arXiv subjects

Maochao Xu

Publications and source records attributed to Maochao Xu.

16 recordsLinked to original sources

arXiv2026

Multi-Trigger Crypto CAT Bonds with On-Chain Settlement: Valuation and Optimal Design

Cryptocurrencies have experienced repeated large-scale losses from protocol exploits and exchange breaches, exposing insurers and investors to severe operational risks. This paper develops an equilibrium pricing framework for catastrophe bonds tailored to the cryptocurrency ecosystem. We introduce a double-trigger structure that jointly captures short-term catastrophic shocks and longer-term systemic deterioration. To model the multi-risk environment, we incorporate dual dependence, combining dependence across triggers with multivariate dependence among financial risk factors through vine copulas. Beyond expected prices, we characterize the full distribution of discounted cash flows and return rates, enabling risk-sensitive metrics such as Value-at-Risk and Tail Value-at-Risk. Furthermore, we propose an on-chain settlement architecture where calibrated payout functions are embedded directly into smart contracts. This design eliminates basis risk associated with settlement delays and minimizes the agency costs inherent in traditional intermediation. Our results demonstrate that multi-trigger crypto CAT bonds offer a statistically robust and economically efficient vehicle for transferring systemic digital asset risks to capital markets.

stat.AP↗

arXiv2024

A Framework for Digital Asset Risks with Insurance Applications

The remarkable growth of digital assets, starting from the inception of Bitcoin in 2009 into a 1 trillion market in 2024, underscores the momentum behind disruptive technologies and the global appetite for digital assets. This paper develops a framework to enhance actuaries' understanding of the cyber risks associated with the developing digital asset ecosystem, as well as their measurement methods in the context of digital asset insurance. By integrating actuarial perspectives, we aim to enhance understanding and modeling of cyber risks at both the micro and systemic levels. The qualitative examination sheds light on blockchain technology and its associated risks, while our quantitative framework offers a rigorous approach to modeling cyber risks in digital asset insurance portfolios. This multifaceted approach serves three primary objectives: i) offer a clear and accessible education on the evolving digital asset ecosystem and the diverse spectrum of cyber risks it entails; ii) develop a scientifically rigorous framework for quantifying cyber risks in the digital asset ecosystem; iii) provide practical applications, including pricing strategies and tail risk management. Particularly, we develop frequency-severity models based on real loss data for pricing cyber risks in digit assets and utilize Monte Carlo simulation to estimate the tail risks, offering practical insights for risk management strategies. As digital assets continue to reshape finance, our work serves as a foundational step towards safeguarding the integrity and stability of this rapidly evolving landscape.

stat.AP↗

arXiv2024

Smart Home Cyber Insurance Pricing

Our homes are increasingly employing various kinds of Internet of Things (IoT) devices, leading to the notion of smart homes. While this trend brings convenience to our daily life, it also introduces cyber risks. To mitigate such risks, the demand for smart home cyber insurance has been growing rapidly. However, there are no studies on analyzing the competency of smart home cyber insurance policies offered by cyber insurance vendors (i.e., insurers), where `competency' means the insurer is profitable and smart home owners are not overly charged with premiums and/or deductibles. In this paper, we propose a novel framework for pricing smart home cyber insurance, which can be adopted by insurers in practice. Our case studies show, among other things, that insurers are over charging smart home owners in terms of premiums and deductibles.

cs.CE↗

arXiv2024

Bayesian Nowcasting Data Breach IBNR Incidents

The reporting delay in data breach incidents poses a formidable challenge for Incurred But Not Reported (IBNR) studies, complicating reserve estimation for actuarial professionals. This work presents a novel Bayesian nowcasting model designed to accurately model and predict the number of IBNR data breach incidents. Leveraging a Bayesian modeling framework, the model integrates time and heterogeneous effects to enhance predictive accuracy. Synthetic and empirical studies demonstrate the superior performance of the proposed model, highlighting its efficacy in addressing the complexities of IBNR estimation. Furthermore, we examine reserve estimation for IBNR incidents using the proposed model, shedding light on its implications for actuarial practice.

stat.AP↗

arXiv2022

Statistical Modeling of Data Breach Risks: Time to Identification and Notification

It is very challenging to predict the cost of a cyber incident owing to the complex nature of cyber risk. However, it is inevitable for insurance companies who offer cyber insurance policies. The time to identifying an incident and the time to noticing the affected individuals are two important components in determining the cost of a cyber incident. In this work, we initialize the study on those two metrics via statistical modeling approaches. Particularly, we propose a novel approach to imputing the missing data, and further develop a dependence model to capture the complex pattern exhibited by those two metrics. The empirical study shows that the proposed approach has a satisfactory predictive performance and is superior to other commonly used models.

stat.AP↗

arXiv2021

Modeling Multivariate Cyber Risks: Deep Learning Dating Extreme Value Theory

Modeling cyber risks has been an important but challenging task in the domain of cyber security. It is mainly because of the high dimensionality and heavy tails of risk patterns. Those obstacles have hindered the development of statistical modeling of the multivariate cyber risks. In this work, we propose a novel approach for modeling the multivariate cyber risks which relies on the deep learning and extreme value theory. The proposed model not only enjoys the high accurate point predictions via deep learning but also can provide the satisfactory high quantile prediction via extreme value theory. The simulation study shows that the proposed model can model the multivariate cyber risks very well and provide satisfactory prediction performances. The empirical evidence based on real honeypot attack data also shows that the proposed model has very satisfactory prediction performances.

stat.AP↗

arXiv2020

Should the Ransomware be Paid?

Ransomware has emerged as one of the most concerned cyber risks in recent years, which has caused millions of dollars monetary loss over the world. It typically demands a certain amount of ransom payment within a limited timeframe to decrypt the encrypted victim's files. This paper explores whether the ransomware should be paid in a novel game-theoretic model from the perspective of Bayesian game. In particular, the new model analyzes the ransom payment strategies within the framework of incomplete information for both hacker and victim. Our results show that there exist pure and randomized Bayesian Nash equilibria under some mild conditions for the hacker and victim. The sufficient conditions that when the ransom should be paid are presented when an organization is compromised by the ransomware attack. We further study how the costs and probabilities of cracking or recovering affect the expected payoffs of the hacker and the victim in the equilibria. In particular, it is found that the backup option for computer files is not always beneficial, which actually depends on the related cost. Moreover, it is discovered that fake ransomware may be more than expected because of the potential high payoffs. Numerical examples are also presented for illustration.

econ.GN↗

arXiv2020

Joint Cyber Risk Assessment of Network Systems with Heterogeneous Components

Cyber risks are the most common risks encountered by a modern network system. However, it is significantly difficult to assess the joint cyber risk owing to the network topology, risk propagation, and heterogeneities of components. In this paper, we propose a novel backward elimination approach for computing the joint cyber risk encountered by different types of components in a network system; moreover, explicit formulas are also presented. Certain specific network topologies including complete, star, and complete bi-partite topologies are studied. The effects of propagation depth and compromise probabilities on the joint cyber risk are analyzed using stochastic comparisons. The variances and correlations of cyber risks are examined by a simulation experiment. It was discovered that both variances and correlations change rapidly when the propagation depth increases from its initial value. Further, numerical examples are also presented.

cs.SI↗

arXiv2020

Pricing cyber insurance for a large-scale network

Facing the lack of cyber insurance loss data, we propose an innovative approach for pricing cyber insurance for a large-scale network based on synthetic data. The synthetic data is generated by the proposed risk spreading and recovering algorithm that allows infection and recovery events to occur sequentially, and allows dependence of random waiting time to infection for different nodes. The scale-free network framework is adopted to account for the topology uncertainty of the random large-scale network. Extensive simulation studies are conducted to understand the risk spreading and recovering mechanism, and to uncover the most important underwriting risk factors. A case study is also presented to demonstrate that the proposed approach and algorithm can be adapted accordingly to provide reference for cyber insurance pricing.

cs.SI↗

arXiv2016

An Extended Stochastic Model for Quantitative Security Analysis of Networked Systems

Quantitative security analysis of networked computer systems is one of the decades-long open problems in computer security. Recently, a promising approach was proposed in \cite{XuTDSC11}, which however made some strong assumptions including the exponential distribution of, and the independence between, the relevant random variables. In this paper, we substantially weaken these assumptions while offering, in addition to the same types of analytical results as in \cite{XuTDSC11}, methods for obtaining the desired security quantities in practice. Moreover, we investigate the problem from a higher-level abstraction, which also leads to both analytical results and practical methods for obtaining the desired security quantities. These would represent a significant step toward ultimately solving the problem of quantitative security analysis of networked computer systems.

cs.CR↗

arXiv2016

A New Approach to Modeling and Analyzing Security of Networked Systems

Modeling and analyzing security of networked systems is an important problem in the emerging Science of Security and has been under active investigation. In this paper, we propose a new approach towards tackling the problem. Our approach is inspired by the {\em shock model} and {\em random environment} techniques in the Theory of Reliability, while accommodating security ingredients. To the best of our knowledge, our model is the first that can accommodate a certain degree of {\em adaptiveness of attacks}, which substantially weakens the often-made independence and exponential attack inter-arrival time assumptions. The approach leads to a stochastic process model with two security metrics, and we attain some analytic results in terms of the security metrics.

cs.CR↗

arXiv2016

Cyber Epidemic Models with Dependences

Studying models of cyber epidemics over arbitrary complex networks can deepen our understanding of cyber security from a whole-system perspective. In this paper, we initiate the investigation of cyber epidemic models that accommodate the {\em dependences} between the cyber attack events. Due to the notorious difficulty in dealing with such dependences, essentially all existing cyber epidemic models have assumed them away. Specifically, we introduce the idea of Copulas into cyber epidemic models for accommodating the dependences between the cyber attack events. We investigate the epidemic equilibrium thresholds as well as the bounds for both equilibrium and non-equilibrium infection probabilities. We further characterize the side-effects of assuming away the due dependences between the cyber attack events, by showing that the results thereof are unnecessarily restrictive or even incorrect.

cs.CR↗

arXiv2016

Predicting Cyber Attack Rates with Extreme Values

It is important to understand to what extent, and in what perspectives, cyber attacks can be predicted. Despite its evident importance, this problem was not investigated until very recently, when we proposed using the innovative methodology of {\em gray-box prediction}. This methodology advocates the use of gray-box models, which accommodate the statistical properties/phenomena exhibited by the data. Specifically, we showed that gray-box models that accommodate the Long-Range Dependence (LRD) phenomenon can predict the attack rate (i.e., the number of attacks per unit time) 1-hour ahead-of-time with an accuracy of 70.2-82.1\%. To the best of our knowledge, this is the first result showing the feasibility of prediction in this domain. We observe that the prediction errors are partly caused by the models' incapability in predicting the large attack rates, which are called {\em extreme values} in statistics. This motivates us to analyze the {\em extreme-value phenomenon}, by using two complementary approaches: the Extreme Value Theory (EVT) and the Time Series Theory (TST). In this paper, we show that EVT can offer long-term predictions (e.g., 24-hour ahead-of-time), while gray-box TST models can predict attack rates 1-hour ahead-of-time with an accuracy of 86.0-87.9\%. We explore connections between the two approaches, and point out future research directions. Although our prediction study is based on specific cyber attack data, our methodology can be equally applied to analyze any cyber attack data of its kind.

cs.CR↗

arXiv2016

Characterizing Honeypot-Captured Cyber Attacks: Statistical Framework and Case Study

Rigorously characterizing the statistical properties of cyber attacks is an important problem. In this paper, we propose the {\em first} statistical framework for rigorously analyzing honeypot-captured cyber attack data. The framework is built on the novel concept of {\em stochastic cyber attack process}, a new kind of mathematical objects for describing cyber attacks. To demonstrate use of the framework, we apply it to analyze a low-interaction honeypot dataset, while noting that the framework can be equally applied to analyze high-interaction honeypot data that contains richer information about the attacks. The case study finds, for the first time, that Long-Range Dependence (LRD) is exhibited by honeypot-captured cyber attacks. The case study confirms that by exploiting the statistical properties (LRD in this case), it is feasible to predict cyber attacks (at least in terms of attack rate) with good accuracy. This kind of prediction capability would provide sufficient early-warning time for defenders to adjust their defense configurations or resource allocations. The idea of "gray-box" (rather than "black-box") prediction is central to the utility of the statistical framework, and represents a significant step towards ultimately understanding (the degree of) the {\em predictability} of cyber attacks.

cs.CR↗

arXiv2016

A Characterization of Cybersecurity Posture from Network Telescope Data

Data-driven understanding of cybersecurity posture is an important problem that has not been adequately explored. In this paper, we analyze some real data collected by CAIDA's network telescope during the month of March 2013. We propose to formalize the concept of cybersecurity posture from the perspectives of three kinds of time series: the number of victims (i.e., telescope IP addresses that are attacked), the number of attackers that are observed by the telescope, and the number of attacks that are observed by the telescope. Characterizing cybersecurity posture therefore becomes investigating the phenomena and statistical properties exhibited by these time series, and explaining their cybersecurity meanings. For example, we propose the concept of {\em sweep-time}, and show that sweep-time should be modeled by stochastic process, rather than random variable. We report that the number of attackers (and attacks) from a certain country dominates the total number of attackers (and attacks) that are observed by the telescope. We also show that substantially smaller network telescopes might not be as useful as a large telescope.

cs.CR↗

arXiv2013

Some inequalities of linear combinations of independent random variables: II

Linear combinations of independent random variables have been extensively studied in the literature. However, most of the work is based on some specific distribution assumptions. In this paper, a companion of (J. Appl. Probab. 48 (2011) 1179-1188), we unify the study of linear combinations of independent nonnegative random variables under the general setup by using some monotone transforms. The results are further generalized to the case of independent but not necessarily identically distributed nonnegative random variables. The main results complement and generalize the results in the literature including (In Studies in Econometrics, Time Series, and Multivariate Statistics (1983) 465-489 Academic Press; Sankhyā Ser. A 60 (1998) 171-175; Sankhyā Ser. A 63 (2001) 128-132; J. Statist. Plann. Inference 92 (2001) 1-5; Bernoulli 17 (2011) 1044-1053).

math.ST↗