Frequency and severity estimation of cyber attacks using spatial clustering analysis

In this paper, a cluster-based method is developed to investigate the risk of cyber attacks in the continental United States. The proposed analysis considers geographical information of cyber incidents for clustering. By clustering state-based observations, the frequency and severity of cyber losses demonstrate a simplified structure: independent structure between inter-arrival time and size of cyber breaches. The independence between frequency and severity is significant in the state level instead of national level. Within clustered subcategories, the inter-arrival time is modelled by the family of Autoregressive Conditional Duration models (ACD) and log-transformed size of breach is described by an ARMA-GARCH model. Under multiple statistical tests, it is shown that the cluster-based models have better fitting and are more robust than the aggregate model, where all incidents are considered together. Finally, a numerical analysis is presented to illustrate the performance of the approach. Accordingly, the prediction of total losses are compared with other dependent models. The differences of key cyber risk features among clusters are illustrated.