A Framework to Quantify the Probability of Future Cyber Loss Events
LEFSA estimates future cyber-loss probabilities from Defender telemetry, with XGBoost reaching 0.90 mean AUC across 23 organizations.
LEFSA reformulates Loss Event Frequency estimation as machine-level cyber loss event prediction plus hierarchical aggregation across infrastructure. It was tested on proprietary Managed Detection and Response telemetry from 23 organizations using Microsoft Defender for Endpoint. XGBoost produced the best results, with a mean ROC AUC of 0.90 and consistently low calibration error. The authors argue operational telemetry contains useful signal for probabilistic, organization-wide cyber risk estimates.
- LEFSA predicts machine-level cyber loss events, then aggregates them hierarchically.
- Evaluation used Defender for Endpoint telemetry from 23 organizations.
- XGBoost reached a mean ROC AUC of 0.90 with low calibration error.
- Dependencies between machines are included in infrastructure-level aggregation.
- Vendors
- Microsoft
- Products
- Microsoft Defender for Endpoint
From the original article
1 min read at arxiv.orgCybersecurity risk quantification remains challenging due to limited operational data and difficulties in quantifying Loss Event Frequency (LEF). This paper introduces the Loss Event Frequency Security Analyser (LEFSA), a probabilistic framework that reformulates LEF estimation as machine-level Cyber Loss Event (CLE) prediction combined with hierarchical infrastructure-level aggregation.
By Siem Peters · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.