Predictive Taxonomy Analytics (LASSO): Predicting Outcome Types of Cyber Breach

Goh，Jing Rong1,2,3; Wang，Shaun S.2,4; Harel，Yaniv5; Toh，Gabriel6

2023

10.1093/cybsec/tyad015

Journal of Cybersecurity   Impact Factor & Quartile

2057-2085

2057-2093

Cyber breaches are costly for the global economy and extensive efforts have gone into improving the cybersecurity infrastructure. There are numerous types of cyber breaches that vary greatly in terms of cause and impact, resulting in an extensive literature for individual cyber breach type. Our paper seeks to provide a general framework that can be easily applied to analyze different types of cyber breaches. Our framework is inspired by the taxonomy approach in the cybersecurity literature, where it was proposed that an effective set of taxonomy can provide a direction on supporting improved decision-making in cyber risk management and selecting relevant cybersecurity controls. Our paper extends upon the current approach by using this taxonomy to model and predict the associated breach outcomes, given the occurrence of a cyber breach. Specifically, our paper applies least absolute shrinkage and selection operator (LASSO) within a taxonomy framework. Using a proprietary database of known cyber breaches, we show that this analytical tool performs well in out-of-sample predictions and a stable model that generates consistent predictions. For each cyber breach outcome type, we also provide the list of keywords that are useful in predicting the outcome type. We envision researchers, insurers, underwriters, and cybersecurity professionals can use (or expand on) our list of keywords, or use our method to yield their own set of keywords. Practitioners who seek to mitigate their cyber risk may use these keywords as a guide towards the specific attack surfaces that might be most susceptible to the corresponding breach. Our paper lays the groundwork for researchers to better apply the taxonomy approach within cybersecurity research. We also perform regression analysis to identify industries that are most susceptible to various cyber breach events. Our results corroborate with the literature, where some industries are indeed more likely to be impacted by certain types of cyberattacks.

ESCI

English

Others

Social Sciences - Other Topics

Social Sciences, Interdisciplinary

WOS:001046823200001

OXFORD UNIV PRESS

2-s2.0-85168763652

Scopus

1.School of Economics,Singapore Management University,188065,Singapore
2.Risk Lighthouse International,051531,Singapore
3.Accredify,Singapore,339213,Singapore
4.Department of Finance,Southern University of Science and Technology,Shenzhen,518055,China
5.Interdisciplinary Cyber Research Center (ICRC),Tel Aviv University,Tel Aviv,6997801,Israel
6.Cyber Risk Management [CyRiM] Project,Nanyang Business School,Nanyang Technological University,Singapore,639798,Singapore

Goh，Jing Rong,Wang，Shaun S.,Harel，Yaniv,et al. Predictive Taxonomy Analytics (LASSO): Predicting Outcome Types of Cyber Breach[J]. Journal of Cybersecurity,2023,9(1).

Goh，Jing Rong,Wang，Shaun S.,Harel，Yaniv,&Toh，Gabriel.(2023).Predictive Taxonomy Analytics (LASSO): Predicting Outcome Types of Cyber Breach.Journal of Cybersecurity,9(1).

Goh，Jing Rong,et al."Predictive Taxonomy Analytics (LASSO): Predicting Outcome Types of Cyber Breach".Journal of Cybersecurity 9.1(2023).