Statistical Inference on the Residual Risk Metric of the Quantitative Security-Meter Model Using Triple-Uniform Density

• Activity Number: 498
• Type: Invited
• Date/Time: Wednesday, August 5, 2009 : 2:00 PM to 3:50 PM
• Sponsor: Section on Risk Analysis
• Author(s): Mehmet Sahinoglu*+ and Yanling Yuan and David Banks
• Companies: Auburn University Montgomery and Troy University Montgomery and Duke University
• Keywords: Quantitative ; Residual-Risk ; Inference ; Security-Meter ; Simulation ; Uniform

Abstract

In the quantitative security-meter with a vulnerability-threat-countermeasure approach to assess the risk, the product of three non-identical uniforms is required so as to estimate the pdf one of the branches that add up to the total residual risk. Using the CLT, we sum the means and variances computed with the MAPLE software to find the approximate Normal(m=mean, v=variance). We have a match of the theoretical mean with the Monte Carlo Simulations' average for a large n=100,000. The summed variance of 10 or more branches is not accurate, but the accurate variance can be obtained from the Monte Carlo simulations. A closed form solution is found for the Security Meter's risk metric through an approximate Normal(m,v) to conduct statistical inference to compute risks. The triple-uniform densities' means and variances are satisfactorily computed using Rohatgi's theorem by the MAPLE package.