Vulnerability Webs: Systemic Risk in Software Networks

Cornelius Fritz; Co-Pierre Georg; Angelo Mele; Michael Schweinberger

Home/Archive/arXiv

arXiv · 2402.13375

Vulnerability Webs: Systemic Risk in Software Networks

Cornelius Fritz·Co-Pierre Georg·Angelo Mele·Michael Schweinberger

View original source ↗Read source document ↗Export metadata ↓

Abstract

Software development relies on code reuse to minimize costs, creating vulnerability risks through dependencies with substantial economic impact, as seen in the Crowdstrike and HeartBleed incidents. We analyze 52,897 dependencies across 16,102 Python repositories using a strategic network formation model incorporating observable and unobservable heterogeneity. Through variational approximation of conditional distributions, we demonstrate that dependency creation generates negative externalities. Vulnerability propagation, modeled as a contagion process, shows that popular protection heuristics are ineffective. AI-assisted coding, on the other hand, offers an effective alternative by enabling dependency replacement with in-house code.

Explore related subjects

econ.EM

Keep this discovery

BibTeX RIS

Cornelius Fritz, Co-Pierre Georg, Angelo Mele, Michael Schweinberger. 2024-02-20. Vulnerability Webs: Systemic Risk in Software Networks. https://arxiv.org/abs/2402.13375

Cite the original work for its findings. Save a collection to share your selection of sources.

KEEP EXPLORING

Related papers

arXiv2026

Identification in Linear Quantile Panel Models

This paper studies identification in linear quantile panel models with unrestricted individual heterogeneity when the number of time periods is fixed and small. We impose strict exogeneity, whereby the conditional quantile restriction holds given the individual's complete regressor history and latent individual effect, but otherwise allow the disturbances to be arbitrarily dependent over time.

econ.EM↗

arXiv2026

Experimental Design for Policy Choice

We show how to optimally design experiments when the resulting data will be used to choose a welfare-maximizing policy subject to constraints. A decision maker seeks to maximize Bayes expected welfare by choosing a policy whose effects depend on an unknown finite-dimensional parameter. The decision maker has access to a first wave of experimental data with a fixed design but may choose the design of a second wave that will be collected before choosing the policy. The resulting experimental design--policy choice problem is a very high-dimensional dynamic program that is generally intractable in finite samples. We propose a tractable approximation based on the limit experiment and show it is asymptotically optimal using a new asymptotic representation theorem for adaptive experiments with continuous treatments. We apply the method to a conditional cash transfer experiment and demonstrate the potential for large gains from tailoring the experiment to the policy choice.

econ.EM↗

arXiv2026

Designing Spatial Treatments

Spatial treatments are interventions assigned to locations potentially distinct from those of the responding units. We study their optimal design under a general model in which a unit's response diminishes with distance to a treated site. Our estimand of interest is an ``uncontaminated'' effect equal to the average impact of a single intervention site over all hypothetical sites. We propose a novel design based on a Mat\'{e}rn point process which separates treatments by a distance of at least $r$. A larger choice of $r$ reduces bias by separating interventions but increases variance by reducing their numerosity. We choose $r$ to maximize the rate of convergence of a Horvitz-Thompson estimator and prove that this is minimax rate-optimal. We provide weak conditions under which the estimator is asymptotically normal and propose a variance estimator.

econ.EM↗