Search

Dependence among cyber risks has been an essential and challenging component of risk management. The current study characterizes cyber dependence from both qualitative and quantitative perspectives based on L-hop propagation model. From the qualitative side, it is shown that cyber risks always possess positive association based on the proposed risk propagation model. From the quantitative side, an explicit formula for computing the fundamental dependence measure of covariance is provided for an arbitrary network. In particular, we study the impacts of factors—especially external and internal compromise probabilities, propagation depth, and network topologies—on dependence among cyber risks. We conclude by presenting some examples and applications.

Data breaches cause millions of dollars in financial losses each year. The insurance industry has been exploring the ways to transfer such extreme risk. In this work, we investigate data breach cat...

Modeling cyber threats, such as the computer malicious software (malware) propagation dynamics in cyberspace, is an important research problem because models can deepen our understanding of dynamical cyber threats. In this paper, we study the statistical modeling of the macro-level evolution of dynamical cyber attacks. Specifically, we propose a Bayesian structural time series approach for modeling the computer malware propagation dynamics in cyberspace. Our model not only possesses the parsimony property (i.e. using few model parameters) but also can provide the predictive distribution of the dynamics by accommodating uncertainty. Our simulation study shows that the proposed model can fit and predict the computer malware propagation dynamics accurately, without requiring to know the information about the underlying attack-defense interaction mechanism and the underlying network topology. We use the model to study the propagation of two particular kinds of computer malware, namely the Conficker and Code Red worms, and show that our model has very satisfactory fitting and prediction accuracies.

Malicious hacking data breaches cause millions of dollars in financial losses each year, and more companies are seeking cyber insurance coverage. The lack of suitable statistical approaches for sco...

Modeling cyber-attacks is a very attractive area of research because of its practical importance. However, most of the related research in the literature does not consider the simultaneous (or coordinated) attacks, which, in fact, is an important attack instrument in practice. This is mainly because of the complicated evolution of cyber-attacks over networks. In this paper, we propose a novel model, which can accommodate different types of simultaneous attacks with possible heterogeneous compromise probabilities. Our results show that simultaneous attacks have a significant effect on the reliability/dynamics of network systems. In particular, we present a sufficient condition for the epidemics dying out over the network, and upper bounds for the time to extinction. We also provide upper bounds for compromise probabilities of network systems when the evolution enters the quasi-equilibrium state. The effects of strength of simultaneous attacks and heterogeneity among successful attack probabilities on epidemic spreading are studied as well. The theoretical results are further validated by the simulation evidence.

Cybersecurity risk has attracted considerable attention in recent decades. However, the modeling of cybersecurity risk is still in its infancy, mainly because of its unique characteristics. In this...

Analyzing cyber incident data sets is an important method for deepening our understanding of the evolution of the threat situation. This is a relatively new research topic, and many studies remain to be done. In this paper, we report a statistical analysis of a breach incident data set corresponding to 12 years (2005–2017) of cyber hacking activities that include malware attacks. We show that, in contrast to the findings reported in the literature, both hacking breach incident inter-arrival times and breach sizes should be modeled by stochastic processes, rather than by distributions because they exhibit autocorrelations. Then, we propose particular stochastic process models to, respectively, fit the inter-arrival times and the breach sizes. We also show that these models can predict the inter-arrival times and the breach sizes. In order to get deeper insights into the evolution of hacking breach incidents, we conduct both qualitative and quantitative trend analyses on the data set. We draw a set of cybersecurity insights, including that the threat of cyber hacks is indeed getting worse in terms of their frequency, but not in terms of the magnitude of their damage.

Modeling cyber risks has been an important but challenging task in the domain of cyber security. It is mainly because of the high dimensionality and heavy tails of risk patterns. Those obstacles have hindered the development of statistical modeling of the multivariate cyber risks. In this work, we propose a novel approach for modeling the multivariate cyber risks which relies on the deep learning and extreme value theory. The proposed model not only enjoys the high accurate point predictions via deep learning but also can provide the satisfactory high quantile prediction via extreme value theory. The simulation study shows that the proposed model can model the multivariate cyber risks very well and provide satisfactory prediction performances. The empirical evidence based on real honeypot attack data also shows that the proposed model has very satisfactory prediction performances., 25 pages

Causality is an intriguing concept that once tamed, can have many applications. While having been widely investigated in other domains, its relevance and usefulness in the cybersecurity domain has received little attention. In this paper, we present a systematic investigation of a particular approach to causality, known as Granger causality (G-causality), in cybersecurity. We propose a framework, dubbed Cybersecurity Granger Causality (CGC), for characterizing the presence of G-causality in cyber attack rate time series and for leveraging G-causality to predict (i.e., forecast) cyber attack rates. The framework offers a range of research questions, which can be adopted or adapted to study G-causality in other kinds of cybersecurity time series data. In order to demonstrate the usefulness of CGC, we present a case study by applying it to a particular cyber attack dataset collected at a honeypot. From this case study, we draw a number of insights into the usefulness and limitations of G-causality in the cybersecurity domain.

Computing the system signature is an attractive but challenging problem in system reliability. In this article, we propose a novel algorithm to compute the signature of a system with exchangeable c...

The computation of the signature of a complex system is often challenging, as it may involve a large number of components and a complex architecture. In this study, we propose a novel approach to computing the signature of a system consisting of subsystems with shared components. The proposed approach relies on a new concept called decomposed survival signatures. This new concept can be efficiently used to compute the signature of a modular system with an arbitrary organizing structure and to provide explicit formulas for computation. Applications in cyber systems, transportation systems, and branched oil pipeline systems are highlighted.

Modeling cybersecurity risks is an important, yet challenging, problem. In this paper, we initiate the study of modeling multivariate cybersecurity risks. We develop the first statistical a...

Due to the increasing reliance on networks, defending a cyber system is of vital importance. In this paper, we consider an important mechanism of early warning for defending a cyber system that has become a key component of constructing network defense in practice. We study the reliability of a system under attack from single or multiple sources. In particular, we discuss the effect of an early warning mechanism on the system reliability. We then propose the optimal strategy for defending a cyber system with early warning components in the worst attack scenario. The theoretical results are further validated by simulation evidence.

The online storage of sensitive data enjoys many benefits such as flexibility, cost-savings, scalability, and convenience but it also poses a big concern on the data confidentiality and availability. To ensure the confidentiality and availability of sensitive data over a network system, the data partition technique is often employed. We study the optimal data partition strategy over an arbitrary network under cyber threats. Both the outside attack and the risk propagation (i.e., inside attack) are considered for the data partition. The data breach probability and retrieve probability are discussed under both limited and unlimited risk propagation for various scenarios. It is discovered that the risk propagation can have much more impact on the optimal partition strategy than that of outside attacks, and the unlimited risk propagation leads to more severer cyber risk. The network topology significantly impacts the partition strategy which hints that the network topology should never be overlooked in practice. The corruption due to compromise can lead to different partition strategies. An optimal partition model is developed for determining the optimal strategy and the pareto non-dominated solutions are recommended for practical use.

Phasor measurement units (PMUs) have been integrated into the smart grid for monitoring the operational state of system and improving the reliability. Due to the high cost of PMU installment, the optimal placement strategies have attracted considerable attention in the literature. However, the impacts of cyber threats on the placement have been largely ignored owing to the cyber complexities. This paper initializes the study on the optimal PMU placement in a smart grid under the cyber threats. A probabilistic model is developed for assessing the unobservable risk of the power grid. We characterize the impacts of several cyber factors on the PMU placements including the number of directly attacked PMUs, the dependence among attack outcomes, and risk propagation. We further study the impacts of cyber attacks on the allocation strategies under a bi-level placement model. In particular, a novel ‘greedy’ algorithm for PMU placement is introduced with the presence of cyber risks. Our studies show that the cyber risk can significantly increase the unobservability risk of a power system which in turn requires additional PMU allocations, and the dependence among cyber attacks can lead to more unobservable risk.

Internet-based computer information systems play critical roles in many aspects of modern society. However, these systems are constantly under cyber attacks that can cause catastrophic consequences. To defend these systems effectively, it is necessary to measure and predict the effectiveness of cyber defense mechanisms. In this article, we investigate how to measure and predict the effectiveness of an important cyber defense mechanism that is known as early-warning. This turns out to be a challenging problem because we must accommodate the dependence among certain four-dimensional time series. In the course of using a dataset to demonstrate the prediction methodology, we discovered a new nonexchangeable and rotationally symmetric dependence structure, which may be of independent value. We propose a new vine copula model to accommodate the newly discovered dependence structure, and show that the new model can predict the effectiveness of early-warning more accurately than the others. We also discus...

In this paper we investigate a cybersecurity model: An attacker can launch multiple attacks against a target with a termination strategy that says that the attacker will stop after observing a number of successful attacks or when the attacker is out of attack resources. However, the attacker's observation of the attack outcomes (i.e., random variables indicating whether the target is compromised or not) has an observation error that is specified by both a false-negative and a false-positive probability. The novelty of the model we study is the accommodation of the dependence between the attack outcomes, because the dependence was assumed away in the literature. In this model, we characterize the monotonicity and bounds of the compromise probability (i.e., the probability that the target is compromised). In addition to extensively showing the impact of dependence on quantities such as compromise probability and attack cost, we give methods for finding the optimal strategy that leads to maximum compromise probability or minimum attack cost. This study highlights that the dependence between random variables cannot be assumed away, because the results will be misleading.

Cyber attacks have become a problem that is threatening the economy, human privacy, and even national security. Before we can adequately address the problem, we need to have a crystal clear understanding about cyber attacks from various perspectives. This is a challenge because the Internet is a large-scale complex system with humans in the loop. In this paper, we investigate a particular perspective of the problem, namely the extreme value phenomenon that is exhibited by cyber attack rates, which are the numbers of attacks against a system of interest per time unit. It is important to explore this perspective because understanding the statistical properties of extreme cyber attack rates will pave the way for cost-effective, if not optimal, allocation of resources in real-life cyber defense operations. Specifically, we propose modeling and predicting extreme cyber attack rates via marked point processes, while using the Value-at-Risk as a natural measure of intense cyber attacks. The point process...

Like how useful weather forecasting is, the capability of forecasting or predicting cyber threats can never be overestimated. Previous investigations show that cyber attack data exhibits interesting phenomena, such as long-range dependence and high nonlinearity, which impose a particular challenge on modeling and predicting cyber attack rates. Deviating from the statistical approach that is utilized in the literature, in this paper we develop a deep learning framework by utilizing the bi-directional recurrent neural networks with long short-term memory, dubbed BRNN-LSTM. Empirical study shows that BRNN-LSTM achieves a significantly higher prediction accuracy when compared with the statistical approach.

In this paper, we propose a novel method for constructing upper bounds of the quasi-stationary distribution of SIS processes. Using this method, we obtain an upper bound that is better than the state-of-the-art upper bound. Moreover, we prove that the fixed point map Φ [7] actually preserves the equilibrium reversed hazard rate order under a certain condition. This allows us to further improve the upper bound. Some numerical results are presented to illustrate the results.

Summary Discrete power-law distributions have significant consequences for understanding many phenomena in practice, and have attracted much attention in recent decades. However, in many practical applications, there exists a natural upper bound for the probability tail. In this paper, we develop maximum likelihood estimates for truncated discrete power-law distributions based on the upper order statistics, and large sample properties are mentioned as well. Monte Carlo simulation is carried out to examine the finite sample performance of the estimates. Applications in real cyber attack data and peak gamma-ray intensity of solar flares are highlighted.

The PMU network has been utilized to monitor the system operation of a smart grid in recent decades. This brings a significant cyber risk for the power grid as the attacker can manipulate the PMU network to introduce the false positive and false negative observation errors. A novel risk model is proposed for the PMU networks by considering the observation errors. It is discovered that ignoring the due observation errors can severely underestimate the PMU risks as shown by the theoretical and simulation studies. The risk mitigation strategies for improving the safety levels of PMUs with the observation errors are studied. It is found that the optimal mitigation strategy can be different when the observation errors are present. Numerical examples are presented for illustrations as well.

In this article, necessary conditions for comparing order statistics from distributions with regularly varying tails are discussed in terms of various stochastic orders. A necessary and sufficient condition for stochastically comparing tail behaviors of order statistics is derived. The main results generalize and recover some results in Kleiber (2002, 2004). Extensions to coherent systems are mentioned as well.

Bidder asymmetries are common in certain auctions where heterogeneous bidders coexist. In this paper, we employ the tool of majorization to study the effect of bidder asymmetry on revenue in second-price auctions. As a preorder on vectors of real components, the majorization is used to rank the asymmetry of bid distributions from different auctions. Our analysis indicates that bidders’ asymmetries may raise revenue under certain classes of value distributions (e.g., proportional reversed hazard rate models) and may not in others (e.g., proportional hazard rate models). These results are further validated through supportive evidence that is based on simulated three-bidder auctions. The use of majorization allows us to extend and strengthen the results obtained in the existing literature under more general conditions. This study adds to the literature a useful analytical technique for future research on asymmetric auctions.

This paper studies capital allocation problems with the aggregate risk exceeding a certain threshold. We propose a novel capital allocation rule based on the Tail Mean–Variance principle. General formulas for the optimal capital allocations are proposed. Explicit formulas for optimal capital allocations are derived for multivariate elliptical distributions. Moreover, we give asymptotic allocation formulas for multivariate regular variation variables. Various numerical examples are given to illustrate the results, and real insurance data is discussed as well.

Vaccinium bracteatum Thunb. (VBT) is a traditional Chinese herbal medicine. The anti-diabetic activity of VBT leaves' polysaccharide (VBTLP) is studied in this paper. The results indicated VBTLP had a dose-dependent decrease on the blood glucose (BG) level, and the time effect of VBTLP on BG level was also significant. The insulin level of high dose group (HDG) was significantly higher (p

Professors Balakrishnan and Zhao have written an excellent survey on the recent developments of stochastic comparisons of order statistics, which cover almost every aspect of ordering properties of order statistics from both continuous and discrete heterogeneous populations. My discussion will be limited to the skewness of order statistics and order statistics from heterogeneous populations with different shape parameters.

In this paper, the relative dependence of a linear regression model is studied. In particular, the dependence of autoregressive models in time series are investigated. It is shown that for the first-order non-stationary autoregressive model and the random walk with trend and drift model, the dependence between two states decreases with lag. Some numerical examples are presented as well.

It is important to understand to what extent, and in what perspectives, cyber attacks can be predicted. Despite its evident importance, this problem was not investigated until very recently, when we proposed using the innovative methodology of {\em gray-box prediction}. This methodology advocates the use of gray-box models, which accommodate the statistical properties/phenomena exhibited by the data. Specifically, we showed that gray-box models that accommodate the Long-Range Dependence (LRD) phenomenon can predict the attack rate (i.e., the number of attacks per unit time) 1-hour ahead-of-time with an accuracy of 70.2-82.1\%. To the best of our knowledge, this is the first result showing the feasibility of prediction in this domain. We observe that the prediction errors are partly caused by the models' incapability in predicting the large attack rates, which are called {\em extreme values} in statistics. This motivates us to analyze the {\em extreme-value phenomenon}, by using two complementary approaches: the Extreme Value Theory (EVT) and the Time Series Theory (TST). In this paper, we show that EVT can offer long-term predictions (e.g., 24-hour ahead-of-time), while gray-box TST models can predict attack rates 1-hour ahead-of-time with an accuracy of 86.0-87.9\%. We explore connections between the two approaches, and point out future research directions. Although our prediction study is based on specific cyber attack data, our methodology can be equally applied to analyze any cyber attack data of its kind.

Order statistics from heterogeneous samples have been extensively studied in the literature. However, most of the work focused on the effect of heterogeneity on the magnitude or dispersion of order statistics. In this paper, we study the skewness of order statistics from heterogeneous samples according to star ordering. The main results extend the corresponding results in Kochar and Xu (J. Appl. Probab. 46:342–352, 2009; J. Appl. Probab. 48:271–284, 2011). Examples and applications are highlighted as well.

In this paper, the sample range from a heterogeneous exponential sample is shown to be larger than that from a homogeneous exponential sample in the sense of the star ordering. Then, by using this result, some equivalent characterizations of stochastic comparisons of sample ranges with respect to various stochastic orders are established. In this process, two open problems mentioned in Mao and Hu (2010) [16] are solved. The main results established here extend and strengthen several known results in the literature including those of Khaledi and Kochar (2000) [8] , Zhao and Li (2009) [22] and Genest et al. (2009) [7] .

In this paper, a new sufficient condition for comparing linear combinations of independent gamma random variables according to star ordering is given. This unifies some of the newly proved results on this problem. Equivalent characterizations between various stochastic orders are established by utilizing the new condition. The main results in this paper generalize and unify several results in the literature including those of Amiri, Khaledi, and Samaniego [2], Zhao [18], and Kochar and Xu [9].

This paper studies capital allocation problems using a general loss function. Stochastic comparisons are conducted for general loss functions in several scenarios: independent and identically distributed risks; independent but non-identically distributed risks; comonotonic risks. Applications in optimal capital allocations and policy limits allocations are discussed as well.

In this paper we provide some sufficient conditions to stochastically compare linear combinations of independent random variables. The main results extend those given in Proschan (1965), Ma (1998), Zhao et al. (2011), and Yu (2011). In particular, we propose a new sufficient condition to compare the peakedness of linear combinations of independent random variables which may have heavy-tailed properties.

In this article, we study the order statistics from heterogenous negative binomial random variables. Sufficient conditions are provided for comparing the extreme order statistics according to the usual stochastic order. For the special case of geometric distribution, a sufficient condition is established for comparing order statistics in the sense of multivariate stochastic order. Applications in the Poisson–Gamma shock model and redundant systems have been described as well.

Two sufficient conditions for comparing convolutions of heterogeneous gamma random variables in terms of star order are established. It is further shown that if the scale parameters of heterogeneous gamma random variables are more dispersed in the sense of majorization, then the convolutions are more dispersed according to the right spread order, which generalizes and strengthens the results in Diaconis and Perlman (1987), Kochar and Xu (2010) and Zhao and Balakrishnan (2009).

A sufficient condition for comparing convolutions of heterogeneous exponential random variables in terms of right spread order is established. As a consequence, it is shown that a convolution of heterogeneous independent exponential random variables is more skewed than that of homogeneous exponential random variables in the sense of NBUE order. This gives a new insight into the distribution theory of convolutions of independent random variables. A sufficient condition is also derived for comparing such convolutions in terms of Lorenz order.

In this article, mixture representations of survival functions of residual lifetimes of k-out-of-n systems are obtained when the components are independent but not necessarily identically distributed. Then we stochastically compare the residual lifetimes of k-out-of-n systems in one- and two-sample problems. In particular, the results extend some results in Li and Zhao [14], Khaledi and Shaked [13], Sadegh [17], Gurler and Bairamov [7] and Navarro, Balakrishnan, and Samaniego [16]. Applications in the proportional hazard rates model are presented as well.

Let R"n be the range of a random sample X"1,...,X"n of exponential random variables with hazard rate @l. Let S"n be the range of another collection Y"1,...,Y"n of mutually independent exponential random variables with hazard rates @l"1,...,@l"n whose average is @l. Finally, let r and s denote the reversed hazard rates of R"n and S"n, respectively. It is shown here that the mapping [email protected]?s(t)/r(t) is increasing on (0,~) and that as a result, R"n=X"("n")-X"("1") is smaller than S"n=Y"("n")-Y"("1") in the likelihood ratio ordering as well as in the dispersive ordering. As a further consequence of this fact, X"("n") is seen to be more stochastically increasing in X"("1") than Y"("n") is in Y"("1"). In other words, the pair (X"("1"),X"("n")) is more dependent than the pair (Y"("1"),Y"("n")) in the monotone regression dependence ordering. The latter finding extends readily to the more general context where X"1,...,X"n form a random sample from a continuous distribution while Y"1,...,Y"n are mutually independent lifetimes with proportional hazard rates.

A parallel system with heterogeneous exponential component lifetimes is shown to be more skewed (according to the convex transform order) than the system with independent and identically distributed exponential components. As a consequence, equivalent conditions for comparing the variabilities of the largest order statistics from heterogeneous and homogeneous exponential samples in the sense of the dispersive order and the right-spread order are established. A sufficient condition is also given for the proportional hazard rate model.

A parallel system with heterogeneous exponential component lifetimes is shown to be more skewed (according to the convex transform order) than the system with independent and identically distributed exponential components. As a consequence, equivalent conditions for comparing the variabilities of the largest order statistics from heterogeneous and homogeneous exponential samples in the sense of the dispersive order and the right-spread order are established. A sufficient condition is also given for the proportional hazard rate model.

In this paper, we introduce a new copula-based dependence order to compare the relative degree of dependence between two pairs of random variables. Relationship of the new order to the existing dependence orders is investigated. In particular, the new ordering is stronger than the partial ordering, more monotone regression dependence as developed by Avérous et al. [J. Avérous, C. Genest, S.C. Kochar, On dependence structure of order statistics, Journal of Multivariate Analysis 94 (2005) 159–171]. Applications of this partial order to order statistics, k-record values and frailty models are given.

This note investigates the negative dependence in frailty models. First, we show that the frailty variable and the overall population variable are negatively likelihood ratio dependent and derive an upper bound for the survival function of the population with higher frailty. Secondly, we prove that the DFR property and the logconvex hazard rate of the baseline variable imply the DLR property of the population variable. Finally, we further prove that the likelihood ratio order, hazard rate order and reversed hazard rate order between two frailty variables imply the likelihood ratio order, reversed hazard rate order, and hazard rate order between the corresponding overall population variables, respectively.

This paper investigates the stochastic comparison of spacings of record values. The likelihood ratio order, the hazard rate order and the mean residual life order between spacings of record values from one sample sequence are developed. Furthermore, the increasing convex order and the mean residual life order between simple spacings of record values from two sample sequences are built as well.

Let X1, … , Xn be independent random variables with Xi having survival function Fλi, i = 1, … , n, and let Y1, … ,Yn be a random sample with common population survival distribution F, where c = ∑i=1nλi/n. Let Xn:n and Yn:n denote the lifetimes of the parallel systems consisting of these components, respectively. It is shown that Xn:n is greater than Yn:n in terms of likelihood ratio order. It is also proved that the sample range Xn:n − X1:n is larger than Yn:n − Y1:n according to reverse hazard rate ordering. These two results strengthen and generalize the results in Dykstra, Kochar, and Rojo [6] and Kochar and Rojo [11], respectively.

In this note, we further study the properties of excess wealth (or right spread) order and the location independent riskier order. It is proved that if X is less variable than Y according to excess wealth order, then X n : n − X k : n ≤ icx Y n : n − Y k : n for k = 0 , 1 , … , n − 1 , where X 0 : n = Y 0 : n ≡ 0 . Similar results are obtained for location independent riskier order. An application in k -price business auction models is presented as well.

This article deals with the multiple-outlier exponential model. The likelihood ratio order between m-spacings of the combined sample is developed, some results extend the conclusions on simple spacings in Wen et al. (2007).