Multivariate Hawkes process for cyber insurance

Yannick Bessy-Roland (1) , Alexandre Boumezoued (1) , Caroline Hillairet (2)

1 R&D, Milliman, Paris
2 ENSAE Paris - École Nationale de la Statistique et de l'Administration Économique

In this paper, we propose a multivariate Hawkes framework for modelling and predicting cyber-attacks frequency. The inference is based on a public dataset containing features of data-breaches targeting the US industry. As a main output of this paper, we demonstrate the ability of Hawkes models to capture self-excitation and interactions of data-breaches depending on their type and targets. In this setting we detail prediction results providing the full joint distribution of future cyber attacks times of occurrence. In addition we show that a non-instantaneous excitation in the multi-variate Hawkes model, which is not the classical framework of the exponential kernel, better fits with our data. In an insurance framework, this study allows to determine quantiles for number of attacks, useful for an internal model, as well as the frequency component for a data breach guarantee.

Mots clés: Hawkes process; Cyber risk; Data breaches; Clustering; Prediction and uncertainty

Domaines: Statistiques [math.ST]

Yannick Bessy-Roland, Alexandre Boumezoued, Caroline Hillairet. Multivariate Hawkes process for cyber insurance. 2020. ⟨hal-02546343⟩