresses that are attacked, the number of attackers that are observed by the telescope, and the number of attacks that are observed by the telescope. Characterizing cybersecurity posture therefore becomes investigating the phenomena and statistical properties exhibited by these time series, and explaining their cybersecurity meanings. For example, we propose the concept of sweep-time, and show that sweep-time should be modeled by stochastic process, rather than random variable. We report that the number of attackers and attacks from a certain country dominates the total number of attackers and attacks that are observed by the telescope. We also show that substantially smaller network telescopes might not be as useful as a large telescope.

Modeling and analyzing security of networked systems is an important problem in the emerging Science of Security and has been under active investigation. In this paper, we propose a new approach towards tackling the problem. Our approach is inspired by the {\em shock model} and {\em random environment} techniques in the Theory of Reliability, while accommodating security ingredients. To the best of our knowledge, our model is the first that can accommodate a certain degree of {\em adaptiveness of attacks}, which substantially weakens the often-made independence and exponential attack inter-arrival time assumptions. The approach leads to a stochastic process model with two security metrics, and we attain some analytic results in terms of the security metrics., Proceedings of the 2014 Symposium on the Science of Security (HotSoS'14)

Linear combinations of independent random variables have been extensively studied in the literature. However, most of the work is based on some specific distribution assumptions. In this paper, a companion of (J. Appl. Probab. 48 (2011) 1179-1188), we unify the study of linear combinations of independent nonnegative random variables under the general setup by using some monotone transforms. The results are further generalized to the case of independent but not necessarily identically distributed nonnegative random variables. The main results complement and generalize the results in the literature including (In Studies in Econometrics, Time Series, and Multivariate Statistics (1983) 465-489 Academic Press; Sankhy\={a} Ser. A 60 (1998) 171-175; Sankhy\={a} Ser. A 63 (2001) 128-132; J. Statist. Plann. Inference 92 (2001) 1-5; Bernoulli 17 (2011) 1044-1053)., Comment: Published in at http://dx.doi.org/10.3150/12-BEJ429 the Bernoulli (http://isi.cbs.nl/bernoulli/) by the International Statistical Institute/Bernoulli Society (http://isi.cbs.nl/BS/bshome.htm)

Background Pharmacy databases are commonly used to assess medication usage, and a number of measures have been developed to measure patients’ adherence to medication. An extensive literature now supports these measures, although few studies have systematically compared the properties of different adherence measures. Methods As part of an 18-month randomized clinical trial to assess the impact of automated telephone reminders on adherence to inhaled corticosteroids (ICS) among 6903 adult members of a managed care organization, we computed eight pharmacy-based measures of ICS adherence using outpatient pharmacy dispensing records obtained from the health plan’s electronic medical record. We used simple descriptive statistics to compare the relative performance characteristics of these measures. Results Comparative analysis found a relative upward bias in adherence estimates for those measures that require at least one dispensing event to be calculated. Measurement strategies that require a second dispensing event evidence even greater upward bias. These biases are greatest with shorter observation times. Furthermore, requiring a dispensing to be calculated meant that these measures could not be defined for large numbers of individuals (17-32 % of participants in this study). Measurement strategies that do not require a dispensing event to be calculated appear least vulnerable to these biases and can be calculated for everyone. However they do require additional assumptions and data (e.g., pre-intervention dispensing data) to support their validity. Conclusions Many adherence measures require one, or sometimes two, dispensings in order to be defined. Since such measures assume all dispensed medication is used as directed, they have a built in upward bias that is especially pronounced when they are calculated over relatively short timeframes (< 9 months). Less biased measurement strategies that do not require a dispensing event are available, but require additional data to support their validity. Trial registration The study was funded by grant R01HL83433 from the National Heart, Lung and Blood Institute (NHLBI) and is filed as study NCT00414817 in the clinicaltrials.gov database.

Quantitative security analysis of networked computer systems is one of the decades-long open problems in computer security. Recently, a promising approach was proposed in \cite{XuTDSC11}, which however made some strong assumptions including the exponential distribution of, and the independence between, the relevant random variables. In this paper, we substantially weaken these assumptions while offering, in addition to the same types of analytical results as in \cite{XuTDSC11}, methods for obtaining the desired security quantities in practice. Moreover, we investigate the problem from a higher-level abstraction, which also leads to both analytical results and practical methods for obtaining the desired security quantities. These would represent a significant step toward ultimately solving the problem of quantitative security analysis of networked computer systems.

In this paper, some ordering properties of convolutions of heterogeneous Bernoulli random variables are discussed. It is shown that, under some suitable conditions, the likelihood ratio order and the reversed hazard rate order hold between convolutions of two heterogeneous Bernoulli sequences. The results established here extend and strengthen the previous results of Pledger and Proschan (1971) and Boland, Singh and Cukic (2002).

Kochar and Xu (2009) proved that a parallel system with heterogeneous exponential component lifetimes is more skewed (according to the convex transform order) than the system with independent and identically distributed exponential components. In this paper we extend this study to the general k-out-of-n systems for the case when there are only two types of component in the system. An open problem proposed in Pǎltǎnea (2008) is partially solved.

The statistics literature has mostly focused on the case when the data available is in the form of a random sample. In many cases, the observations are not identically distributed. Such samples are called heterogeneous samples. The study of heterogeneous samples is of great interest in many areas, such as statistics, econometrics, reliability engineering, operation research and risk analysis. Stochastic orders between probability distributions is a widely studied concept. There are several kinds of stochastic orders that are used to compare different aspects of probability distributions like location, variability, skewness, dependence, etc. In this dissertation, most of the work is devoted to investigating the properties of statistics based on heterogeneous samples with the aid of stochastic orders. We will see the effect of the change in the stochastic properties of various functions of observations as their parameters change. The theory of majorization will be used for this purpose. First, order statistics from heterogeneous samples will be investigated. Order statistics appear everywhere in statistics and related areas. The k-out-of-n systems are building blocks of a coherent system. The lifetime of such a system is the same as that of the (n−k+1)th order statistic in a sample size of n. Stochastic comparisons between order statistics have been studied extensively in the literature in case the parent observations are independent and identically distributed. i However, in practice this assumption is often violated as different components in a system may not have the same distribution. Comparatively less work has been done in the case of heterogeneous random variables, mainly because of the reason that their distribution theory is very complicated. Some open problems in the literature have been solved in the dissertation. Some new problems associated with order statistics have been investigated in the thesis. Next, stochastic properties of spacings based on heterogeneous observations are studied. Spacings are of great interest in many areas of statistics, in particular, in the characterizations of distributions, goodness-of-fit tests, life testing and reliability models. In particular, the stochastic properties of the sample range are investigated in detail. Applications in reliability theory are highlighted. The relative dependence between extreme order statistics will be investigated in Chapter 4. In particular, the open problem discussed in Dolati, et al. [18] is solved in this Chapter. In the last Chapter, convolutions of random variables from heterogeneous samples will be investigated. Convolutions have been widely used in many areas to model many practical situations. For example, in reliability theory, it arises as the lifetime of a redundant standby system; in queuing theory, it is used to model the total service time by an agent in a system; in insurance, it is used to model total claims on a number of policies in the individual risk model. I will compare the dispersion and skewness properties of convolutions of different heterogeneous

In our article [3] we have found a gap in the middle of the proof of Theorem 3.2. Therefore, we do not know whether Theorem 3.2 is true for the reverse hazard rate order. However, we could prove the following weaker result for the stochastic order.