Cyber Security Project Selection Using Integer Programming

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current methods for calculating and mitigating cyber security threats face challenges in quantifying expected losses due to lack of data and reliance on expert judgment, and fail to accurately account for redundancies and synergies among cyber security projects, leading to suboptimal resource allocation.

Innovation Solution

The proposed solution involves using a Loss Distribution Approach (LDA) that combines frequency and severity distributions, along with a scorecard framework to estimate parameters, and a portfolio-level analysis to calculate expected loss reductions, considering redundancies and synergies among projects, and optimizing project selection using integer programming to maximize ROI within budget constraints.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Quantity of substance

If expert judgment is used to quantify cyber loss, then data requirements are reduced, but measurement precision deteriorates

Engineering Contradiction:

Improvedata requirementsVSAvoidexpected loss quantification accuracy

Core Design Contradiction:

Quantity of substanceVSMeasurement precision

Solution Approach 1:

The patent transforms expert judgment into quantitative parameters by using scorecards that assign numerical values to risk factors. Experts evaluate cyber security projects against predefined criteria (frequency, severity, redundancy, synergy) and receive scores that are converted into quantitative expected loss reduction values, bridging subjective judgment with objective measurement

Inventive Principle:

Principle #35Parameter changes

Solution Approach 2:

The scorecard framework acts as an intermediary between expert judgment and quantitative analysis. It translates qualitative expert assessments into standardized numerical parameters that can be processed by optimization models, enabling both expert insight and precise measurement

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If multiple cyber security projects are implemented, then expected loss reduction increases, but device complexity increases

Engineering Contradiction:

Improveexpected loss reductionVSAvoidproject portfolio complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent segments the cyber security project portfolio into individual projects, each evaluated independently against the scorecard criteria. This allows complex interactions to be broken down into manageable components that can be optimized separately before being combined in the overall portfolio

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The optimization model dynamically adjusts project selection based on budget constraints and expected loss reduction goals. The system can adapt the portfolio composition by selecting different combinations of projects that maximize protection while managing complexity through mathematical optimization

Inventive Principle:

Principle #15Dynamics

3Device complexity

If project redundancies are not accounted for, then calculation simplicity is maintained, but measurement precision deteriorates

Engineering Contradiction:

Improvecalculation simplicityVSAvoidexpected loss reduction accuracy

Core Design Contradiction:

Device complexityVSMeasurement precision

Solution Approach 1:

The scorecard framework incorporates feedback mechanisms where the expected loss reduction of one project is adjusted based on the presence of other projects. Redundancy and synergy factors provide feedback that modifies individual project values to reflect their actual contribution in the context of the overall portfolio

Inventive Principle:

Principle #23Feedback

Solution Approach 2:

The patent merges the evaluation of multiple projects into a unified portfolio analysis. By combining individual project expected loss reductions and adjusting for redundancies and synergies, the system achieves precise measurement without requiring separate complex calculations for each project interaction

Inventive Principle:

Principle #5Merging (Combining)

4Adaptability or versatility

If budget constraints are not considered, then project selection flexibility is maintained, but loss of energy increases

Engineering Contradiction:

Improveproject selection flexibilityVSAvoidresource allocation efficiency

Core Design Contradiction:

Adaptability or versatilityVSLoss of energy

Solution Approach 1:

The optimization model uses parameter changes to reflect budget constraints as hard limits or soft targets. The mathematical model adjusts project selection parameters to maximize expected loss reduction while respecting budget boundaries, transforming financial constraints into mathematical conditions that guide optimal resource allocation

Inventive Principle:

Principle #35Parameter changes

Data Source

PatentUS11232384B1Methods and systems for determining cyber related projects to implement

Publication Date: 2022.01.25 BOSTON CONSULTING GRP INC

AI summary

Methods and systems for determining cyber security related projects to implement. Cyber security related projects used to protect entity assets can be identified. A return on investment for each cyber security related project can be determined. An optimization programming problem algorithm can be solved to remove project redundancies. Cyber security related projects to implement can be determined.