The paper evaluates machine learning cyber defenses using log data against adversarial attacks.
problem Evaluating the robustness of machine learning cyber defenses against adversarial attacks.
method Developed a testing framework using deep reinforcement learning and adversarial natural language processing.
result Higher dropout levels increase robustness, with 90% dropout probability showing the highest robustness.
The scale of Internet-connected systems has increased considerably, and these systems are being exposed to cyber attacks more than ever. The complexity and dynamics of cyber attacks require protecting mechanisms to be responsive, adaptive, and scalable. Machine learning, or more specifically deep reinforcement learning…
This paper discusses adversarial attacks on cyber security systems using machine learning.
problem Adversarial attacks limit the use of machine learning in cyber security.
method Characterizes adversarial attack methods and their applications in cyber security.
result Highlights unique challenges and future research directions for adversarial attacks in cyber security.
This paper optimizes cybersecurity resource allocation in networks with heterogeneous attacker and defender valuations.
problem Optimizing cybersecurity resource allocation in networks with heterogeneous attacker and defender valuations.
method Combining strategic behavior of players with contagion dynamics, a method is extended to determine optimal resource allocation based on simple network metrics weighted by risk profiles.
result The asymmetry between attacker and defender valuations drives optimal attack and defense strategies, shaping system resilience.
Defense strategy improves controller robustness against adversarial attacks.
problem Adversarial attacks on learning-enabled controllers in CPS.
method Two-stage defense strategy treating controller and environment as black-boxes with unknown dynamics.
result Defense strategy effectively improves controller robustness in realistic control domains.
Research shows filtering reduces predictability of cyber-attacks.
problem Predicting cyber-attacks from incomplete data.
method Combining external data with machine learning algorithms to learn indicators of cyber-attacks.
result The process of filtering reduces the predictability of cyber-attacks.
Intrusion detection systems (IDSs) generate valuable knowledge about network security, but an abundance of false alarms and a lack of methods to capture the interdependence among alerts hampers their utility for network defense. Here, we explore a graph-based approach for fusing alerts generated by multiple IDSs (e.g.,…
Cyber attacks are growing in frequency and severity. Over the past year alone we have witnessed massive data breaches that stole personal information of millions of people and wide-scale ransomware attacks that paralyzed critical infrastructure of several countries. Combating the rising cyber threat calls for a multi-p…
This work develops agents to learn generalizable policies for dynamic network environments.
problem Real-world network topologies change due to attackers, defenders, or system failures, leading to failures in adaptive ACD systems.
method Developing agents to learn generalizable policies across dynamic network environments.
result Agents can learn robust policies for dynamic network topologies and diverse attackers.
Research evaluates data poisoning attacks on regression learning and introduces a new defense strategy.
problem Data poisoning attacks on regression learning threaten model integrity in critical systems.
method Realistic scenarios, novel black-box attack, and evaluation on 26 datasets.
result Mean squared error (MSE) increases to 150% with only 2% poisoned samples.
Due to the surprisingly good representation power of complex distributions, neural network (NN) classifiers are widely used in many tasks which include natural language processing, computer vision and cyber security. In recent works, people noticed the existence of adversarial examples. These adversarial examples break…
Study finds stocks with higher cyber risk scores outperform others, indicating a market-wide cyber risk premium.
problem Identifying and quantifying firms' cyber risks and their impact on stock performance.
method Machine learning algorithm to analyze disclosures and a dedicated cyber corpus.
result High cyber risk stocks significantly outperform others, indicating a market-wide cyber risk premium.
Nowadays more and more data are gathered for detecting and preventing cyber attacks. In cyber security applications, data analytics techniques have to deal with active adversaries that try to deceive the data analytics models and avoid being detected. The existence of such adversarial behavior motivates the development…
Paper analyzes cyber risk classifications for forecasting performance.
problem Lack of effective out-of-sample forecasting performance in current cyber risk classifications.
method Rolling window analysis using threshold weighted scoring functions.
result Dynamic and impact-based cyber risk classifiers outperform others in forecasting future cyber risk losses.
New adversarial training enhances malware detectors against various attacks.
problem Vulnerability of malware detectors to evasion attacks.
method Proposes a mixture of attacks and adversarial training to improve deep neural networks.
result Significantly enhances robustness of deep neural networks against a wide range of attacks.
Motivated by the developments in cyber risk treatment in the finance industry, we propose a general framework of cyber bond, whose main purpose is to insure (compensate) losses of a cyber attack. Based on a database of publicly available cyber events, we determine cyber loss distribution parameters and use them to nume…
Develops a Bonus-Malus model for cyber risk insurance to incentivize cybersecurity.
problem Lack of effective insurance strategies to incentivize cybersecurity.
method Proposes a Bonus-Malus model and a mathematical model with a numerical algorithm.
result Demonstrates how a Bonus-Malus system resolves moral hazard and benefits the insurer.
Paper introduces a framework for managing cyber risk with insurance and cybersecurity models.
problem Pervasive challenges in managing cyber risk, especially for capital allocation.
method Combines insurance frequency-severity models with cybersecurity cascade models for comprehensive cyber risk assessment. Facilitates informed capital allocation through a two-pillar framework.
result Demonstrates the necessity of comprehensive cost-benefit analysis for budget-constrained companies.
The paper models and prices cyber insurance risks, distinguishing idiosyncratic, systematic, and systemic risks.
problem Modeling and pricing cyber insurance policies, especially for systemic risks.
method Distinguishes three types of cyber risks and proposes methods for their valuation.
result Complex methods are needed for systemic cyber risks, including risk-neutral valuation and monetary risk measures.
Study examines cyber losses across sectors, finds high severity and frequency.
problem Understanding the nature of cyber losses and their variability across sectors.
method Analysis of a leading industry dataset of cyber events, focusing on frequency and severity.
result Cyber risks are heavy-tailed, with high probability of extreme losses.
Machine learning techniques help to understand patterns of a dataset to create a defense mechanism against cyber attacks. However, it is difficult to construct a theoretical model due to the imbalances in the dataset for discriminating attacks from the overall dataset. Multilayer Perceptron (MLP) technique will provide…
Preventing organizations from Cyber exploits needs timely intelligence about Cyber vulnerabilities and attacks, referred as threats. Cyber threat intelligence can be extracted from various sources including social media platforms where users publish the threat information in real time. Gathering Cyber threat intelligen…
Introduces an artificial cyber lab to test and identify cyber resilience measures.
problem Systemic cyber risks and their control methods.
method Classical contagion models and artificial cyber lab simulations.
result Identified two classes of measures: security- and topology-based interventions.
Study on cyber insurance viability using statistical models.
problem Exploring insurability of cyber risk and its factors.
method Regression models (GAMLSS, ordinal regressions) and utility modelling.
result Provides insights into insurability of cyber risk.
Study finds high cyber risk stocks generate significant excess returns.
problem Understanding and quantifying cyber risk's impact on stock returns.
method Machine learning algorithm measuring cyber risk proximity to a corpus.
result High cyber risk stocks generate an excess return of 18.72% p.a.
The paper examines the feasibility of managing aggregate cyber-risk in IoT environments.
problem Determining sustainable conditions for providing aggregate cyber-risk coverage.
method Developed a rigorous general theory and validated it with real data.
result Conditions for sustainable aggregate cyber-risk management under heavy-tailed distributions.
The paper uses a simulator and optimisation to defend against cyber threats.
problem Defending against cyber threats in simulated networks.
method Dynamic causal Bayesian optimisation (DCBO) integrated with a cyber security simulator.
result DCBO optimally reduces the cost of intrusions in simulated networks.
Enhances cyber risk assessment with entity-specific features.
problem Lack of high-quality public cyber incident data.
method Develops an InsurTech framework to enrich cyber incident data with entity-specific attributes and implements machine learning models.
result InsurTech features improve prediction robustness and provide customized risk profiles.
A novel model combines deep learning and extreme value theory for multivariate cyber risk prediction.
problem High dimensionality and heavy tails in multivariate cyber risk patterns.
method Combines deep learning for point predictions and extreme value theory for quantile predictions.
result The model provides satisfactory high quantile predictions and accurate point predictions.
Study quantifies model risk in cyber insurance, affecting premium pricing.
problem Model risk and risk sensitivity in cyber insurance pricing.
method Robust estimators for model parameters and dependence analysis.
result Robust estimation improves tail index and joint loss model accuracy.
This paper aims to optimize incident-specific cyber insurance design.
problem Complexity in determining optimal risk retention and transfer.
method Economic foundation for incident-specific cyber insurance with Pareto optimality.
result Illustrates feasibility of designing incident-specific indemnities for both parties.
Paper models cloud outages for cyber insurance stress-testing.
problem Cyber insurance portfolios' vulnerability to simultaneous cloud outages.
method Modeling and calibrating cloud-outage scenarios, measuring diversification.
result Cloud-outage diversification can protect against accumulation risk.
This research develops a new model for cyber risk and insurance pricing.
problem Accurate calculation of aggregate losses in cyber insurance pricing.
method A path-based k-generation risk contagion model in a tree-shaped network structure.
result Explicit expressions for mean and variance of local loss on a single path.
We present cyber-security problems of high importance. We show that in order to solve these cyber-security problems, one must cope with certain machine learning challenges. We provide novel data sets representing the problems in order to enable the academic community to investigate the problems and suggest methods to c…
CyPhERS provides real-time event info for CPSs, avoiding downtime.
problem Real-time event identification in CPSs is challenging due to complex interdependencies and rare events.
method CyPhERS integrates cyber and physical components, generating event signatures for known and unknown events.
result Event signatures provide relevant and inferable information on both known and unknown event types.
Study shows data breaches cause significant financial losses for firms, especially in health sector.
problem Understanding the economic impact of cyber incidents on listed firms.
method Event study using abnormal returns over 2012-2022, adjusting for event-induced variance and residual cross-correlation.
result Data breaches cause significant financial losses for firms, especially in health sector.
New approach detects cyber-attacks in real-time.
problem Real-time detection of cyber-attacks for effective mitigation.
method Aggregates unsupervised anomaly detection algorithms and incorporates delayed feedback.
result Improves anomaly detection performance through theoretical guarantees.
Framework for managing cyber risks in networks.
problem Managing systemic cyber risks in digital networks.
method Three components: acceptable configurations, risk mitigation interventions, and cost function.
result Effective decision-making for network resilience.
Model quantifies cyber-attacks' impact on firms and insurers.
problem Impact of cyber-attacks on firms' revenues and insurers' portfolios.
method Stochastic SIR model coupled with granular firm growth model.
result Predicts insurer needs to compensate up to two days of revenue in a 100-day incident.
The paper shows supply chain features improve cyber risk prediction.
problem Predicting cyber risk from supply chain attributes.
method Machine learning, external supply chain features, AUC improvement.
result Supply chain network features improve AUC by 2.3%.
Recent changes to greenhouse gas emission policies are catalyzing the electric vehicle (EV) market making it readily accessible to consumers. While there are challenges that arise with dense deployment of EVs, one of the major future concerns is cyber security threat. In this paper, cyber security threats in the form o…
Paper introduces a new model for cyber insurance pricing.
problem Inaccurate pricing of cyber insurance due to multiple, contagious losses.
method Developed a bivariate compound dynamic contagion process.
result Analytical expressions for the compound process and its moments.
Criminals use malware to disrupt cyber-systems. The number of these malware-vulnerable systems is increasing quickly as common systems, such as vehicles, routers, and lightbulbs, become increasingly interconnected cyber-systems. To address the scale of this problem, analysts divide malware into classes and develop, for…
Recreating cyber-attack alert data with a high level of fidelity is challenging due to the intricate interaction between features, non-homogeneity of alerts, and potential for rare yet critical samples. Generative Adversarial Networks (GANs) have been shown to effectively learn complex data distributions with the inten…
CyBeR-0 optimizes federated learning with Byzantine resilience and reduced communication costs.
problem Byzantine attacks and communication inefficiency in federated learning.
method Transformed robust aggregation for zero-order optimization under client heterogeneity.
result CyBeR-0 achieves stable performance with minimal communication costs and reduced memory usage.
Early detection of cyber-attacks is crucial for a safe and reliable operation of the smart grid. In the literature, outlier detection schemes making sample-by-sample decisions and online detection schemes requiring perfect attack models have been proposed. In this paper, we formulate the online attack/anomaly detection…
This chapter studies emerging cyber-attacks on reinforcement learning (RL) and introduces a quantitative approach to analyze the vulnerabilities of RL. Focusing on adversarial manipulation on the cost signals, we analyze the performance degradation of TD(λ) and Q-learning algorithms under the manipulation. For TD($…
Cybersecurity attacks are growing both in frequency and sophistication over the years. This increasing sophistication and complexity call for more advancement and continuous innovation in defensive strategies. Traditional methods of intrusion detection and deep packet inspection, while still largely used and recommende…