The complexity of estimating systematic risk in networks

Benjamin Johnson, Aron Laszka, Jens Grossklags

Research output: Chapter in Book/Report/Conference proceedingConference contribution

9 Scopus citations

Abstract

This risk of catastrophe from an attack is a consequence of a network's structure formed by the connected individuals, businesses and computer systems. Understanding the likelihood of extreme events, or, more generally, the probability distribution of the number of compromised nodes is an essential requirement to provide risk-mitigation or cyber-insurance. However, previous network security research has not considered features of these distributions beyond their first central moments, while previous cyber-insurance research has not considered the effect of topologies on the supply side. We provide a mathematical basis for bridging this gap: we study the complexity of computing these loss-number distributions, both generally and for special cases of common real-world networks. In the case of scale-free networks, we demonstrate that expected loss alone cannot determine the riskiness of a network, and that this riskiness cannot be naively estimated from smaller samples, which highlights the lack/importance of topological data in security incident reporting.

Original languageEnglish (US)
Title of host publicationProceedings - 2014 IEEE 27th Computer Security Foundations Symposium, CSF 2014
PublisherIEEE Computer Society
Pages325-336
Number of pages12
ISBN (Electronic)9781479942909
DOIs
StatePublished - Nov 13 2014
Event27th IEEE Computer Security Foundations Symposium, CSF 2014 - Vienna, Austria
Duration: Jul 19 2014Jul 22 2014

Publication series

NameProceedings of the Computer Security Foundations Workshop
Volume2014-January
ISSN (Print)1063-6900

Other

Other27th IEEE Computer Security Foundations Symposium, CSF 2014
CountryAustria
CityVienna
Period7/19/147/22/14

All Science Journal Classification (ASJC) codes

  • Software

Fingerprint Dive into the research topics of 'The complexity of estimating systematic risk in networks'. Together they form a unique fingerprint.

  • Cite this

    Johnson, B., Laszka, A., & Grossklags, J. (2014). The complexity of estimating systematic risk in networks. In Proceedings - 2014 IEEE 27th Computer Security Foundations Symposium, CSF 2014 (pp. 325-336). [6957120] (Proceedings of the Computer Security Foundations Workshop; Vol. 2014-January). IEEE Computer Society. https://doi.org/10.1109/CSF.2014.30