Orateur
Description
“Modeling cyber attack frequency and spread is crucial for the insurance industry to evaluate risk and adapt mitigation strategies. Hawkes processes have been widely adopted in the cyber literature for their ability to model self-exciting behavior of cyber attacks. However, such a model, in its standard linear form, may seem limited to account for external factors driving the dynamics of cyber attacks, such as vulnerabilities which, once discovered, can trigger cascading attacks. We therefore consider a larger class of Hawkes processes by adding external excitation to capture vulnerabilities discoveries and stochastic marks to account for the magnitude and variability of their impacts on the contagion dynamics. We develop and compare parametric estimation methods for the externally excited marked Hawkes process for cyber attack modeling without resorting to stationarity assumptions. We tackle the likelihood estimation and expectation calculation for both exponential and Erlang kernels, the latter being key to account for delays in the contagion mechanism. We test estimation methods, comparing deterministic and Monte Carlo likelihoods. Simulations show that the deterministic method performs well in low variance settings, while the Monte Carlo one excels in high variance, emphasizing the need to choose suitable calibration techniques based on the underlying contagion variability. We compare different methods to tackle the inference problem based on public datasets containing features of cyber attacks found in the Hackmageddon database and cyber vulnerabilities from the Known Exploited Vulnerability database and the National Vulnerability Dataset. By refining the external excitation database selection, the degree of endogeneity of the model is nearly halved.”
