Search

Abstract Like how useful weather forecasting is, the capability of forecasting or predicting cyber threats can never be overestimated. Previous investigations show that cyber attack data exhibits interesting phenomena, such as long-range dependence and high nonlinearity, which impose a particular challenge on modeling and predicting cyber attack rates. Deviating from the statistical approach that is utilized in the literature, in this paper we develop a deep learning framework by utilizing the bi-directional recurrent neural networks with long short-term memory, dubbed BRNN-LSTM. Empirical study shows that BRNN-LSTM achieves a significantly higher prediction accuracy when compared with the statistical approach.

Causality is an intriguing concept that once tamed, can have many applications. While having been widely investigated in other domains, its relevance and usefulness in the cybersecurity domain has received little attention. In this paper, we present a systematic investigation of a particular approach to causality, known as Granger causality (G-causality), in cybersecurity. We propose a framework, dubbed Cybersecurity Granger Causality (CGC), for characterizing the presence of G-causality in cyber attack rate time series and for leveraging G-causality to predict (i.e., forecast) cyber attack rates. The framework offers a range of research questions, which can be adopted or adapted to study G-causality in other kinds of cybersecurity time series data. In order to demonstrate the usefulness of CGC, we present a case study by applying it to a particular cyber attack dataset collected at a honeypot. From this case study, we draw a number of insights into the usefulness and limitations of G-causality in the cybersecurity domain.

In this paper we provide some sufficient conditions to stochastically compare linear combinations of independent random variables. The main results extend those given in Proschan (1965), Ma (1998), Zhao et al. (2011), and Yu (2011). In particular, we propose a new sufficient condition to compare the peakedness of linear combinations of independent random variables which may have heavy-tailed properties. [ABSTRACT FROM AUTHOR]

In this paper, some ordering properties of convolutions of heterogeneous Bernoulli random variables are discussed. It is shown that, under some suitable conditions, the likelihood ratio order and the reversed hazard rate order hold between convolutions of two heterogeneous Bernoulli sequences. The results established here extend and strengthen the previous results of Pledger and Proschan (1971) and Boland, Singh and Cukic (2002). [ABSTRACT FROM AUTHOR]

A parallel system with heterogeneous exponential component lifetimes is shown to be more skewed (according to the convex transform order) than the system with independent and identically distributed exponential components. As a consequence, equivalent conditions for comparing the variabilities of the largest order statistics from heterogeneous and homogeneous exponential samples in the sense of the dispersive order and the right- spread order are established. A sufficient condition is also given for the proportional hazard rate model. [ABSTRACT FROM AUTHOR]

This paper deals with preservation of the reversed hazard rate order between equilibrium random variables under formations of some reliability structures. We further investigate a new aging notion based upon the reversed hazard rate order between a random life and its equilibrium version. A nonparametric method is developed to test the exponentiality against such a strict aging property, some numerical results are presented as well. [ABSTRACT FROM AUTHOR]

Background: Pharmacy databases are commonly used to assess medication usage, and a number of measures have been developed to measure patients' adherence to medication. An extensive literature now supports these measures, although few studies have systematically compared the properties of different adherence measures. Methods: As part of an 18-month randomized clinical trial to assess the impact of automated telephone reminders on adherence to inhaled corticosteroids (ICS) among 6903 adult members of a managed care organization, we computed eight pharmacy-based measures of ICS adherence using outpatient pharmacy dispensing records obtained from the health plan's electronic medical record. We used simple descriptive statistics to compare the relative performance characteristics of these measures. Results: Comparative analysis found a relative upward bias in adherence estimates for those measures that require at least one dispensing event to be calculated. Measurement strategies that require a second dispensing event evidence even greater upward bias. These biases are greatest with shorter observation times. Furthermore, requiring a dispensing to be calculated meant that these measures could not be defined for large numbers of individuals (17-32 % of participants in this study). Measurement strategies that do not require a dispensing event to be calculated appear least vulnerable to these biases and can be calculated for everyone. However they do require additional assumptions and data (e.g., pre-intervention dispensing data) to support their validity. Conclusions: Many adherence measures require one, or sometimes two, dispensings in order to be defined. Since such measures assume all dispensed medication is used as directed, they have a built in upward bias that is especially pronounced when they are calculated over relatively short timeframes (< 9 months). Less biased measurement strategies that do not require a dispensing event are available, but require additional data to support their validity. Trial registration: The study was funded by grant R01HL83433 from the National Heart, Lung and Blood Institute (NHLBI) and is filed as study NCT00414817 in the clinicaltrials.gov database. [ABSTRACT FROM AUTHOR]

This paper deals with a new aging notion, which is called NBUrh, based on the reversed hazard rate order. It is found that the ILR life distribution can be characterized by using the decreasing property of the residual life according to the reversed hazard rate order. A part from some characterizations of NBUrh and implications between this notion and other known aging conceptions, we further investigate the preservation properties under order statistics and monotonic transforms. [ABSTRACT FROM AUTHOR]

We develop statistical methodology for the quantification of risk of source-destination pairs in an internet network. The methodology is developed within the framework of functional data analysis and copula modeling. It is summarized in the form of computational algorithms that use bidirectional source-destination packet counts as input. The usefulness of our approach is evaluated by an application to real internet traffic flows and via a simulation study. [ABSTRACT FROM AUTHOR]

We explore the economics of ransomware on production supply chains. Integrated supply chains result in a mutual-dependence between firms that can be exploited by cyber-criminals. For instance, we show that by targeting one firm in the network the criminals can potentially hold multiple firms to ransom. Overlapping security systems may also allow the criminals to strike at weak points in the network. For instance, it may be optimal for the attacker to target a supplier in order to ransom a large producer at the heart of the production network. We introduce a game theoretic model of an attack on a supply chain and solve for two types of Nash equilibria. We then study a hub and spoke example before providing simulation results for a general case. We find that the total ransom the criminals can demand is increasing in the average path length of the network. Thus, the ransom is lowest for a hub and spoke network and highest for a line network. Mitigation strategies are discussed. [ABSTRACT FROM AUTHOR]

Correlation in cyber risk represents an additional source of concern for utility and industrial infrastructures, where risks may be introduced by connected systems. A major means of reducing risk is to transfer it through insurance. In this paper, we consider a company which has peripheral branches in addition to its headquarters, where risk correlation is present between all of its sites and insurance is adopted to hedge against economic losses. We employ the expected utility principle (which leads to the well-known mean variance premium formula) to derive the insurance premium under risk correlation under several risk scenarios. Under a first-order approximation, a quasi-linear relationship between the premium and the two major risk factors (the number of branches and the risk correlation coefficient) is determined. [ABSTRACT FROM AUTHOR]

Despite growing attention to cyber risks in research and practice, quantitative cyber risk assessments remain limited, mainly due to a lack of reliable data. This analysis leverages sparse historical data to quantify the financial impact of cyber incidents at the enterprise level. For this purpose, an operational risk database—which has not been previously used in cyber research—was examined to model and predict the likelihood, severity and time dependence of a company's cyber risk exposure. The proposed model can predict a negative time correlation, indicating that individual cyber exposure is increasing if no cyber loss has been reported in previous years, and vice versa. The results suggest that the probability of a cyber incident correlates with the subindustry, with the insurance sector being particularly exposed. The predicted financial losses from a cyber incident are less extreme than cited in recent investigations. The study confirms that cyber risks are heavy-tailed, jeopardising business operations and profitability. [ABSTRACT FROM AUTHOR]

Modeling cyber risks has been an important but challenging task in the domain of cyber security, which is mainly caused by the high dimensionality and heavy tails of risk patterns. Those obstacles have hindered the development of statistical modeling of the multivariate cyber risks. In this work, we propose a novel approach for modeling the multivariate cyber risks which relies on the deep learning and extreme value theory. The proposed model not only enjoys the high accurate point predictions via deep learning but also can provide the satisfactory high quantile predictions via extreme value theory. Both the simulation and empirical studies show that the proposed approach can model the multivariate cyber risks very well and provide satisfactory prediction performances. [ABSTRACT FROM AUTHOR]

Modeling cyber threats, such as the computer malicious software (malware) propagation dynamics in cyberspace, is an important research problem because models can deepen our understanding of dynamical cyber threats. In this paper, we study the statistical modeling of the macro-level evolution of dynamical cyber attacks. Specifically, we propose a Bayesian structural time series approach for modeling the computer malware propagation dynamics in cyberspace. Our model not only possesses the parsimony property (i.e. using few model parameters) but also can provide the predictive distribution of the dynamics by accommodating uncertainty. Our simulation study shows that the proposed model can fit and predict the computer malware propagation dynamics accurately, without requiring to know the information about the underlying attack-defense interaction mechanism and the underlying network topology. We use the model to study the propagation of two particular kinds of computer malware, namely the Conficker and Code Red worms, and show that our model has very satisfactory fitting and prediction accuracies. [ABSTRACT FROM AUTHOR]

In this paper, the relative dependence of a linear regression model is studied. In particular, the dependence of autoregressive models in time series are investigated. It is shown that for the first-order non-stationary autoregressive model and the random walk with trend and drift model, the dependence between two states decreases with lag. Some numerical examples are presented as well. [ABSTRACT FROM AUTHOR]

Modeling cyber-attacks is a very attractive area of research because of its practical importance. However, most of the related research in the literature does not consider the simultaneous (or coordinated) attacks, which, in fact, is an important attack instrument in practice. This is mainly because of the complicated evolution of cyber-attacks over networks. In this paper, we propose a novel model, which can accommodate different types of simultaneous attacks with possible heterogeneous compromise probabilities. Our results show that simultaneous attacks have a significant effect on the reliability/dynamics of network systems. In particular, we present a sufficient condition for the epidemics dying out over the network, and upper bounds for the time to extinction. We also provide upper bounds for compromise probabilities of network systems when the evolution enters the quasi-equilibrium state. The effects of strength of simultaneous attacks and heterogeneity among successful attack probabilities on epidemic spreading are studied as well. The theoretical results are further validated by the simulation evidence. [ABSTRACT FROM AUTHOR]

Each day brings with it a news report about how another company has suffered a data breach. But then what? Victims of data breaches have little or no recourse. Victims often struggle to overcome the constitutional standing requirement. When a legal settlement is reached, the actual compensation that victims receive is minimal. Businesses have weak incentives to strengthen security protocols, and there is no standard for what constitutes acceptable data protection practices. This Note reconceptualizes data breaches, not as isolated events requiring specifically tailored remedies, but as societal harms that are sure to repeat themselves. Using past responses to other widespread risks, this Note outlines a modern solution to the problem of data breaches. By setting clear standards, realigning incentives for organizations that store data, and ensuring that impacted parties obtain meaningful recovery, the incidence of data breaches and their harmful effects can be minimzed. [ABSTRACT FROM AUTHOR]

Modeling cybersecurity risks is an important, yet challenging, problem. In this paper, we initiate the study of modeling multivariate cybersecurity risks. We develop the first statistical approach, which is centered at a Copula-GARCH model that uses vine copulas to model the multivariate dependence exhibited by real-world cyber attack data. We find that ignoring the due multivariate dependence causes a severe underestimation of cybersecurity risks. Both simulation and empirical studies show that the proposed approach leads to accurate predictions of multivariate cybersecurity risks. [ABSTRACT FROM AUTHOR]