Multivariate Hawkes process for cyber insurance

Abstract

In this paper, we propose a multivariate Hawkes framework for modelling and predicting cyber attacks frequency. The inference is based on a public data set containing features of data breaches targeting the US industry. As a main output of this paper, we demonstrate the ability of Hawkes models to capture self-excitation and interactions of data breaches depending on their type and targets. In this setting, we detail prediction results providing the full joint distribution of future cyber attacks times of occurrence. In addition, we show that a non-instantaneous excitation in the multivariate Hawkes model, which is not the classical framework of the exponential kernel, better fits with our data. In an insurance framework, this study allows to determine quantiles for number of attacks, useful for an internal model, as well as the frequency component for a data breach guarantee.

Cyber risk and cybersecurity: a systematic review of data availability

“…They also pointed out that a better understanding of data collection and use in cyber insurance would be invaluable for future research and practice. Bessy-Roland et al (2021) come to a similar conclusion. They proposed a multivariate Hawkes framework to model and predict the frequency of cyberattacks.…”

“…These data could be combined with existing portfolio data from cyber insurers and integrated with existing pricing tools and factors to better assess cyber risk valuation. Although most cyber insurers have sparse historical cyber policy and claims data, they remain too small at present for accurate prediction (Bessy-Roland et al 2021). A combination of portfolio data and external datasets would support risk-adjusted pricing for cyber insurance, which would also benefit policyholders.…”

“…These high levels of uncertainty mean that cyber insurers are more inclined to overprice cyber risk cover (Kshetri 2018). Combining external data with insurance portfolio data therefore seems to be essential to improve the evaluation of the risk and thus lead to risk-adjusted pricing (Bessy-Roland et al 2021). This argument is also supported by the fact that some re/insurers reported that they are working to improve their cyber pricing models (e.g.…”

Propagation of cyber incidents in an insurance portfolio: counting processes combined with compartmental epidemiological models

“…The cyber-insurance market is increasingly developing (see for example Camillo (2017)), with important uncertainties on the real value of the guarantees. Recently, efforts have been made to quantify the risk with a traditional frequency/severity approach, as in Eling and Loperfido (2017), Forrest et al (2016), Farkas et al (2019) or Bessy-Roland et al (2020). Apart from the difficulty to evaluate a fast evolving risk with a relative lack of consistent historical data, the systemic potential of a "cyber hurricane" is a major concern.…”

Malliavin-Stein method for the multivariate compound Hawkes process

“…In recent years, the need to model systems with interacting components has been growing, that is how the multivariate Hawkes process emerged. In addition to its self-exciting properties, the multivariate Hawkes process can model mutually-exciting phenomena and it has been used in a wide array of fields such that neuro-science [11], [12], social networks [1], cyber-security [4] and financial econometrics [5].…”