Search

We study security-development patterns in computer-science technologies through (i) the security attention among technologies, (ii) the relation between technological change and security development, and (iii) the effect of opinion on security development. We perform a scientometric analysis on arXiv e-prints (n=340,569) related to 20 computer-science technology categories. Our contribution is threefold. First, we characterize both processes of technological change and security development: while most technologies follow a logistic-growth process, the security development follows an AR(1) process or a random walk with positive drift. Moreover, over the lifetime of computer-science technologies, the security development surges at a late stage. Second, we document no relation between the technological change and the security development. Third, we identify an inverse relation between security attention and experts’ opinion. Along with these results, we introduce new methods for modeling security-development patterns for broader sets of technologies., Technological Forecasting and Social Change, 188, ISSN:0040-1625

Clinical research in autism has recently witnessed promising digital phenotyping results, mainly focused on single feature extraction, such as gaze, head turn on name-calling or visual tracking of the moving object. The main drawback of these studies is the focus on relatively isolated behaviors elicited by largely controlled prompts. We recognize that while the diagnosis process understands the indexing of the specific behaviors, ASD also comes with broad impairments that often transcend single behavioral acts. For instance, the atypical nonverbal behaviors manifest through global patterns of atypical postures and movements, fewer gestures used and often decoupled from visual contact, facial affect, speech. Here, we tested the hypothesis that a deep neural network trained on the non-verbal aspects of social interaction can effectively differentiate between children with ASD and their typically developing peers. Our model achieves an accuracy of 80.9% (F1 score: 0.818; precision: 0.784; recall: 0.854) with the prediction probability positively correlated to the overall level of symptoms of autism in social affect and repetitive and restricted behaviors domain. Provided the non-invasive and affordable nature of computer vision, our approach carries reasonable promises that a reliable machine-learning-based ASD screening may become a reality not too far in the future.

Cyber risk encompasses a broad spectrum of risks to digital systems, such as data breaches or full-fledged cyber attacks on the electric grid. Efforts to systematically advance the science of cyber risk must draw on not only computer science but also fields such as behavioral science, economics, law, management science, and political science. Yet, many scholars believe that they have sufficient understanding of other fields to comprehensively address the inherently cross-disciplinary nature of cyber risk. For example, a statistician might apply Bayesian modeling to predict future cyber events, even though it is not entirely clear what bearing historical cyber events have on future ones. Computer scientists might write on data protection laws, yet with little knowledge of legal jurisdiction issues. Such questions of disciplinary ownership, the inability to coordinate across disciplines, and the undefined scope of the problem domain have thus plagued inherently cross-disciplinary cyber risk research. Drawing on global expertise and challenges from industry, academia, nonprofit organizations, and governments, we adapted the classical risk-management process to identify core research questions for cyber risk, gaps in knowledge that need to be addressed for advances in security, and opportunities for cross-disciplinary collaboration for each area. Although we mention specific disciplines reflective of our backgrounds, these are not the only ones that should be conducting cyber risk research.

STUDY OBJECTIVES: Actigraphy, the tool of choice for assessment of sleep phase disorders, is insensitive to movement-free waking. This study aimed to determine whether the detection of waking could be performed by recording instrumental responses to haptic stimuli delivered by a low-cost device. METHODS: Twenty adults underwent 2 nights of laboratory polysomnography (PSG) while wearing a fingerless glove under which a stimulating actigraph (“Wakemeter”) was apposed to the palm. The Wakemeter, controlled by a tablet computer, delivered gentle, haptic stimuli every 10 minutes during the sleep period. If a stimulus was detected, the participant squeezed the Wakemeter. Stimulus times, response times and movements were streamed to the tablet. Concurrent PSG data were scored blind to stimuli and responses. Self-reported sleep quality ratings were collected each morning. RESULTS: The Wakemeter was acceptable to 19 of 20 participants, and effects on self-reported and objective sleep were small. The probability of a response to the stimulus during a wake epoch was high regardless of movement. In contrast, actigraphy magnitude distributions were indistinguishable across epochs scored wake without movement versus sleep, confirming a known limitation of actigraphy. A simple method for calculating sleep efficiency from responses to the stimuli yielded estimates that were highly correlated with PSG-derived estimates (rho = .69, P < .001). CONCLUSIONS: Behavioral responses to haptic stimuli detected epochs of movement-free wake during the sleep period and may augment actigraphy in the low-burden estimation of sleep efficiency. Acceptability of the method over longer recording periods remains to be established. CITATION: Miller KE, Bäbler L, Maillart T, Faerman A, Woodward SH. Sleep/wake detection by behavioral response to haptic stimuli. J Clin Sleep Med. 2019;15(11):1675–1681.

Organizations exist because they provide additional production gains, in comparison to horizontal ways of allocating resources, such as markets, and the open source movement is deemed to be a new kind of peer-production organization somehow in between hierarchically organized firms and markets. However, to strive as a new kind of organization, open source must provide production gains, which in turn should be measurable. The open source movement is particularly interesting to study for this reason. Here, we confront and discuss two contrasting views, which were reported in the literature recently. On the one hand, Sornette et al. uncovered a superlinear production mechanism, which quantifies Aristotle adage: `the whole is more than the sum of its parts'. On the other hand, Scholtes et al. found opposite results, and referred to Maximilien Ringelmann, a French agricultural engineer (1861-1931), who discovered the tendency for individual members of a group to become increasingly less productive as the size of their group increases. Since Ringelmann, the topic of collective intelligence has interested numbers of researchers in social sciences and social psychology, as well as practitioners in management aiming at improving the performance of their team. In most research and practice case studies, the Ringelmann effect has been found to hold, while, in contrast, the superlinear effect found by Sornette et al.is novel and may challenge common wisdom. Here, we compare these two theories, weigh their strengths and weaknesses, and discuss how they have been tested with empirical data. We find that they may not contradict each other as much as was claimed by Scholtes et al., 22 pages, published in Physica A

Bug bounty programs offer a modern platform for organizations to crowdsource their software security and for security researchers to be fairly rewarded for the vulnerabilities they find. Little is known however on the incentives set by bug bounty programs: How they drive new bug discoveries, and how they supposedly improve security through the progressive exhaustion of discoverable vulnerabilities. Here, we recognize that bug bounty programs create tensions, for organizations running them on the one hand, and for security researchers on the other hand. At the level of one bug bounty program, security researchers face a sort of St-Petersburg paradox: The probability of finding additional bugs decays fast, and thus can hardly be matched with a sufficient increase of monetary rewards. Furthermore, bug bounty program managers have an incentive to gather the largest possible crowd to ensure a larger pool of expertise, which in turn increases competition among security researchers. As a result, we find that researchers have high incentives to switch to newly launched programs, for which a reserve of low-hanging fruit vulnerabilities is still available. Our results inform on the technical and economic mechanisms underlying the dynamics of bug bounty program contributions, and may in turn help improve the mechanism design of bug bounty programs that get increasingly adopted by cybersecurity savvy organizations., 19 pages, 3 figures, 1 table, forthcoming at Journal of Cybersecurity (2017)

Personal data breaches from organisations, enabling mass identity fraud, constitute an \emph{extreme risk}. This risk worsens daily as an ever-growing amount of personal data are stored by organisations and on-line, and the attack surface surrounding this data becomes larger and harder to secure. Further, breached information is distributed and accumulates in the hands of cyber criminals, thus driving a cumulative erosion of privacy. Statistical modeling of breach data from 2000 through 2015 provides insights into this risk: A current maximum breach size of about 200 million is detected, and is expected to grow by fifty percent over the next five years. The breach sizes are found to be well modeled by an \emph{extremely heavy tailed} truncated Pareto distribution, with tail exponent parameter decreasing linearly from 0.57 in 2007 to 0.37 in 2015. With this current model, given a breach contains above fifty thousand items, there is a ten percent probability of exceeding ten million. A size effect is unearthed where both the frequency and severity of breaches scale with organisation size like $s^{0.6}$. Projections indicate that the total amount of breached information is expected to double from two to four billion items within the next five years, eclipsing the population of users of the Internet. This massive and uncontrolled dissemination of personal identities raises fundamental concerns about privacy., 16 pages, 3 sets of figures, and 4 tables

The European Physical Journal B, 86 (4), ISSN:1434-6028, ISSN:1434-6036

From biotechnology to cyber-risks, most extreme technological risks cannot be reliably estimated from historical statistics. Therefore, engineers resort to predictive methods, such as fault/event trees in the framework of probabilistic safety assessment (PSA), which consists in developing models to identify triggering events, potential accident scenarios, and estimate their severity and frequency. However, even the best safety analysis struggles to account for evolving risks resulting from inter-connected networks and cascade effects. Taking nuclear risks as an example, the predicted plant-specific distribution of losses is found to be significantly underestimated when compared with available empirical records. Using a novel database of 99 events with losses larger than $50'000 constructed by Sovacool, we document a robust power law distribution with tail exponent mu \approx 0.7. A simple cascade model suggests that the classification of the different possible safety regimes is intrinsically unstable in the presence of cascades. Additional continuous development and validation, making the best use of the experienced realized incidents, near misses and accidents, is urgently needed to address the existing known limitations of PSA when aiming at the estimation of total risks., Comment: expanded to 25 pages including 5 figures, in press in International Journal of Disaster Risk Reduction

The dynamics of technological, economic and social phenomena is controlled by how humans organize their daily tasks in response to both endogenous and exogenous stimulations. Queueing theory is believed to provide a generic answer to account for the often observed power-law distributions of waiting times before a task is fulfilled. However, the general validity of the power law and the nature of other regimes remain unsettled. Using anonymized data collected by Google at the World Wide Web level, we identify the existence of several additional regimes characterizing the time required for a population of Internet users to execute a given task after receiving a message. Depending on the under- or over-utilization of time by the population of users and the strength of their response to perturbations, the pure power law is found to be coextensive with an exponential regime (tasks are performed without too much delay) and with a crossover to an asymptotic plateau (some tasks are never performed). The characterization of the availability and efficiency of humans on their actions revealed by our study have important consequences to understand human decision-making, optimal designs of policies such as for Internet security, with spillovers to collective behaviors, crowds dynamics, and social epidemics., 17 pages, 4 figures

The European Physical Journal B, 75 (3), ISSN:1434-6028, ISSN:1434-6036

The evolution of open source software projects in Linux distributions offers a remarkable example of a growing complex self-organizing adaptive system, exhibiting Zipf's law over four full decades. We present three tests of the usually assumed ingredients of stochastic growth models that have been previously conjectured to be at the origin of Zipf's law: (i) the growth observed between successive releases of the number of in-directed links of packages obeys Gibrat's law of proportional growth; (ii) the average growth increment of the number of in-directed links of packages over a time interval $\Delta t$ is proportional to $\Delta t$, while its standard deviation is proportional to $\sqrt{\Delta t}$; (iii) the distribution of the number of in-directed links of new packages appearing in evolving versions of Debian Linux distributions has a tail thinner than Zipf's law, with an exponent which converges to the Zipf's law value 1 as the time $\Delta t$ between releases increases., Comment: 4 pages and 4 figures