{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,9,29]],"date-time":"2025-09-29T08:15:44Z","timestamp":1759133744195,"version":"3.41.0"},"reference-count":38,"publisher":"Association for Computing Machinery (ACM)","issue":"3","license":[{"start":{"date-parts":[[2019,9,30]],"date-time":"2019-09-30T00:00:00Z","timestamp":1569801600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Trans. Manage. Inf. Syst."],"published-print":{"date-parts":[[2019,9,30]]},"abstract":"<jats:p>\n            In this article, we comment on the drawbacks of the existing AI-based Bayesian network (BN) cyber-vulnerability analysis (C-VA) model proposed in Mukhopadhyay et al. (2013) to assess cyber-risk in IT firms, where this quantity is usually a joint distribution of multiple risk (random) variables (e.g., quality of antivirus, frequency of monitoring, etc.) coming from heterogeneous distribution families. As a major modeling drawback, Mukhopadhyay et al. (2013) assume that any pair of random variables in the BN are\n            <jats:italic>linearly<\/jats:italic>\n            correlated with each other. This simplistic assumption might not always hold true for general IT organizational environments. Thus, the use of the C-VA model in general will result in loose estimates of correlated IT risk and will subsequently affect cyber-insurance companies in framing profitable coverage policies for IT organizations. To this end, we propose methods to (1) find a closed-form expression for the maximal correlation arising between pairs of discrete random variables, whose value finds importance in getting robust estimates of copula-induced computations of organizational cyber-risk, and (2) arrive at a computationally effective mechanism to compute nonlinear correlations among pairs of discrete random variables in the correlation matrix of the CBBN model (Mukhopadhyay et al. 2013). We also prove that an empirical computation of MC using our method converges rapidly, that is, exponentially fast, to the true correlation value in the number of samples. Our proposed method contributes to a tighter estimate of IT cyber-risk under environments of low-risk data availability and will enable insurers to better assess organizational risks and subsequently underwrite profitable cyber-insurance policies.\n          <\/jats:p>","DOI":"10.1145\/3351158","type":"journal-article","created":{"date-parts":[[2019,10,10]],"date-time":"2019-10-10T13:13:05Z","timestamp":1570713185000},"page":"1-18","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":11,"title":["On Robust Estimates of Correlated Risk in Cyber-Insured IT Firms"],"prefix":"10.1145","volume":"10","author":[{"given":"Ranjan","family":"Pal","sequence":"first","affiliation":[{"name":"University of Cambridge, UK"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Leana","family":"Golubchik","sequence":"additional","affiliation":[{"name":"University of Southern California, Los Angeles, CA, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Konstantions","family":"Psounis","sequence":"additional","affiliation":[{"name":"University of Southern California, Los Angeles, CA, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Tathagata","family":"Bandyopadhyay","sequence":"additional","affiliation":[{"name":"Indian Institute of Management Ahmedabad, India"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2019,10,10]]},"reference":[{"key":"e_1_2_1_1_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.insmatheco.2007.02.001"},{"key":"e_1_2_1_2_1","doi-asserted-by":"publisher","DOI":"10.1214\/aos\/1031689016"},{"key":"e_1_2_1_3_1","volume-title":"Workshop of Economics of Information Security (WEiS\u201906)","author":"Bohme Rainer","year":"2006","unstructured":"Rainer Bohme and Gaurav Kataria . 2006 . Models and measures for correlation in cyber-insurance . In Workshop of Economics of Information Security (WEiS\u201906) . Rainer Bohme and Gaurav Kataria. 2006. Models and measures for correlation in cyber-insurance. In Workshop of Economics of Information Security (WEiS\u201906)."},{"key":"e_1_2_1_4_1","volume-title":"Workshop of Economics of Information Security (WEiS\u201910)","author":"Bohme Rainer","year":"2010","unstructured":"Rainer Bohme and Galina Schwartz . 2010 . Modeling cyber-insurance: Towards a unifying framework . In Workshop of Economics of Information Security (WEiS\u201910) . Rainer Bohme and Galina Schwartz. 2010. Modeling cyber-insurance: Towards a unifying framework. In Workshop of Economics of Information Security (WEiS\u201910)."},{"key":"e_1_2_1_5_1","doi-asserted-by":"publisher","DOI":"10.1080\/01621459.1985.10478157"},{"key":"e_1_2_1_6_1","doi-asserted-by":"publisher","DOI":"10.1080\/10864415.2004.11044320"},{"key":"e_1_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.1287\/mnsc.45.2.208"},{"key":"e_1_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.1287\/mksc.1090.0491"},{"key":"e_1_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.1214\/aos\/1176346255"},{"key":"e_1_2_1_10_1","doi-asserted-by":"publisher","DOI":"10.1109\/TNSE.2017.2716966"},{"key":"e_1_2_1_11_1","unstructured":"Organisation for Economic Co-Operation and Development. 2017. Enhancing the Role of Insurance in Cyber Risk Management. OECD. Retrieved from https:\/\/books.google.fi\/books?id&equals;R-CctAEACAAJ.  Organisation for Economic Co-Operation and Development. 2017. Enhancing the Role of Insurance in Cyber Risk Management. OECD. Retrieved from https:\/\/books.google.fi\/books?id&equals;R-CctAEACAAJ."},{"volume-title":"Tabu search? In Handbook of Combinatorial Optimization","author":"Glover Fred","key":"e_1_2_1_12_1","unstructured":"Fred Glover and Manuel Laguna . 2013. Tabu search? In Handbook of Combinatorial Optimization . Springer , 3261--3362. Fred Glover and Manuel Laguna. 2013. Tabu search? In Handbook of Combinatorial Optimization. Springer, 3261--3362."},{"key":"e_1_2_1_13_1","first-page":"26","article-title":"Return on information security investments: Myths vs. realities","volume":"84","author":"Gordon Lawrence A.","year":"2002","unstructured":"Lawrence A. Gordon and Martin P. Loeb . 2002 . Return on information security investments: Myths vs. realities . Strategic Finance 84 , 5 (2002), 26 -- 31 . Lawrence A. Gordon and Martin P. Loeb. 2002. Return on information security investments: Myths vs. realities. Strategic Finance 84, 5 (2002), 26--31.","journal-title":"Strategic Finance"},{"key":"e_1_2_1_14_1","unstructured":"Siobhan Gorman. 2012. Alert on hacker power play: US official signals growing concern over anonymous group?s capabilities. Wall Street Journal.  Siobhan Gorman. 2012. Alert on hacker power play: US official signals growing concern over anonymous group?s capabilities. Wall Street Journal."},{"key":"e_1_2_1_15_1","first-page":"7","article-title":"Copula based actuarial model for pricing cyber-insurance policies","volume":"2","author":"Herath Hemanta S. B.","year":"2011","unstructured":"Hemanta S. B. Herath and Tejaswini Herath . 2011 . Copula based actuarial model for pricing cyber-insurance policies . Insurance Markets and Companies: Analyses and Actuarial Computations 2 (2011), 7 \u2013 20 . Hemanta S. B. Herath and Tejaswini Herath. 2011. Copula based actuarial model for pricing cyber-insurance policies. Insurance Markets and Companies: Analyses and Actuarial Computations 2 (2011), 7\u201320.","journal-title":"Insurance Markets and Companies: Analyses and Actuarial Computations"},{"key":"e_1_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.1017\/S0305004100013517"},{"key":"e_1_2_1_17_1","volume-title":"Johnson","author":"Horn Roger A.","year":"2012","unstructured":"Roger A. Horn and Charles R . Johnson . 2012 . Matrix Analysis. Cambridge University Press . Roger A. Horn and Charles R. Johnson. 2012. Matrix Analysis. Cambridge University Press."},{"key":"e_1_2_1_19_1","unstructured":"Jay Kesan Ruperto Majuca and William Yurcik. 2005. Cyberinsurance as a market-based solution to the problem of cybersecurity: A case study. In WEIS.  Jay Kesan Ruperto Majuca and William Yurcik. 2005. Cyberinsurance as a market-based solution to the problem of cybersecurity: A case study. In WEIS."},{"key":"e_1_2_1_20_1","unstructured":"Sergey Kirshner. 2008. Learning with tree-averaged densities and distributions. In Advances in Neural Information Processing Systems. 761--768.  Sergey Kirshner. 2008. Learning with tree-averaged densities and distributions. In Advances in Neural Information Processing Systems. 761--768."},{"volume-title":"Probabilistic Graphical Models: Principles and Techniques","author":"Koller Daphne","key":"e_1_2_1_21_1","unstructured":"Daphne Koller , Nir Friedman , and Francis Bach . 2009. Probabilistic Graphical Models: Principles and Techniques . MIT Press . Daphne Koller, Nir Friedman, and Francis Bach. 2009. Probabilistic Graphical Models: Principles and Techniques. MIT Press."},{"key":"e_1_2_1_22_1","doi-asserted-by":"publisher","DOI":"10.1109\/INFCOM.2009.5062066"},{"volume-title":"Proceedings of the 27th International Conference on International Conference on Machine Learning (ICML\u201910)","author":"Lin Frank","key":"e_1_2_1_23_1","unstructured":"Frank Lin and William W. Cohen . 2010. Power iteration clustering . In Proceedings of the 27th International Conference on International Conference on Machine Learning (ICML\u201910) . Omnipress, 655--662. Retrieved from http:\/\/dl.acm.org\/citation.cfm?id&equals;3104322.3104406 Frank Lin and William W. Cohen. 2010. Power iteration clustering. In Proceedings of the 27th International Conference on International Conference on Machine Learning (ICML\u201910). Omnipress, 655--662. Retrieved from http:\/\/dl.acm.org\/citation.cfm?id&equals;3104322.3104406"},{"key":"e_1_2_1_24_1","unstructured":"Yang Liu Armin Sarabi Jing Zhang Parinaz Naghizadeh Manish Karir Michael Bailey and Mingyan Liu. 2015. Cloudy with a chance of breach: Forecasting cyber security incidents. In USENIX Security. 1009--1024.  Yang Liu Armin Sarabi Jing Zhang Parinaz Naghizadeh Manish Karir Michael Bailey and Mingyan Liu. 2015. Cloudy with a chance of breach: Forecasting cyber security incidents. In USENIX Security. 1009--1024."},{"key":"e_1_2_1_25_1","doi-asserted-by":"publisher","DOI":"10.1093\/qmath\/11.1.50"},{"key":"e_1_2_1_26_1","volume-title":"Cyber-risk decision models: To insure IT or not?Decision Support Systems 56","author":"Mukhopadhyay Amitabha","year":"2013","unstructured":"Amitabha Mukhopadhyay , Samir Chatterjee , Debasis Saha , Ambuja Mahanti , and Samir. K. Sadhukan . 2013. Cyber-risk decision models: To insure IT or not?Decision Support Systems 56 ( 2013 ), 11\u201326. Amitabha Mukhopadhyay, Samir Chatterjee, Debasis Saha, Ambuja Mahanti, and Samir. K. Sadhukan. 2013. Cyber-risk decision models: To insure IT or not?Decision Support Systems 56 (2013), 11\u201326."},{"key":"e_1_2_1_27_1","unstructured":"Hulisi Ogut Nirup Menon and Srinivasan Raghunathan. 2005. Cyber insurance and IT security investment. In WEIS.  Hulisi Ogut Nirup Menon and Srinivasan Raghunathan. 2005. Cyber insurance and IT security investment. In WEIS."},{"key":"e_1_2_1_28_1","doi-asserted-by":"publisher","DOI":"10.1111\/j.1539-6924.2010.01478.x"},{"key":"e_1_2_1_29_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICDCS.2010.79"},{"key":"e_1_2_1_30_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-25280-8_12"},{"key":"e_1_2_1_31_1","doi-asserted-by":"publisher","DOI":"10.1109\/INFOCOM.2014.6847944"},{"key":"e_1_2_1_32_1","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2017.2684801"},{"key":"e_1_2_1_33_1","doi-asserted-by":"publisher","DOI":"10.1145\/3273996.3273999"},{"key":"e_1_2_1_34_1","doi-asserted-by":"publisher","DOI":"10.1214\/aoms\/1177704472"},{"key":"e_1_2_1_35_1","doi-asserted-by":"publisher","DOI":"10.1093\/cybsec\/tyw004"},{"key":"e_1_2_1_36_1","doi-asserted-by":"publisher","DOI":"10.1080\/14697680902821733"},{"key":"e_1_2_1_37_1","doi-asserted-by":"publisher","DOI":"10.1214\/aos\/1176344136"},{"key":"e_1_2_1_38_1","doi-asserted-by":"publisher","DOI":"10.1137\/080744888"},{"key":"e_1_2_1_39_1","doi-asserted-by":"publisher","DOI":"10.1137\/0128010"}],"container-title":["ACM Transactions on Management Information Systems"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3351158","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3351158","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T23:13:40Z","timestamp":1750202020000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3351158"}},"subtitle":["A First Look at Optimal AI-Based Estimates under \u201cSmall\u201d Data"],"short-title":[],"issued":{"date-parts":[[2019,9,30]]},"references-count":38,"journal-issue":{"issue":"3","published-print":{"date-parts":[[2019,9,30]]}},"alternative-id":["10.1145\/3351158"],"URL":"https:\/\/doi.org\/10.1145\/3351158","relation":{},"ISSN":["2158-656X","2158-6578"],"issn-type":[{"type":"print","value":"2158-656X"},{"type":"electronic","value":"2158-6578"}],"subject":[],"published":{"date-parts":[[2019,9,30]]},"assertion":[{"value":"2018-02-01","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2019-01-01","order":1,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2019-10-10","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}