Modeling-Yearly-Maximums-and-Future-Cyber-Risk

A statistical analysis of extreme cyber breaches using Extreme Value Theory (EVT). The project models annual maximum data breach sizes with Generalized Extreme Value (GEV) distributions, comparing stationary and non-stationary specifications to estimate long-term return levels, as well as quantifying uncertainty through bootstrap resampling and Monte Carlo simulation

Overview

Large cyber breaches are a rare occurrence, but disproportionately damaging. Traditional statistical methods, which focus on average behavior, tends to underestimate the probability of catastrophic outlier events. This project applies Extreme Value Theory (EVT) to model annual maximum data breaches and answer four questions:

• How large could future extreme data breaches realistically become?
• Has the magnitude of the largest annual breaches increased over time?
• How uncertain are predictions of rare events (e.g. 50- or 100- year breaches)?
• Does a non-stationary model (allowing a trend over time) fit better than a stationary one?

Dataset

• Source: "World's Biggest Data Breaches and Hacks" (Kaggle)
• Raw size: 419 reported breaches, 2004 - 2022
• Reduction method: Block Maxima - only the largest breach per year is retained, yielding 19 annual maximum observations
• Variables used:
  • year - calendar year of the breach
  • records_lost - number of records exposed

Methods used

• Data cleaning
• Block Maxima extraction
• Exploratory analysis
• Stationary GEV model
• Non-stationary GEV model
• Model comparison
  • AIC
  • Likelihood Ratio Test
• Return level estimation
• Uncertainty quantification
• Monte Carlo simulation study

Key findings

• Annual maximum breach sizes are heavy-tailed
• Future breaches far larger than any observed observation are statistically plausible
• No statistically significant trend was found in annual breach size
  • Stationary GEV model was preferred over non-stationary model by both AIC and the likelihood ratio test
• Long-term return level estimates carry substantial uncertainty, driven by limited sample size
• A simulation study confirmed a clear bias-variance trade-off

Key Skills Demonstrated

• Extreme Value Theory (GEV modeling, block maxima)
• Stationary vs. non-stationary model comparison (AIC, likelihood ratio testing)
• Return level estimation and interpretation
• Bootstrap resampling for uncertainty quantification
• Monte Carlo simulation study design
• Statistical computing in R (extRemes, evd, dplyr, ggplot2)
• Critical evaluation of model limitations and data quality

How to Run

1. Clone the repository:

git clone https://github.com/Mancon1/Modeling-Yearly-Maximums-and-Future-Cyber-Risk

2. Place the dataset (data_breaches.csv) in the project directory.
3. Open Project_work_cyber_risk.R in RStudio.
4. Install required packages if necessary (extRemes, evd, dplyr, ggplot2).
5. Run the script from top to bottom.

Authors

• Måns Conradson
• Jacob Telander