Building up Cyber Resilience by Better Grasping Cyber Risk Via a New Algorithm for Modelling Heavy-Tailed Data

TL;DR

This paper introduces a new algorithm for modeling heavy-tailed data to better understand cyber risks, aiding in cyber resilience and risk management strategies.

Contribution

The paper presents a novel algorithm tailored for asymmetric heavy-tailed data, improving the estimation of full distributions including tails in cyber risk analysis.

Findings

Confirmed the finiteness of the loss expectation for cyber risks

Compared the new model's results with standard EVT models

Proposed a classification of attacks based on tail fatness

Abstract

Cyber security and resilience are major challenges in our modern economies; this is why they are top priorities on the agenda of governments, security and defense forces, management of companies and organizations. Hence, the need of a deep understanding of cyber risks to improve resilience. We propose here an analysis of the database of the cyber complaints filed at the {\it Gendarmerie Nationale}. We perform this analysis with a new algorithm developed for non-negative asymmetric heavy-tailed data, which could become a handy tool in applied fields. This method gives a good estimation of the full distribution including the tail. Our study confirms the finiteness of the loss expectation, necessary condition for insurability. Finally, we draw the consequences of this model for risk management, compare its results to other standard EVT models, and lay the ground for a classification of attacks based on the fatness of the tail.