Models and Measures for Correlation in CyberInsurance网络保险中的相关模型及相关措施.pptVIP

Models and Measures for Correlation in Cyber-Insurance Cyber-Insurance in a Nutshell Risk sharing avoid extreme losses at manageable expenses Security metric premiums differentiate good and bad risks Incentive function to develop and deploy sound security technology Market for cyber-insurance immature losses from cyber incidents in the range of $ 200 bn global cyber-insurance market $ 2 bn -Majuca et al., 2006 (Danger of) High correlation of cyber-risks due to homogeneous technology -Geer et al., 2003 Decision to Offer Insurance Cost of offering insurance: C = E(L) + A + i · c Where, E(L) is the expected loss amount, L being a random variable A is the sum of all administrative costs, assumed negligible c is the safety capital required to settle all claims if the realization of L turns out to the ?-worst case (? is the probability of ruin for the insurer) i is the interest rate to be paid for the safety capital c. The rate should reflect the risk associated with the business in general and the choice of ? in particular Decision to Seek Insurance Decision to Seek Insurance Classes of Cyber-Risks Cyber-Insurance Scenario Cyber-Insurance Scenario Two-Step Risk Arrival Modeling Two-Step Risk Arrival Equilibrium Conditions How strong is cyber-risk correlation in reality? Standard Response lack of actuarial data on loss amounts Our Approach if correlation of losses is caused by attack correlation, then we can try to estimate correlation from sensor data measuring attack activity Data Source Honeypots decoy for hackers and automated attacks useful monitoring tool for malicious activity - L honeynet project (Eurecom, France) 35 sensors emulating 3 TCP/IP stacks each deployed in 25 countries over five continents -Pouget et al., 2004, Pouget/Dancier/Pham, 2005 Observations Location Port Sequence Time (days) Hits Global Attack Activity Correlation Measure Do attacks coincide at different sensor locations? Fit stochastic models