Cyber Epidemic Models with Dependences

TL;DR

This paper introduces a novel approach to modeling cyber epidemics by incorporating dependencies between attack events using copulas, revealing that ignoring these dependencies leads to overly restrictive or incorrect results.

Contribution

It pioneers the integration of copulas into cyber epidemic models to account for attack event dependences, which were previously neglected.

Findings

Dependences significantly affect epidemic thresholds.

Ignoring dependences can lead to incorrect security assessments.

The model provides bounds for infection probabilities.

Abstract

Studying models of cyber epidemics over arbitrary complex networks can deepen our understanding of cyber security from a whole-system perspective. In this paper, we initiate the investigation of cyber epidemic models that accommodate the {\em dependences} between the cyber attack events. Due to the notorious difficulty in dealing with such dependences, essentially all existing cyber epidemic models have assumed them away. Specifically, we introduce the idea of Copulas into cyber epidemic models for accommodating the dependences between the cyber attack events. We investigate the epidemic equilibrium thresholds as well as the bounds for both equilibrium and non-equilibrium infection probabilities. We further characterize the side-effects of assuming away the due dependences between the cyber attack events, by showing that the results thereof are unnecessarily restrictive or even incorrect.