Online Program

Reporting Delays Correction of Cyber Incidents (309943)

Keywords: Cyber Incidents, Reporting Delays, Parametric Distributions

Obtaining an accurate estimate of cyber incident counts and their evolution over time is an important problem. Unfortunately, cyber incidents are frequently not immediately detected, and may take additional time to be reported. Recently, HIPAA accepted that cyber events goes unnoticed for months/years. Consequently, cyber data is biased since a smaller proportion of recent events have been reported, falsely making it appear that cyber incidents are diminishing in frequency. In last few decades, this problem has been studied in various perspectives. Estimation of reporting delays directly from raw data faces two concerns. First, recent events could only have been reported if their reporting delays were small, which leads to overestimation of the prevalence of shorter reporting delays. Second, our analysis found that the reporting delay distribution is non-stationary. We propose an algorithm that corrects for under reporting by using a sequence of parametric distributions to model the reporting delay distribution over time. The approach is validated by estimating a year ahead correction of cyber event counts reported until 2018 and compared these against counts reported until 2019.