Statistical models for the number of successful cyber intrusions

Abstract

We propose several generalized linear models (GLMs) to predict the number of successful cyber intrusions (or "intrusions") into an organization's computer network, where the rate at which intrusions occur is a function of the following observable characteristics of the organization: (i) domain name server (DNS) traffic classified by their top-level domains (TLDs); (ii) the number of network security policy violations; and (iii) a set of predictors that we collectively call "cyber footprint" that is comprised of the number of hosts on the organization's network, the organization's similarity to educational institution behavior (SEIB), and its number of records on scholar.google.com (ROSG). In addition, we evaluate the number of intrusions to determine whether these events follow a Poisson or negative binomial (NB) probability distribution. We reveal that the NB GLM provides the best fit model for the observed count data, number of intrusions per organization, because the NB model allows the variance of the count data to exceed the mean. We also show that there are restricted and simpler NB regression models that omit selected predictors and improve the goodness-of-fit of the NB GLM for the observed data. With our model simulations, we identify certain TLDs in the DNS traffic as having significant impact on the number of intrusions. In addition, we use the models and regression results to conclude that the number of network security policy violations are consistently predictive of the number of intrusions. KeywordsDomain name server (DNS) traffic, cyber risk, generalized linear models (GLM), negative binomial (NB) model, principal component analysis (PCA), managed security service provider (MSSP), regression

On metrics and prioritization of investments in hardware security

“…For example, estimating probability distributions that model the frequency of cyber-attacks is a difficult and ongoing area of research. 56,57 One approach is to utilize the triangular distribution 58 which has the convenient property that it is simple to elicit -generally an expert is asked to provide a maximum, minimum, and most-likely value for some variable of interest. 59 Empirical data are typically not available for certain parameters such as ARO and MR, and therefore experts must be consulted to estimate them.…”

A Multivariate Model to Quantify and Mitigate Cybersecurity Risk

“…Instead, we will use a counting process that has a Negative Binomial distribution at time t. The Negative Binomial distribution is often used for fitting to count data, and is well known in operational risk. The application of the negative binomial distribution to real world data is done in a cybersecurity context in Leslie et al (2018).…”

Fundamental Concepts of Cyber Resilience: Introduction and Overview

“…The key components of cyber risk are relatively well understood. The likelihood of a successful cyber attack can be empirically measured and estimated apriori with a degree of accuracy from known characteristics of a system or network (Leslie et al 2017), (Gil et al 2014). The cyber impact on a system is a topic in which assessment methods are being developed (Kott et al 2017).…”