Cyber Risk Management and Mitigation via Controlled Stochastic SIS Dynamics: An Optimal Control Approach

TL;DR

The paper addresses cyber risk propagation by casting cyber risk management as a stochastic optimal control problem on a controlled SIS diffusion, introducing two controls $\eta_t$ (proactive) and $\rho_t$ (reactive). It derives the Hamilton–Jacobi–Bellman equation and proves the value function $V$ is the unique increasing viscosity solution, then develops a Policy Improvement Algorithm (PIA) with BSDE-based convergence to solve the infinite-horizon problem and demonstrates its effectiveness via a benchmark and sensitivity analyses. The results show that proactive risk management delivers robust benefits across infection levels, while reactive mitigation is crucial when infections are widespread, offering practical guidance on resource allocation in cyber defense. Overall, the work provides a rigorous, computationally viable framework for optimizing cyber risk control under stochastic contagion, with clear avenues for extending to jumps, regime-switching, and network-heterogeneity settings.

Abstract

In this paper, we formulate cyber risk management and mitigation as a stochastic optimal control problem under a stochastic Susceptible-Infected-Susceptible (SIS) epidemic model. To capture the dynamics and interplay of management and mitigation strategies, we introduce two stochastic controls: (i) a proactive risk management control to reduce external cyber attacks and internal contagion effects, and (ii) a reactive mitigation control to accelerate system recovery from cyber infection. The interplay between these controls is modeled by minimizing the expected discounted running costs, which balance proactive management expenses against reactive mitigation expenditures. We derive the associated Hamilton-Jacobi-Bellman (HJB) equation and characterize the value function as its unique viscosity solution. For numerical solutions, we propose a Policy Improvement Algorithm (PIA) and prove its convergence via Backward Stochastic Differential Equations (BSDEs). Finally, we present a comprehensive numerical analysis through a benchmark example, suboptimal control analysis, sensitivity analysis, and comparative statics.

Figures (7)

• Figure 4.1: Results of benchmark example \ref{['example:4.1']}
• Figure 4.2: Optimal strategy and value function for suboptimal controls
• Figure 4.3: Sensitivity analysis on small deviations from the optimal control.
• Figure 4.4: Comparison analysis for $\alpha$(left) and $\beta$(right).
• Figure 4.5: Comparison analysis for $\sigma$.

Theorems & Definitions (23)

• Lemma 2.1
• Proposition 2.1
• Remark 2.1
• Proposition 2.2
• Definition 3.1
• Proposition 3.1
• Definition 3.2
• Proposition 3.2
• Proposition 3.3
• Proposition 3.4