Towards an economic cyber loss index for parametric cover based on IT security indicator: A preliminary analysis

Dal Moro, Eric Article Towards an economic cyber loss index for parametric cover based on IT security indicator: A preliminary analysis Risks Provided in Cooperation with: MDPI – Multidisciplinary Digital Publishing Institute, Basel Suggested Citation: Dal Moro, Eric (2020) : Towards an economic cyber loss index for parametric cover based on IT security indicator: A preliminary analysis, Risks, ISSN 2227-9091, MDPI, Basel, Vol. 8, Iss. 2, pp. 1-12, https://doi.org/10.3390/risks8020045 This Version is available at: https://hdl.handle.net/10419/257999 Standard-Nutzungsbedingungen: Die Dokumente auf EconStor dürfen zu eigenen wissenschaftlichen Zwecken und zum Privatgebrauch gespeichert und kopiert werden. Sie dürfen die Dokumente nicht für öffentliche oder kommerzielle Zwecke vervielfältigen, öffentlich ausstellen, öffentlich zugänglich machen, vertreiben oder anderweitig nutzen. Sofern die Verfasser die Dokumente unter Open-Content-Lizenzen (insbesondere CC-Lizenzen) zur Verfügung gestellt haben sollten, gelten abweichend von diesen Nutzungsbedingungen die in der dort genannten Lizenz gewährten Nutzungsrechte. Terms of use: Documents in EconStor may be saved and copied for your personal and scholarly purposes. You are not to copy documents for public or commercial purposes, to exhibit the documents publicly, to make them publicly available on the internet, or to distribute or otherwise use the documents in public. If the documents have been made available under an Open Content Licence (especially Creative Commons Licences), you may exercise further usage rights as specified in the indicated licence. https://creativecommons.org/licenses/by/4.0/ risks Article Towards an Economic Cyber Loss Index for Parametric Cover Based on IT Security Indicator: A Preliminary Analysis Eric Dal Moro SCOR Reinsurance Company, CH-8022 Zürich, Switzerland; [email protected] Received: 27 January 2020; Accepted: 29 April 2020; Published: 8 May 2020   Abstract: As cyber events have virtually no geographical limitations and can result in economic losses on a global scale, the assessment of return periods for such economic losses is currently debated among experts. The potential accumulation of consequential insurance losses due to intrusions or viruses is one of the major reasons why the (re-)insurance industry has limited risk appetite for cyber related risks. In order to increase the risk appetite for cyber risk and based on a first batch of data provided by Symantec, the goal of this article is to: Check if IT activity, i.e., the number of virus or intrusions being blocked by Norton on end-user computers could be used as an index for parametric covers that reinsurance companies could propose to their cedants; Look into the correlations of this IT activity across different regions, thereby confirming the absence of geographical limitations for cyber risk, and hence confirming the systemic nature of this risk. This first study on the Symantec dataset shows that a cyber index based on IT activity could be a useful tool to design parametric reinsurance product. Keywords: correlation; time-series; cyber risk; insurance linked securities; parametric insurance 1. Introduction Cyber risk commonly refers to any risk of financial loss, disruption or damage to the reputation of an organization, resulting from the failure of its information technology systems. In order to protect organization or persons from cyber risk, a few companies propose protection tools such as Symantec, AVG or Microsoft. Among these companies, Symantec is one of the major providers of end-user (personal computer) protection with its software Norton. For this article, Symantec has provided a first batch of data that will help characterize the cyber risk, and could be a source for deriving an index of cybercrime activity. In its 2018 Internet Crime Report (see Federal Bureau of Investigation 2018), the USA Federal Bureau of Investigation describes the mission of its IC3 department as “provide the public with a reliable and convenient reporting mechanism to submit information to the FBI concerning suspected Internet-facilitated criminal activity, and to develop effective alliances with industry partners. Information is analyzed and disseminated for investigative and intelligence purposes, for law enforcement, and for public awareness”. The report shows a steady increase of Internet crime, totaling, in 2018, 1,509,679 complaints for a total loss estimated at USD 7.45 billion. As an illustration of the growing crime activity on the internet, Guy Carpenter and Cybercube mentioned (see Guy Carpenter 2019) that: • The U.S. industry 1-in-100 years return period produces total annual cyber catastrophe insured losses of USD 14.6 billion (this can include one or more events within the same year); Risks 2020,8, 45; doi:10.3390/risks8020045 www.mdpi.com/journal/risks Risks 2020,8, 45 2 of 12 • Both on-premise and cloud service providers face exogenous threats from malicious third parties. Focusing on cloud service providers, the calculated probability of ransomware is four times larger than the probability of other outages; • The costliest cyber catastrophe scenario is widespread data loss from a leading operating systems provider with potential to generate up to USD 23.8 billion of insured loss; • The most likely cyber catastrophe loss scenario is widespread data theft from a major email service provider. In the context of the significant amount of losses already existing and of the lack of cyber risk characterization, insurance and reinsurance companies are still hesitating to propose covers which would be needed by the industry (see Abadie 2019). There have been many attempts to answer the lack of knowledge on cyber risk through scenarios (see Swiss Insurance Association ( Switzerland ) 2017), or through an agenda to work on this topic (see Falco et al. 2019). However, to this day, most of the stakeholders on this market still recognize the complexity of mastering this risk. This results in a lack of capacity provided to this market. One way to increase the available cyber capacity of the risk transfer market, and to achieve an additional atomization of this accumulation exposure, are alternative risk transfer (ART) solutions, involving the capital market via insurance linked securities (ILS), i.e., cyber cat bonds and parametric insurance and industry loss warranties (ILW). ILS and ILW are defined as financial instruments whose values are driven by insurance loss events. Those such instruments that are linked to property losses due to natural catastrophes, for example, represent a unique asset class, the return from which is uncorrelated with that of the general financial market. To achieve the participation of the capital market in index triggered ILS transactions, investors and insurers need to have confidence and full understanding of the composition of unbiased, reliable indices, based on transparent and robust IT security key performance indicators, parameters and metrics. When ART solutions will be made available by reinsurance companies to their cedants, insurers will have access to a significant capacity and will be in a position to propose more insurance policies with higher capacities to their clients. In addition to the transparency and robustness of the envisaged IT activity-based trigger, the advantage of parametric covers is that they provide significant cost-saving opportunities in terms of loss indemnification. In the case of cyber risk, the identification of a loss, or the sources of it, can be very complex, especially due to the uncertain event duration: when it started, when was the peak, when it stopped. All these elements may be difficult to assess. As a consequence, ART may be a good solution to provide coverage provided a reliable cyber index can be built. At this point, there have been some attempts to propose pricing models for such products (see Kasper 2019 or Eling and Jung 2018), but the lack of data is always limiting the applicability of the proposed model. As a result, with the data provided by Symantec, this article opens new areas of research for the creation of a reliable index based on IT activity, which could be used in the creation of a new set of ART products. 2. Review of Related Works As mentioned above, the lack of data is limiting the ability of the insurance industry to propose coverage for cyber risk. In Marotta et al. (2017), an obvious explanation for the lack of available data is given: “Organizations are afraid of releasing too much information about their internal systems to prevent decrease of reputation as well as prevent leakage of knowledge about weaknesses of the system”. As a result, in Eling and Schnell (2016), a thorough review of 209 papers conclude to “the immense difficulties to insure cyber risk, especially due to a lack of data and modelling approaches, the risk of change and incalculable accumulation risks”. The same conclusion is reached by Flor ê ncio and Herley (2013): as most of the information on cyber risk is gathered through surveys, they conclude that there should be a bias on the analysis of such data. Risks 2020,8, 45 3 of 12 In this context, some proposals to overcome this issue are proposed including public-private partnerships. This is precisely the aim of the recently formed ASTIN working group (the non-life section of the International Actuarial Association—see www.actuaries.org) on cyber risk: it gathers experts from different fields, such as IT, (re)insurance actuaries, Insurance Linked Securities experts. As a non-profit working group, access to IT data is facilitated and Symantec has offered the database which is used in this article. This is one of the first time where a collaborative non-profit approach to cyber risk is proposed. Finally, since 2018, the Geneva Association (see Geneva Association 2020) initiated a study to explore the opportunity of building an international cyber claims and cyber incident database, the Cyber Incident Data Exchange and Repository (CIDER). By giving insurers access to a pool of anonymized data, such a tool would aim to assist them in better understanding threat vectors and impacts, and in improving their ability to protect people and businesses from cyber incidents. Following these different initiatives, it is likely that more and more IT and insurance data will be made available to researchers to explore cyber risk. This article is the first one providing some quantitative analysis on IT data, which could be used for providing parametric insurance cover in the future. 3. Methodology and Dataset Description As mentioned above, based on a first batch of data provided by Symantec, this paper aims at confirming quantitatively some key features of cyber risk, in particular, the systemic nature of this risk and the possibility to use such IT data to create an index which would reflect the insurance losses. Many articles and books have been written on cyber risk (see Swiss Re 2017;KPMG 2016, or Edwards et al. 2016 to quote only a few of them), but the quantitative analysis of such risk is still limited, due to the limited data available, as the risk is relatively new. This article will therefore focus on the analysis of this first batch of data to derive some quantitative elements that could be used for pricing (re)insurance products covering cyber risk. The data provided by Symantec includes the following elements on a daily basis between 1st July 2016 and 31st December 2018: • The number of viruses blocked on each computer using Symantec software protection; virus protection software is designed to prevent viruses, worms and Trojan horses from getting onto a computer, as well as to remove any malicious software code that has already infected a computer; • The sample covers all the countries where at least one computer is protected by Norton, the Symantec protection software; • The number of intrusions blocked on each computer using Symantec software protection. The intrusion prevention system (IPS) is the Symantec Endpoint Protection client’s second layer of defense after the firewall. The intrusion prevention system is a network-based system. If a known attack is detected, one or more intrusion prevention technologies can automatically block it. For example, this technology prevents malicious files from getting to a hard drive in the first place. Unlike an antivirus, which looks for known malicious files, IPS scans the network traffic stream in order to find threats using known exploits and attack vectors. IPS does not detect specific files, but rather specific methods that can be used to get malicious files onto a network. This allows IPS to protect against both known and unknown threats (see Holm 2014), even before antivirus signatures can be created for them; •The daily numbers are split by country; • For the antivirus extract (i.e., the number of viruses being blocked by Norton over all the computers worldwide), there are 127,231 records over the period 1st July 2016 and 31st December 2018. One record consists of the number of viruses being blocked for one day in one country; • For the IPS extract, there are 128,054 records. One record consists of the number of IPS being blocked for one day in one country. Risks 2020,8, 45 4 of 12 The Symantec data needs to be correlated to real loss data in order to assess the possibility to define a cyber loss index on the basis of such data. As real loss data is not available yet, the Symantec data is checked against the information included in the report of the Center for Strategic & International Studies (2006) and against the information available on the website PrivacyRights.org. The following sections will focus on the information which we can be gathered from the analysis of the Symantec data: •The first section will concentrate on Virus activities being blocked; •The second section will concentrate on Intrusions being blocked; • The third section will try to link the above two cyber activities with known events which happened on the Internet. In the first two sections, the challenge is to visualize within Symantec data any surge in cyber activity which could be used as a trigger for a parametric insurance cover (see Figure 1below). If such events are present in the Symantec data, there is a good chance that they are related to insurance losses. However, this next step consisting of correlating cyber activity extreme events with insurance loss is not part of this article. Risks 2020, 8, x FOR PEER REVIEW 4 of 13 data is checked against the information included in the report of the Center for Strategic & International Studies (2006) and against the information available on the website PrivacyRights.org. The following sections will focus on the information which we can be gathered from the analysis of the Symantec data: • The first section will concentrate on Virus activities being blocked; • The second section will concentrate on Intrusions being blocked; • The third section will try to link the above two cyber activities with known events which happened on the Internet. In the first two sections, the challenge is to visualize within Symantec data any surge in cyber activity which could be used as a trigger for a parametric insurance cover (see Figure 1 below). If such events are present in the Symantec data, there is a good chance that they are related to insurance losses. However, this next step consisting of correlating cyber activity extreme events with insurance loss is not part of this article. It must be noted that one strong assumption around this work lies with the idea that the virus/intrusions which affect computers not being protected by Symantec are proportional to virus/intrusions being blocked by Symantec. Even though such assumption is reasonable, there is no way in which such an assumption can be tested at this point. The need for this assumption would disappear in a business model where an insurer teams up with Symantec, so that all the insureds are actually Symantec-protected, and those not protected by Symantec are not insured. In such a case, the basis risk related to the proposed parametric trigger calculated on the basis of Symantec data would be significantly reduced. Figure 1. Number of virus being blocked on computers protected by Symantec protection software. 4. Symantec Antivirus activities The following is a visualization of the Symantec antivirus activity. For each day, the number of viruses being blocked by Symantec protection software on each end-used computer is shown per country. The graph above has the following limitations: • Data from weekends is filtered; • Only the countries where number of blocks were more than 100,000 are shown. Below is the result of a simple study of stationarity performed on the above time-series by country. The Augmented Dickey-Fuller (ADF) test with drift and trend is applied to each time-series: 0% 50% 100% 150% 200% 250% 300% 350% 400% 450% FR AU BR CA CN DE ES GB IN IT JP MX NL US Figure 1. Number of virus being blocked on computers protected by Symantec protection software. It must be noted that one strong assumption around this work lies with the idea that the virus/intrusions which affect computers not being protected by Symantec are proportional to virus/intrusions being blocked by Symantec. Even though such assumption is reasonable, there is no way in which such an assumption can be tested at this point. The need for this assumption would disappear in a business model where an insurer teams up with Symantec, so that all the insureds are actually Symantec-protected, and those not protected by Symantec are not insured. In such a case, the basis risk related to the proposed parametric trigger calculated on the basis of Symantec data would be significantly reduced. 4. Symantec Antivirus activities The following is a visualization of the Symantec antivirus activity. For each day, the number of viruses being blocked by Symantec protection software on each end-used computer is shown per country. The graph above has the following limitations: •Data from weekends is filtered; •Only the countries where number of blocks were more than 100,000 are shown. Risks 2020,8, 45 5 of 12 Below is the result of a simple study of stationarity performed on the above time-series by country. The Augmented Dickey-Fuller (ADF) test with drift and trend is applied to each time-series: The above results (Table 1) confirm that the time-series are stationary. Table 1. Results of the Augmented Dickey-Fuller test. Lag France Australia Brazil Canada China Germany Spain ADF p.Value ADF p.Value ADF p.Value ADF p.Value ADF p.Value ADF p.Value ADF p.Value 0− 10.23 0.01 − 9.71 0.01 − 12.73 0.01 − 10.31 0.01 − 10.55 0.01 − 9.98 0.01 − 10.28 0.01 1− 8.99 0.01 − 8.71 0.01 − 9.55 0.01 − 8.65 0.01 − 9.51 0.01 − 8.93 0.01 − 8.46 0.01 2− 7.39 0.01 − 7.17 0.01 − 7.28 0.01 − 7.11 0.01 − 8.31 0.01 − 7.06 0.01 − 6.82 0.01 3− 6.87 0.01 − 6.94 0.01 − 6.91 0.01 − 6.44 0.01 −7.7 0.01 − 6.66 0.01 − 6.44 0.01 4− 6.24 0.01 − 6.39 0.01 − 5.94 0.01 −5.4 0.01 − 7.29 0.01 − 6.24 0.01 − 6.16 0.01 5− 6.52 0.01 − 6.48 0.01 − 6.01 0.01 − 6.34 0.01 − 7.51 0.01 − 6.36 0.01 − 6.01 0.01 6− 6.36 0.01 − 6.12 0.01 − 5.72 0.01 − 5.86 0.01 − 7.29 0.01 − 6.26 0.01 − 5.78 0.01 Lag UK India Italy Japan Mexico Holland USA ADF p.Value ADF p.Value ADF p.Value ADF p.Value ADF p.Value ADF p.Value ADF p.Value 0− 9.36 0.01 − 12.37 0.01 − 9.26 0.01 − 10.35 0.01 − 11.87 0.01 − 9.75 0.01 − 10.48 0.01 1− 8.19 0.01 −9.1 0.01 − 8.08 0.01 − 9.37 0.01 − 9.69 0.01 − 8.81 0.01 − 9.15 0.01 2− 6.66 0.01 − 7.63 0.01 − 6.54 0.01 − 8.05 0.01 −7.7 0.01 − 6.91 0.01 − 7.48 0.01 3− 6.59 0.01 −6.6 0.01 − 6.13 0.01 − 7.55 0.01 − 6.59 0.01 − 6.53 0.01 − 6.99 0.01 4− 6.14 0.01 − 5.19 0.01 − 5.77 0.01 − 7.35 0.01 − 5.64 0.01 − 6.22 0.01 − 6.28 0.01 5− 6.47 0.01 − 5.78 0.01 −6.1 0.01 − 6.73 0.01 −6.4 0.01 − 6.24 0.01 − 6.85 0.01 6− 6.22 0.01 − 6.06 0.01 − 5.93 0.01 − 6.58 0.01 − 6.84 0.01 −6.2 0.01 − 6.58 0.01 As expected, there are peak activities, in particular on the following days: •14–16 Dec. 2016; •24 Mar. 2017 (very high activity); •11 May 2017; •9 Aug. 2017; •16 Nov. 2017; •1 Mar. 2018; •1 Oct. 2018; •19 Oct. 2018. From Figure 1above, there seems to be a possibility to define an index if the above high activities would be related to insurance losses. In order to confirm this possibility to define an index, in further sections, we will try to provide some explanations for these high activities. At this point, we can estimate correlations between the antivirus activities of each country. The correlation matrix is shown below (see Table 2): Risks 2020,8, 45 6 of 12 Table 2. Correlation matrix between the antivirus activities in different countries. FR AU BR CA CN DE ES GB IN IT JP MX NL US FR 100% 80% 75% 72% 61% 88% 89% 84% 71% 86% 82% 83% 88% 83% AU 80% 100% 56% 89% 52% 93% 68% 94% 49% 86% 90% 76% 91% 90% BR 75% 56% 100% 45% 65% 64% 82% 57% 84% 58% 58% 80% 59% 66% CA 72% 89% 45% 100% 37% 89% 60% 93% 38% 83% 86% 70% 90% 92% CN 61% 52% 65% 37% 100% 55% 59% 48% 72% 49% 55% 67% 45% 54% DE 88% 93% 64% 89% 55% 100% 77% 95% 58% 90% 90% 82% 95% 91% ES 89% 68% 82% 60% 59% 77% 100% 73% 76% 77% 71% 80% 76% 74% GB 84% 94% 57% 93% 48% 95% 73% 100% 49% 92% 89% 77% 96% 93% IN 71% 49% 84% 38% 72% 58% 76% 49% 100% 53% 55% 77% 52% 60% IT 86% 86% 58% 83% 49% 90% 77% 92% 53% 100% 85% 74% 90% 85% JP 82% 90% 58% 86% 55% 90% 71% 89% 55% 85% 100% 75% 89% 88% MX 83% 76% 80% 70% 67% 82% 80% 77% 77% 74% 75% 100% 76% 83% NL 88% 91% 59% 90% 45% 95% 76% 96% 52% 90% 89% 76% 100% 90% US 83% 90% 66% 92% 54% 91% 74% 93% 60% 85% 88% 83% 90% 100% FR: France, AU: Australia, BR: Brazil, CA: Canada, CN: China, DE: Germany, ES: Spain, GB: UK, IN: India, IT: Italy, JP: Japan, MX: Mexico, NL: Holland, US: USA. Countries with high correlation between each other (>80%) include France, Australia, Canada, Germany, UK, Italy, Holland, Japan and the US. For Brazil and Mexico, it seems that local hacker groups focus on their country which results in smaller correlation to other countries. Finally, it must be noted that the high correlations of the time-series of these countries are influenced by the fact that Symantec has high market shares in these countries. In addition to the linear correlation analysis, the matrix of Kendall Tau (Table 3) is also shown below: Table 3. Kendall Tau matrix between the antivirus activities in different countries. FR AU BR CA CN DE ES GB IN IT JP MX NL US FR 100% 48% 51% 38% 39% 60% 66% 51% 47% 56% 51% 54% 61% 52% AU 48% 100% 29% 60% 25% 69% 36% 70% 24% 60% 64% 43% 63% 64% BR 51% 29% 100% 19% 49% 36% 60% 26% 65% 29% 30% 56% 32% 40% CA 38% 60% 19% 100% 11% 61% 27% 69% 16% 58% 59% 36% 62% 68% CN 39% 25% 49% 11% 100% 28% 37% 19% 55% 22% 27% 50% 20% 27% DE 60% 69% 36% 61% 28% 99% 45% 72% 33% 66% 66% 49% 73% 66% ES 66% 36% 60% 27% 37% 45% 100% 38% 52% 46% 38% 50% 46% 42% GB 51% 70% 26% 69% 19% 72% 38% 100% 22% 71% 64% 40% 74% 67% IN 47% 24% 65% 16% 55% 33% 52% 22% 100% 26% 30% 57% 28% 36% IT 56% 60% 29% 58% 22% 66% 46% 71% 26% 100% 61% 40% 67% 58% JP 51% 64% 30% 59% 27% 66% 38% 64% 30% 61% 100% 42% 62% 61% MX 54% 43% 56% 36% 50% 49% 50% 40% 57% 40% 42% 100% 43% 52% NL 61% 63% 32% 62% 20% 73% 46% 74% 28% 67% 62% 43% 100% 65% US 52% 64% 40% 68% 27% 66% 42% 67% 36% 58% 61% 52% 65% 100% Risks 2020,8, 45 7 of 12 Based on the above, if we define systemic risk as the risk of the occurrence of an event that threatens the well-functioning of the system of interest (financial, payments, banking, etc.), sometimes to the point of making its operation impossible (see Billio et al. 2012), it shows clearly that cyber risk has a systemic nature: many countries are hit by Virus attacks at the same time. Finally, we must bear in mind that this conclusion is limited to the available dataset. 5. Symantec Intrusion Activities The following is a visualization of the Symantec intrusion activity. For each day, the number of intrusion attempts being blocked by Symantec protection software on each end-used computer is shown per country. As for the Antivirus activities, the graph above (Figure 2) has the following limitations: •Data from weekends is filtered; •Only the countries where the number of blocks were more than 100,000 are shown. Risks 2020, 8, x FOR PEER REVIEW 7 of 13 Table 3. Kendall Tau matrix between the antivirus activities in different countries. FR AU BR CA CN DE ES GB IN IT JP MX NL US FR 100% 48% 51% 38% 39% 60% 66% 51% 47% 56% 51% 54% 61% 52% AU 48% 100% 29% 60% 25% 69% 36% 70% 24% 60% 64% 43% 63% 64% BR 51% 29% 100% 19% 49% 36% 60% 26% 65% 29% 30% 56% 32% 40% CA 38% 60% 19% 100% 11% 61% 27% 69% 16% 58% 59% 36% 62% 68% CN 39% 25% 49% 11% 100% 28% 37% 19% 55% 22% 27% 50% 20% 27% DE 60% 69% 36% 61% 28% 99% 45% 72% 33% 66% 66% 49% 73% 66% ES 66% 36% 60% 27% 37% 45% 100% 38% 52% 46% 38% 50% 46% 42% GB 51% 70% 26% 69% 19% 72% 38% 100% 22% 71% 64% 40% 74% 67% IN 47% 24% 65% 16% 55% 33% 52% 22% 100% 26% 30% 57% 28% 36% IT 56% 60% 29% 58% 22% 66% 46% 71% 26% 100% 61% 40% 67% 58% JP 51% 64% 30% 59% 27% 66% 38% 64% 30% 61% 100% 42% 62% 61% MX 54% 43% 56% 36% 50% 49% 50% 40% 57% 40% 42% 100% 43% 52% NL 61% 63% 32% 62% 20% 73% 46% 74% 28% 67% 62% 43% 100% 65% US 52% 64% 40% 68% 27% 66% 42% 67% 36% 58% 61% 52% 65% 100% 5. Symantec Intrusion Activities The following is a visualization of the Symantec intrusion activity. For each day, the number of intrusion attempts being blocked by Symantec protection software on each end-used computer is shown per country. As for the Antivirus activities, the graph above (Figure 2) has the following limitations: • Data from weekends is filtered; • Only the countries where the number of blocks were more than 100,000 are shown. Figure 2. Number of intrusions being blocked on computers protected by Symantec protection software. As with the antivirus, a simple study of stationarity performed on the above time-series by country was performed. The Augmented Dickey-Fuller (ADF) test with drift and trend is applied to each time-series: As with the antivirus activities, the above results (Table 4) confirm that the time-series are stationary. 0% 50% 100% 150% 200% 250% 300% 350% 400% 450% 500% FR AU BR CA CN DE ES GB IN IT JP MX NL US Figure 2. Number of intrusions being blocked on computers protected by Symantec protection software. As with the antivirus, a simple study of stationarity performed on the above time-series by country was performed. The Augmented Dickey-Fuller (ADF) test with drift and trend is applied to each time-series: As with the antivirus activities, the above results (Table 4) confirm that the time-series are stationary. Also, as expected, there are peak activities, in particular, on the following days: •21 Feb 2017; •6 and 12 Apr 2017; •2 Mar 2018; •1 May 2018 (highest activity recorded); •12 Jun 2018; •1 Oct 2018. Risks 2020,8, 45 8 of 12 Table 4. Results of the Augmented Dickey-Fuller test. Lag France Australia Brazil Canada China Germany Spain ADF p.Value ADF p.Value ADF p.Value ADF p.Value ADF p.Value ADF p.Value ADF p.Value 0− 9.71 0.01 − 9.62 0.01 − 10.56 0.01 − 10.37 0.01 − 9.66 0.01 − 9.36 0.01 − 10.15 0.01 1− 8.44 0.01 − 8.22 0.01 − 8.56 0.01 −8.5 0.01 − 8.77 0.01 − 8.05 0.01 − 8.31 0.01 2− 7.06 0.01 − 6.45 0.01 − 6.68 0.01 − 7.08 0.01 − 7.34 0.01 − 6.21 0.01 − 6.81 0.01 3− 7.06 0.01 − 5.92 0.01 − 6.19 0.01 − 6.92 0.01 − 7.52 0.01 − 6.02 0.01 − 6.48 0.01 4− 6.23 0.01 − 5.18 0.01 − 5.32 0.01 − 6.15 0.01 − 7.07 0.01 − 5.43 0.01 − 5.63 0.01 5− 5.69 0.01 − 5.39 0.01 − 5.14 0.01 −6.1 0.01 − 6.55 0.01 − 5.17 0.01 − 5.31 0.01 6− 5.25 0.01 − 5.25 0.01 − 4.96 0.01 − 5.75 0.01 − 5.92 0.01 − 4.79 0.01 − 4.96 0.01 Lag UK India Italy Japan Mexico Holland USA ADF p.Value ADF p.Value ADF p.Value ADF p.Value ADF p.Value ADF p.Value ADF p.Value 0− 9.46 0.01 − 10.84 0.01 − 9.68 0.01 − 10.14 0.01 − 10.05 0.01 − 9.98 0.01 − 10.27 0.01 1− 8.07 0.01 − 7.86 0.01 − 8.16 0.01 − 8.57 0.01 − 7.83 0.01 −8.5 0.01 − 8.75 0.01 2− 6.75 0.01 − 6.78 0.01 − 6.76 0.01 − 6.96 0.01 − 6.16 0.01 −6.8 0.01 −7.1 0.01 3− 6.84 0.01 − 6.13 0.01 − 6.84 0.01 − 6.55 0.01 − 5.53 0.01 − 6.59 0.01 − 6.73 0.01 4− 5.92 0.01 − 5.38 0.01 − 5.89 0.01 − 6.03 0.01 − 4.64 0.01 − 5.91 0.01 − 6.11 0.01 5− 5.79 0.01 − 4.98 0.01 − 5.84 0.01 − 5.65 0.01 − 4.56 0.01 − 5.66 0.01 − 5.92 0.01 6− 5.41 0.01 − 4.45 0.01 − 5.24 0.01 − 5.18 0.01 − 4.08 0.01 − 5.39 0.01 − 5.59 0.01 From Figure 2above, there seems to be a possibility to define an index if the above high activities would be related to insurance losses (see Figure 3for a comparison of blocked intrusions vs number of records stolen). Interestingly, such an intrusions-based index would trigger the insurance cover at different times as compared to an antivirus-based index. Therefore, it would be interesting to see if the index based on antivirus or on intrusions would be performing better in terms of insurance loss prediction. Alternatively, a blend of the two indexes could be the best performer. Risks 2020, 8, x FOR PEER REVIEW 9 of 13 Also, as expected, there are peak activities, in particular, on the following days: • 21 Feb 2017; • 6 and 12 Apr 2017; • 2 Mar 2018; • 1 May 2018 (highest activity recorded); • 12 Jun 2018; • 1 Oct 2018. From Figure 2 above, there seems to be a possibility to define an index if the above high activities would be related to insurance losses (see Figure 3 for a comparison of blocked intrusions vs number of records stolen). Interestingly, such an intrusions-based index would trigger the insurance cover at different times as compared to an antivirus-based index. Therefore, it would be interesting to see if the index based on antivirus or on intrusions would be performing better in terms of insurance loss prediction. Alternatively, a blend of the two indexes could be the best performer. Figure 3. Number of blocked intrusions vs. the number of records stolen. As for antivirus activities, we can estimate correlations between the activities of each country. The correlation matrix (Table 5) is shown below: Table 5. Correlation matrix between the intrusion activities in different countries. FR AU BR CA CN DE ES GB IN IT JP MX NL US FR 100% 84% 84% 85% 60% 93% 93% 84% 82% 93% 87% 87% 92% 88% AU 84% 100% 80% 94% 59% 85% 81% 92% 72% 85% 91% 82% 93% 92% BR 84% 80% 100% 77% 66% 77% 89% 76% 87% 79% 81% 93% 81% 85% CA 85% 94% 77% 100% 55% 88% 79% 95% 68% 87% 91% 79% 94% 95% CN 60% 59% 66% 55% 100% 60% 62% 57% 68% 58% 61% 67% 56% 62% DE 93% 85% 77% 88% 60% 100% 85% 87% 72% 88% 87% 79% 92% 88% ES 93% 81% 89% 79% 62% 85% 100% 77% 89% 89% 83% 91% 86% 85% GB 84% 92% 76% 95% 57% 87% 77% 100% 65% 88% 89% 77% 92% 93% IN 82% 72% 87% 68% 68% 72% 89% 65% 100% 74% 76% 90% 74% 78% IT 93% 85% 79% 87% 58% 88% 89% 88% 74% 100% 87% 81% 91% 87% JP 87% 91% 81% 91% 61% 87% 83% 89% 76% 87% 100% 81% 92% 92% MX 87% 82% 93% 79% 67% 79% 91% 77% 90% 81% 81% 100% 83% 87% NL 92% 93% 81% 94% 56% 92% 86% 92% 74% 91% 92% 83% 100% 93% US 88% 92% 85% 95% 62% 88% 85% 93% 78% 87% 92% 87% 93% 100% All countries except China and India show high correlation between each other (>80%). 0 500'000'000 1'000'000'000 1'500'000'000 2'000'000'000 2'500'000'000 3'000'000'000 3'500'000'000 0% 50% 100% 150% 200% 250% 300% 350% 400% FR AU BR CN DE ES GB IN IT JP MX NL US CA Records Figure 3. Number of blocked intrusions vs. the number of records stolen. As for antivirus activities, we can estimate correlations between the activities of each country. The correlation matrix (Table 5) is shown below: