Cyber-Threat Mitigation Exploiting the Birth–Death–Immigration Model

We consider the problem of mitigating the effect of malicious cyber-threats spreading across multiple subnets of a data network. Three fundamental issues arise: 1) providing a manageable model of threat propagation; 2) quantifying the danger associated to different subnets; and 3) optimizing the allocation of the countermeasures. We address these issues by providing the following novel contributions. First, a convenient mathematical abstraction of threat propagation is proposed, which employs the birth-and-death process with immigration pioneered by Kendall in his seminal work of 1948. Then, exploiting the notable properties of such a model, we show how to retrieve analytical solutions for optimal resource allocation across subnets, for the case where the parameters of the attack are perfectly known. Finally, the assumption of perfect knowledge is removed, and the unknown attack parameters are estimated using maximum-likelihood estimators.