Multivariate Hawkes process for cyber insurance

In this paper, we propose a multivariate Hawkes framework for modelling and predicting cyber attacks frequency. The inference is based on a public data set containing features of data breaches targeting the US industry. As a main output of this paper, we demonstrate the ability of Hawkes models to capture self-excitation and interactions of data breaches depending on their type and targets. In this setting, we detail prediction results providing the full joint distribution of future cyber attacks times of occurrence. In addition, we show that a non-instantaneous excitation in the multivariate Hawkes model, which is not the classical framework of the exponential kernel, better fits with our data. In an insurance framework, this study allows to determine quantiles for number of attacks, useful for an internal model, as well as the frequency component for a data breach guarantee.