Search

Abstract Like how useful weather forecasting is, the capability of forecasting or predicting cyber threats can never be overestimated. Previous investigations show that cyber attack data exhibits interesting phenomena, such as long-range dependence and high nonlinearity, which impose a particular challenge on modeling and predicting cyber attack rates. Deviating from the statistical approach that is utilized in the literature, in this paper we develop a deep learning framework by utilizing the bi-directional recurrent neural networks with long short-term memory, dubbed BRNN-LSTM. Empirical study shows that BRNN-LSTM achieves a significantly higher prediction accuracy when compared with the statistical approach.

Causality is an intriguing concept that once tamed, can have many applications. While having been widely investigated in other domains, its relevance and usefulness in the cybersecurity domain has received little attention. In this paper, we present a systematic investigation of a particular approach to causality, known as Granger causality (G-causality), in cybersecurity. We propose a framework, dubbed Cybersecurity Granger Causality (CGC), for characterizing the presence of G-causality in cyber attack rate time series and for leveraging G-causality to predict (i.e., forecast) cyber attack rates. The framework offers a range of research questions, which can be adopted or adapted to study G-causality in other kinds of cybersecurity time series data. In order to demonstrate the usefulness of CGC, we present a case study by applying it to a particular cyber attack dataset collected at a honeypot. From this case study, we draw a number of insights into the usefulness and limitations of G-causality in the cybersecurity domain.

In this paper we provide some sufficient conditions to stochastically compare linear combinations of independent random variables. The main results extend those given in Proschan (1965), Ma (1998), Zhao et al. (2011), and Yu (2011). In particular, we propose a new sufficient condition to compare the peakedness of linear combinations of independent random variables which may have heavy-tailed properties. [ABSTRACT FROM AUTHOR]

In this paper, some ordering properties of convolutions of heterogeneous Bernoulli random variables are discussed. It is shown that, under some suitable conditions, the likelihood ratio order and the reversed hazard rate order hold between convolutions of two heterogeneous Bernoulli sequences. The results established here extend and strengthen the previous results of Pledger and Proschan (1971) and Boland, Singh and Cukic (2002). [ABSTRACT FROM AUTHOR]

A parallel system with heterogeneous exponential component lifetimes is shown to be more skewed (according to the convex transform order) than the system with independent and identically distributed exponential components. As a consequence, equivalent conditions for comparing the variabilities of the largest order statistics from heterogeneous and homogeneous exponential samples in the sense of the dispersive order and the right- spread order are established. A sufficient condition is also given for the proportional hazard rate model. [ABSTRACT FROM AUTHOR]

This paper deals with preservation of the reversed hazard rate order between equilibrium random variables under formations of some reliability structures. We further investigate a new aging notion based upon the reversed hazard rate order between a random life and its equilibrium version. A nonparametric method is developed to test the exponentiality against such a strict aging property, some numerical results are presented as well. [ABSTRACT FROM AUTHOR]

Background: Pharmacy databases are commonly used to assess medication usage, and a number of measures have been developed to measure patients' adherence to medication. An extensive literature now supports these measures, although few studies have systematically compared the properties of different adherence measures. Methods: As part of an 18-month randomized clinical trial to assess the impact of automated telephone reminders on adherence to inhaled corticosteroids (ICS) among 6903 adult members of a managed care organization, we computed eight pharmacy-based measures of ICS adherence using outpatient pharmacy dispensing records obtained from the health plan's electronic medical record. We used simple descriptive statistics to compare the relative performance characteristics of these measures. Results: Comparative analysis found a relative upward bias in adherence estimates for those measures that require at least one dispensing event to be calculated. Measurement strategies that require a second dispensing event evidence even greater upward bias. These biases are greatest with shorter observation times. Furthermore, requiring a dispensing to be calculated meant that these measures could not be defined for large numbers of individuals (17-32 % of participants in this study). Measurement strategies that do not require a dispensing event to be calculated appear least vulnerable to these biases and can be calculated for everyone. However they do require additional assumptions and data (e.g., pre-intervention dispensing data) to support their validity. Conclusions: Many adherence measures require one, or sometimes two, dispensings in order to be defined. Since such measures assume all dispensed medication is used as directed, they have a built in upward bias that is especially pronounced when they are calculated over relatively short timeframes (< 9 months). Less biased measurement strategies that do not require a dispensing event are available, but require additional data to support their validity. Trial registration: The study was funded by grant R01HL83433 from the National Heart, Lung and Blood Institute (NHLBI) and is filed as study NCT00414817 in the clinicaltrials.gov database. [ABSTRACT FROM AUTHOR]

This paper deals with a new aging notion, which is called NBUrh, based on the reversed hazard rate order. It is found that the ILR life distribution can be characterized by using the decreasing property of the residual life according to the reversed hazard rate order. A part from some characterizations of NBUrh and implications between this notion and other known aging conceptions, we further investigate the preservation properties under order statistics and monotonic transforms. [ABSTRACT FROM AUTHOR]

We develop statistical methodology for the quantification of risk of source-destination pairs in an internet network. The methodology is developed within the framework of functional data analysis and copula modeling. It is summarized in the form of computational algorithms that use bidirectional source-destination packet counts as input. The usefulness of our approach is evaluated by an application to real internet traffic flows and via a simulation study. [ABSTRACT FROM AUTHOR]

We explore the economics of ransomware on production supply chains. Integrated supply chains result in a mutual-dependence between firms that can be exploited by cyber-criminals. For instance, we show that by targeting one firm in the network the criminals can potentially hold multiple firms to ransom. Overlapping security systems may also allow the criminals to strike at weak points in the network. For instance, it may be optimal for the attacker to target a supplier in order to ransom a large producer at the heart of the production network. We introduce a game theoretic model of an attack on a supply chain and solve for two types of Nash equilibria. We then study a hub and spoke example before providing simulation results for a general case. We find that the total ransom the criminals can demand is increasing in the average path length of the network. Thus, the ransom is lowest for a hub and spoke network and highest for a line network. Mitigation strategies are discussed. [ABSTRACT FROM AUTHOR]

Correlation in cyber risk represents an additional source of concern for utility and industrial infrastructures, where risks may be introduced by connected systems. A major means of reducing risk is to transfer it through insurance. In this paper, we consider a company which has peripheral branches in addition to its headquarters, where risk correlation is present between all of its sites and insurance is adopted to hedge against economic losses. We employ the expected utility principle (which leads to the well-known mean variance premium formula) to derive the insurance premium under risk correlation under several risk scenarios. Under a first-order approximation, a quasi-linear relationship between the premium and the two major risk factors (the number of branches and the risk correlation coefficient) is determined. [ABSTRACT FROM AUTHOR]

Despite growing attention to cyber risks in research and practice, quantitative cyber risk assessments remain limited, mainly due to a lack of reliable data. This analysis leverages sparse historical data to quantify the financial impact of cyber incidents at the enterprise level. For this purpose, an operational risk database—which has not been previously used in cyber research—was examined to model and predict the likelihood, severity and time dependence of a company's cyber risk exposure. The proposed model can predict a negative time correlation, indicating that individual cyber exposure is increasing if no cyber loss has been reported in previous years, and vice versa. The results suggest that the probability of a cyber incident correlates with the subindustry, with the insurance sector being particularly exposed. The predicted financial losses from a cyber incident are less extreme than cited in recent investigations. The study confirms that cyber risks are heavy-tailed, jeopardising business operations and profitability. [ABSTRACT FROM AUTHOR]

Modeling cyber risks has been an important but challenging task in the domain of cyber security, which is mainly caused by the high dimensionality and heavy tails of risk patterns. Those obstacles have hindered the development of statistical modeling of the multivariate cyber risks. In this work, we propose a novel approach for modeling the multivariate cyber risks which relies on the deep learning and extreme value theory. The proposed model not only enjoys the high accurate point predictions via deep learning but also can provide the satisfactory high quantile predictions via extreme value theory. Both the simulation and empirical studies show that the proposed approach can model the multivariate cyber risks very well and provide satisfactory prediction performances. [ABSTRACT FROM AUTHOR]

Modeling cyber threats, such as the computer malicious software (malware) propagation dynamics in cyberspace, is an important research problem because models can deepen our understanding of dynamical cyber threats. In this paper, we study the statistical modeling of the macro-level evolution of dynamical cyber attacks. Specifically, we propose a Bayesian structural time series approach for modeling the computer malware propagation dynamics in cyberspace. Our model not only possesses the parsimony property (i.e. using few model parameters) but also can provide the predictive distribution of the dynamics by accommodating uncertainty. Our simulation study shows that the proposed model can fit and predict the computer malware propagation dynamics accurately, without requiring to know the information about the underlying attack-defense interaction mechanism and the underlying network topology. We use the model to study the propagation of two particular kinds of computer malware, namely the Conficker and Code Red worms, and show that our model has very satisfactory fitting and prediction accuracies. [ABSTRACT FROM AUTHOR]

In this paper, the relative dependence of a linear regression model is studied. In particular, the dependence of autoregressive models in time series are investigated. It is shown that for the first-order non-stationary autoregressive model and the random walk with trend and drift model, the dependence between two states decreases with lag. Some numerical examples are presented as well. [ABSTRACT FROM AUTHOR]

Modeling cyber-attacks is a very attractive area of research because of its practical importance. However, most of the related research in the literature does not consider the simultaneous (or coordinated) attacks, which, in fact, is an important attack instrument in practice. This is mainly because of the complicated evolution of cyber-attacks over networks. In this paper, we propose a novel model, which can accommodate different types of simultaneous attacks with possible heterogeneous compromise probabilities. Our results show that simultaneous attacks have a significant effect on the reliability/dynamics of network systems. In particular, we present a sufficient condition for the epidemics dying out over the network, and upper bounds for the time to extinction. We also provide upper bounds for compromise probabilities of network systems when the evolution enters the quasi-equilibrium state. The effects of strength of simultaneous attacks and heterogeneity among successful attack probabilities on epidemic spreading are studied as well. The theoretical results are further validated by the simulation evidence. [ABSTRACT FROM AUTHOR]

Each day brings with it a news report about how another company has suffered a data breach. But then what? Victims of data breaches have little or no recourse. Victims often struggle to overcome the constitutional standing requirement. When a legal settlement is reached, the actual compensation that victims receive is minimal. Businesses have weak incentives to strengthen security protocols, and there is no standard for what constitutes acceptable data protection practices. This Note reconceptualizes data breaches, not as isolated events requiring specifically tailored remedies, but as societal harms that are sure to repeat themselves. Using past responses to other widespread risks, this Note outlines a modern solution to the problem of data breaches. By setting clear standards, realigning incentives for organizations that store data, and ensuring that impacted parties obtain meaningful recovery, the incidence of data breaches and their harmful effects can be minimzed. [ABSTRACT FROM AUTHOR]

Modeling cybersecurity risks is an important, yet challenging, problem. In this paper, we initiate the study of modeling multivariate cybersecurity risks. We develop the first statistical approach, which is centered at a Copula-GARCH model that uses vine copulas to model the multivariate dependence exhibited by real-world cyber attack data. We find that ignoring the due multivariate dependence causes a severe underestimation of cybersecurity risks. Both simulation and empirical studies show that the proposed approach leads to accurate predictions of multivariate cybersecurity risks. [ABSTRACT FROM AUTHOR]

Internet-based computer information systems play critical roles in many aspects of modern society. However, these systems are constantly under cyber attacks that can cause catastrophic consequences. To defend these systems effectively, it is necessary to measure and predict the effectiveness of cyber defense mechanisms. In this article, we investigate how to measure and predict the effectiveness of an important cyber defense mechanism that is known asearly-warning. This turns out to be a challenging problem because we must accommodate thedependenceamong certain four-dimensional time series. In the course of using a dataset to demonstrate the prediction methodology, we discovered a newnonexchangeableandrotationally symmetricdependence structure, which may be of independent value. We propose a new vine copula model to accommodate the newly discovered dependence structure, and show that the new model can predict the effectiveness of early-warning more accurately than the others. We also discuss how to use the prediction methodology in practice. [ABSTRACT FROM AUTHOR]

Cyber attacks have become a problem that is threatening the economy, human privacy, and even national security. Before we can adequately address the problem, we need to have a crystal clear understanding about cyber attacks from various perspectives. This is a challenge because the Internet is a large-scale complex system with humans in the loop. In this paper, we investigate a particular perspective of the problem, namely the extreme value phenomenon that is exhibited by cyber attack rates, which are the numbers of attacks against a system of interest per time unit. It is important to explore this perspective because understanding the statistical properties of extreme cyber attack rates will pave the way for cost-effective, if not optimal, allocation of resources in real-life cyber defense operations. Specifically, we propose modeling and predicting extreme cyber attack rates via marked point processes, while using the Value-at-Risk as a natural measure of intense cyber attacks. The point processes are then applied to analyze some real data sets. Our analysis shows that the point processes can describe and predict extreme cyber attack rates at a very satisfactory accuracy. [ABSTRACT FROM AUTHOR]

In this paper, we propose a novel method for constructing upper bounds of the quasi-stationary distribution of SIS processes. Using this method, we obtain an upper bound that is better than the state-of-the-art upper bound. Moreover, we prove that the fixed point map Φ [7] actually preserves the equilibrium reversed hazard rate order under a certain condition. This allows us to further improve the upper bound. Some numerical results are presented to illustrate the results. [ABSTRACT FROM PUBLISHER]

Discrete power-law distributions have significant consequences for understanding many phenomena in practice, and have attracted much attention in recent decades. However, in many practical applications, there exists a natural upper bound for the probability tail. In this paper, we develop maximum likelihood estimates for truncated discrete power-law distributions based on the upper order statistics, and large sample properties are mentioned as well. Monte Carlo simulation is carried out to examine the finite sample performance of the estimates. Applications in real cyber attack data and peak gamma-ray intensity of solar flares are highlighted. [ABSTRACT FROM AUTHOR]

Sufficient conditions for comparing the convolutions of heterogeneous gamma random variables in terms of the usual stochastic order are established. Such comparisons are characterized by the Schur convexity properties of the cumulative distribution function of the convolutions. Some examples of the practical applications of our results are given. [ABSTRACT FROM AUTHOR]

Bidder asymmetries are common in certain auctions where heterogeneous bidders coexist. In this paper, we employ the tool of majorization to study the effect of bidder asymmetry on revenue in second-price auctions. As a preorder on vectors of real components, the majorization is used to rank the asymmetry of bid distributions from different auctions. Our analysis indicates that bidders' asymmetries may raise revenue under certain classes of value distributions (e.g., proportional reversed hazard rate models) and may not in others (e.g., proportional hazard rate models). These results are further validated through supportive evidence that is based on simulated three-bidder auctions. The use of majorization allows us to extend and strengthen the results obtained in the existing literature under more general conditions. This study adds to the literature a useful analytical technique for future research on asymmetric auctions. [ABSTRACT FROM AUTHOR]

In this article, necessary conditions for comparing order statistics from distributions with regularly varying tails are discussed in terms of various stochastic orders. A necessary and sufficient condition for stochastically comparing tail behaviors of order statistics is derived. The main results generalize and recover some results in Kleiber (2002, 2004). Extensions to coherent systems are mentioned as well. [ABSTRACT FROM AUTHOR]

Order statistics from heterogeneous samples have been extensively studied in the literature. However, most of the work focused on the effect of heterogeneity on the magnitude or dispersion of order statistics. In this paper, we study the skewness of order statistics from heterogeneous samples according to star ordering. The main results extend the corresponding results in Kochar and Xu (J. Appl. Probab. 46:342-352, ; J. Appl. Probab. 48:271-284, ). Examples and applications are highlighted as well. [ABSTRACT FROM AUTHOR]

Rigorously characterizing the statistical properties of cyber attacks is an important problem. In this paper, we propose the first statistical framework for rigorously analyzing honeypot-captured cyber attack data. The framework is built on the novel concept of stochastic cyber attack process, a new kind of mathematical objects for describing cyber attacks. To demonstrate use of the framework, we apply it to analyze a low-interaction honeypot dataset, while noting that the framework can be equally applied to analyze high-interaction honeypot data that contains richer information about the attacks. The case study finds, for the first time, that long-range dependence (LRD) is exhibited by honeypot-captured cyber attacks. The case study confirms that by exploiting the statistical properties (LRD in this case), it is feasible to predict cyber attacks (at least in terms of attack rate) with good accuracy. This kind of prediction capability would provide sufficient early-warning time for defenders to adjust their defense configurations or resource allocations. The idea of “gray-box” (rather than “black-box”) prediction is central to the utility of the statistical framework, and represents a significant step towards ultimately understanding (the degree of) the predictability of cyber attacks. [ABSTRACT FROM PUBLISHER]

Professors Balakrishnan and Zhao have written an excellent survey on the recent developments of stochastic comparisons of order statistics, which cover almost every aspect of ordering properties of order statistics from both continuous and discrete heterogeneous populations. My discussion will be limited to the skewness of order statistics and order statistics from heterogeneous populations with different shape parameters. [ABSTRACT FROM AUTHOR]

The urban ecosystem possesses dissipating structures that can absorb substances and energy from the external environment and export products and wastes to maintain order within the system. Given these circumstances, this paper analyzed the ability of the urban ecosystem in Guangzhou City to sustain development from the perspective of entropy. The research was carried out in three steps. First, an evaluation index system that considers the ability of the urban ecosystem for sustainable development was formed based on the structures and functions of the urban ecosystem and the change in the entropy of the urban socioeconomic ecosystem. Second, the sustainable development ability assessment model for the urban ecosystem was built using information entropy. Last, by combining the time series variation of the evaluation indicators with the entropy weights, this paper analyzed the influence of the combined factors on the sustainable development ability of the urban ecosystem in Guangzhou and suggested some measures to promote the sustainable development of the urban ecosystem in Guangzhou. The conclusions of this study can be summarized as follows: (1) The urban ecosystem has developed in an orderly and healthy direction, with effective control over the urban environmental pollution problems in Guangzhou between 2004 and 2010. (2) The sustainable development ability of the urban ecosystem had been on an upward trend in Guangzhou during the study period. The ability of the natural urban ecosystem to support the urban socioeconomic ecosystem increased continuously, and the improved ecoenvironment enhanced the harmony and vitality of the urban ecosystem in Guangzhou. [ABSTRACT FROM AUTHOR]

In this paper, a new sufficient condition for comparing linear combinations of independent gamma random variables according to star ordering is given. This unifies some of the newly proved results on this problem. Equivalent characterizations between various stochastic orders are established by utilizing the new condition. The main results in this paper generalize and unify several results in the literature including those of Amiri, Khaledi, and Samaniego [2], Zhao [18], and Kochar and Xu [9]. [ABSTRACT FROM AUTHOR]

In this article, we study the order statistics from heterogenous negative binomial random variables. Sufficient conditions are provided for comparing the extreme order statistics according to the usual stochastic order. For the special case of geometric distribution, a sufficient condition is established for comparing order statistics in the sense of multivariate stochastic order. Applications in the Poisson–Gamma shock model and redundant systems have been described as well. [ABSTRACT FROM AUTHOR]

In this article, mixture representations of survival functions of residual lifetimes of k-out-of-n systems are obtained when the components are independent but not necessarily identically distributed. Then we stochastically compare the residual lifetimes of k-out-of-n systems in one- and two-sample problems. In particular, the results extend some results in Li and Zhao [14], Khaledi and Shaked [13], Sadegh [17], Gurler and Bairamov [7] and Navarro, Balakrishnan, and Samaniego [16]. Applications in the proportional hazard rates model are presented as well. [ABSTRACT FROM AUTHOR]

Cyber insurance ratemaking (CIRM) is a procedure used to set rates (or prices) for cyber insurance products provided by insurance companies. Rate estimation is a critical issue for cyber insurance products. This problem arises because of the unavailability of actuarial data and the uncertainty of normative standards of cyber risk. Most cyber risk analyses do not consider the connection between Information Communication and Technology (ICT) sources. Recently, a cyber risk model was developed that considered the network structure. However, the analysis of this model remains limited to an unweighted network. To address this issue, we propose using a graph mining approach (GMA) to CIRM, which can be applied to obtain fair and competitive prices based on weighted network characteristics. This study differs from previous studies in that it adds the GMA to CIRM and uses communication models to explain the frequency of communications as weights in the network. We used the heterogeneous generalized susceptible-infectious-susceptible model to accommodate different infection rates. Our approach adds up to the existing method because it considers the communication frequency and GMA in CIRM. This approach results in heterogeneous premiums. Additionally, GMA can choose more active communications to reflect high communications contribution in the premiums or rates. This contribution is not found when the infection rates are the same. Based on our experimental results, it is apparent that this method can produce more reasonable and competitive prices than other methods. The prices obtained with GMA and communication factors are lower than those obtained without GMA and communication factors. [ABSTRACT FROM AUTHOR]

This paper investigates the stochastic comparison of spacings of record values. The likelihood ratio order, the hazard rate order and the mean residual life order between spacings of record values from one sample sequence are developed. Furthermore, the increasing convex order and the mean residual life order between simple spacings of record values from two sample sequences are built as well. [ABSTRACT FROM AUTHOR]

Let X1, ? , Xnbe independent random variables with Xihaving survival function F?i, i= 1, ? , n, and let Y1, ? ,Ynbe a random sample with common population survival distribution F, where c= ?i=1n?i/n. Let Xn:nand Yn:ndenote the lifetimes of the parallel systems consisting of these components, respectively. It is shown that Xn:nis greater than Yn:nin terms of likelihood ratio order. It is also proved that the sample range Xn:n? X1:nis larger than Yn:n? Y1:naccording to reverse hazard rate ordering. These two results strengthen and generalize the results in Dykstra, Kochar, and Rojo [6] and Kochar and Rojo [11], respectively. [ABSTRACT FROM AUTHOR]

This article deals with the multiple-outlier exponential model. The likelihood ratio order between m-spacings of the combined sample is developed, some results extend the conclusions on simple spacings in Wen et al. (2007). [ABSTRACT FROM AUTHOR]

A security indicator is a sign that shows us what something is like or how a situation is changing and can aid us in making informed estimations on cyber risks. There are many different breeds of security indicators, but, unfortunately, they are not always easy to apply due to a lack of available or credible sources of data. This paper undertakes a systematic mapping study on the academic literature related to cyber security indicator data. We identified 117 primary studies from the past five years as relevant to answer our research questions. They were classified according to a set of categories related to research type, domain, data openness, usage, source, type and content. Our results show a linear growth of publications per year, where most indicators are based on free or internal technical data that are domain independent. While these indicators can give valuable information about the contemporary cyber risk, the increasing usage of unconventional data sources and threat intelligence feeds of more strategic and tactical nature represent a more forward-looking trend. In addition, there is a need to take methods and techniques developed by the research community from the conceptual plane and make them practical enough for real-world application. [ABSTRACT FROM AUTHOR]

The publication offers a note of thanks and lists its reviewers. [ABSTRACT FROM AUTHOR]

First of all, we express our sincere thanks to all the discussants for their valuable comments and suggestions as well as for their own significant contributions to the area of order statistics in general, and to the topic of stochastic comparison in particular. We shall now provide our response to the comments and suggestions of all the discussants. [ABSTRACT FROM AUTHOR]

Like how useful weather forecasting is, the capability of forecasting or predicting cyber threats can never be overestimated. Previous investigations show that cyber attack data exhibits interesting phenomena, such as long-range dependence and high nonlinearity, which impose a particular challenge on modeling and predicting cyber attack rates. Deviating from the statistical approach that is utilized in the literature, in this paper we develop a deep learning framework by utilizing the bi-directional recurrent neural networks with long short-term memory, dubbed BRNN-LSTM. Empirical study shows that BRNN-LSTM achieves a significantly higher prediction accuracy when compared with the statistical approach. [ABSTRACT FROM AUTHOR]

In our article [3] we have found a gap in the middle of the proof of Theorem 3.2. Therefore, we do not know whether Theorem 3.2 is true for the reverse hazard rate order. However, we could prove the following weaker result for the stochastic order. [ABSTRACT FROM AUTHOR]

The publication offers a note of thanks and lists its reviewers. [ABSTRACT FROM PUBLISHER]