Two-stage Security Controls Selection

Available online at www.sciencedirect.com

ScienceDirect Procedia Computer Science 100 (2016) 971 – 978

&RQIHUHQFHRQ(17(5SULVH,QIRUPDWLRQ6\VWHPV,QWHUQDWLRQDO&RQIHUHQFHRQ3URMHFW 0$1DJHPHQW&RQIHUHQFHRQ+HDOWKDQG6RFLDO&DUH,QIRUPDWLRQ6\VWHPVDQG7HFKQRORJLHV &(17(5,63URM0$1+&LVW2FWREHU

7ZRVWDJHVHFXULW\FRQWUROVVHOHFWLRQ ,U\QD@FRQGXFWHGE\3Z&IRU8.JRYHUQPHQWUHSRUWHGWKDWRI ODUJHDQGRIVPDOORUJDQL]DWLRQVVXIIHUHGVHFXULW\EUHDFKHVLQDQLQFUHDVHIURPWKHSUHYLRXV\HDUIURP DQGUHVSHFWLYHO\7KHDYHUDJHZRUVWVLQJOHVHFXULW\EUHDFKFRVWZHQWXSIURP…N…PLQWR…P …PLQIRUDODUJHRUJDQL]DWLRQDQGIURP…N…NLQWR…N…NLQIRUDVPDOOEXVLQHVV RIUHVSRQGHQWVH[SHFWDQLQFUHDVHRIVHFXULW\LQFLGHQWVLQWKHXSFRPLQJ\HDUVVXJJHVWLQJDQLQFUHDVHLQVHFXULW\ EXGJHWVWRSUHYHQWDQGWRPLWLJDWHVHFXULW\EUHDFKHV6LPLODUWUHQGVDUHUHSRUWHGIRUEXVLQHVVHVLQWKH86VHHHJ 3RQHPRQ,QVWLWXWHUHSRUW>@ ,QWKLVFRQWH[WFRPSDQLHVIDFHDWOHDVWWZRSUREOHPV)LUVWO\WRGHFLGHRQWKHEXGJHWIRUVHFXUHIXQFWLRQLQJRIWKH FRPSDQ\ VHFRQGO\ WRGLYLGH WKH EXGJHW DPRQJ VHFXULW\ FRQWUROV WREX\ DQG WRXSGDWH $QRWKHU LQWHUHVWLQJ LVVXH ZKLFKLVEH\RQGWKHVFRSHRIWKLVSDSHULVKRZWRDFWLQWKHFDVHRIDEUHDFKZKLFKFRXQWHUPHDVXUHVWRDSSO\ZKHQ DQDWWDFNKDSSHQVDQGKRZWRSHUIRUPLQFLGHQWUHVSRQVHPRVWHIILFLHQWO\ 7KH SUREOHP RI FKRRVLQJ D EXGJHW WR EH VSHQW LV D PDQDJHPHQW GHFLVLRQ XVXDOO\ PDGH E\ WKH ERDUG RI GLUHFWRUVRZQHUVRIFRPSDQ\WRJHWKHUDQGLVLQIRUPHGE\&KLHI,QIRUPDWLRQ6HFXULW\2IILFHU&,62 7KHGHFLVLRQ PDNLQJLQYROYHVHVWLPDWLQJULVNVUHODWHGWRSRWHQWLDODWWDFNVDQGVHFXULW\EUHDFKHVDQGFRQVLGHULQJKRZZHOORWKHU FRPSHWLWRUFRPSDQLHVDUHSURWHFWHG,QEXVLQHVVLWLVEHOLHYHGWKDWLWLVHQRXJKWREHSURWHFWHGVOLJKWO\EHWWHUWKDQ FRPSHWLWRUVLQRUGHUWRUHGXFHWKHFKDQFHVRIEHLQJDWWDFNHGVLQFHDWWDFNHUVVHDUFKIRUHDVLHVWWDUJHWV>@ 7KHSUREOHPRIDOORFDWLQJEXGJHWEHWZHHQGLIIHUHQWVHFXULW\FRQWUROVLVVROYHGE\WKH&,62ZKRXVXDOO\IROORZV VHFXULW\SROLFLHVRIWKHFRPSDQ\DQGH[LVWLQJVWDQGDUGVIRUULVNDVVHVVPHQWHJ>@'HFLVLRQVDERXWZKLFKFRQWUROV WREX\ZRXOGW\SLFDOO\EHGRQHZLWKDOLPLWHGEXGJHWDQGLWLVQRWSRVVLEOHWREX\DOODYDLODEOHFRQWUROV ([LVWLQJULVNDVVHVVPHQWPRGHOVDUHEDVHGRQTXDOLWDWLYHRUTXDQWLWDWLYHDQDO\VLVRUVRPHFRPELQDWLRQRIERWK)RU LQVWDQFHLQWHUQDWLRQDOVWDQGDUGV,62,(&>@DQG1,67>@SURYLGHJHQHUDOUHFRPPHQGDWLRQVIRUTXDOLWDWLYH ULVNDVVHVVPHQW,Q>@ERWKDSSURDFKHVDUHXVHGTXDOLWDWLYHIRULGHQWLI\LQJJURXSVRIDWWDFNHUVRUDVVLJQLQJOHYHOVRI DWWDFNVHYHULW\ DQGTXDQWLWDWLYHIRUPHDVXULQJHIILFLHQF\RIFRXQWHUPHDVXUHVDJDLQVWYDULRXVWKUHDWVDQGWKHLUFRVW  %RWKRIWKHLQGLFDWHGSUREOHPVKDYHEHHQDGGUHVVHGLQWKHOLWHUDWXUHEXWQRWVROYHGWRJHWKHU5HFHQWDSSURDFKHVWR ULVNDVVHVVPHQWDQGSODQQLQJDGGUHVVPLQLPL]LQJVHFXULW\ULVNDQGEXGJHWIRUFRQWUROVVLPXOWDQHRXVO\>@DSSO\LQJ ILQDQFLDO PRGHOOLQJ IRU ULVN DVVHVVPHQW >@ SODQQLQJ XQGHU XQFHUWDLQW\ IRU KLJK LPSDFW HYHQWV >@ IRUPXODWLQJ EXGJHWDOORFDWLRQDVDPXOWLSOHNQDSVDFNSUREOHP>@,QRXUSUHYLRXVZRUN>@VHYHUDODOWHUQDWLYHIRUPXODWLRQV IRUVHOHFWLQJWKHRSWLPDOVXEVHWRIVHFXULW\FRQWUROVZHUHVXJJHVWHG ,QWKLVSDSHUZHH[WHQGZRUNVWDUWHGLQ>@DQGDGGUHVVWZRVWDJHVRIVHFXULW\FRQWUROVVHOHFWLRQSUREOHPWKH VHFXULW\EXGJHWLQJDQGVHOHFWLRQRIVHFXULW\FRQWUROVJLYHQVXFKEXGJHW,Q6HFWLRQVWDWHRIWKHDUWDSSURDFKHVDUH FRQVLGHUHGIRUERWKLQGLFDWHGSUREOHPVDQGLQ6HFWLRQZHSURSRVHRXUDSSURDFKWRVROYLQJWKHVHSUREOHPV7KH SUHVHQWHGDSSURDFKLVLOOXVWUDWHGZLWKDQH[DPSOHLQ6HFWLRQ:HGUDZFRQFOXVLRQVDQGLQGLFDWHIXWXUHGLUHFWLRQVIRU WKLVZRUNLQ6HFWLRQ

973

Iryna Yevseyeva et al. / Procedia Computer Science 100 (2016) 971 – 978

%XGJHWDQGVHFXULW\FRQWUROVVHOHFWLRQ 2QHRIWKHPDLQFKDOOHQJHVLQWKHVHFXULW\LQGXVWU\LVWKHGLIILFXOW\RIGHPRQVWUDWLQJDQGTXDQWLI\LQJWKHEHQHILWRI VHFXULW\ LQYHVWPHQWV WR FRQYLQFH PDQDJHUV WR LQYHVW LQ VHFXULW\ 7KH GLIILFXOWLHV LQ GHILQLQJ F\EHUVHFXULW\ FUHDWH FRQIXVLRQDQGDODFNRISXEOLFXQGHUVWDQGLQJRIF\EHUVHFXULW\WKUHDWV>@+HQFHSRWHQWLDOUHVLVWDQFHRIPDQDJHUV WRLQYHVWLQWRF\EHUVHFXULW\PD\EHUHODWHGWRVXFKOXFNRIXQGHUVWDQGLQJ7RKHOSPDQDJHUVWRPDNHLQIRUPHGGHFLVLRQ DERXWWKHVHFXULW\EXGJHWVHYHUDOHGXFDWLRQDOVHVVLRQVDERXWVHFXULW\WKUHDWVPD\EHRUJDQL]HG,QWKLVVHFWLRQDQ DSSURDFKIRUKHOSLQJPDQDJHUVRQVHFXULW\EXGJHWVHOHFWLRQDQGLWVDOORFDWLRQEHWZHHQVHFXULW\FRQWUROVLVSURSRVHG EDVHGRQSRUWIROLRVHOHFWLRQSUREOHPZHOONQRZQLQILQDQFLDOPDQDJHPHQW 2.1. Budget selection ,QEXGJHWVHOHFWLRQRQHFRQVLGHUVVHFXULQJDFRPSDQ\DVDUHZDUGLQJDFWLYLW\HJE\YLHZLQJORVVSUHYHQWLRQZLWK VHFXULW\FRQWUROVDVJDLQVUHODWLYHWRDEDVHOLQHZLWKRXWWKHP 6XFKDFWLYLW\UHTXLUHVVRPHUHVRXUFHVDQGOHDGVWR SRWHQWLDOO\ SUHYHQWLRQ RI VHULRXV ORVV HJ LQ FDVH LI KLJKO\ LPSUREDEOH EXW YHU\ GDPDJLQJ QHZ W\SH RI DWWDFN LV SUHYHQWHGVDYLQJWKHFRPSDQ\IURPKLJKORVVHVRUHYHQEDQNUXSWF\:HEHOLHYHWKDWWKLVYLHZSRLQWZLOOKHOSPDQDJHUV ZKHQDOORFDWLQJVHFXULW\EXGJHWDQGILQGVHFXULW\LQYHVWPHQWDVSRWHQWLDOO\SURILWDEOH+HQFHLQWKHVHVHWWLQJVWKHUH ZLOODOZD\VEHVRPHVHFXULW\EXGJHWWKDWWKHFRPSDQ\ZDQWVWRVSHQGIRUVHFXULW\+RZHYHUWKHUHZLOOVWLOOEHWKH TXHVWLRQZKLFKLVWKHEHVWYDOXHIRULWWDNLQJLQWRDFFRXQWVL]HRIWKHFRPSDQ\LWVDFWLYLW\KRZPXFKWKHFRPSDQ\ LQYHVWHG LQWRVHFXULW\EHIRUHDQGKRZ PXFK LW ZDQWV WR VSHQG IRUXSGDWLQJROGDQGEX\LQJQHZ VHFXULW\ FRQWUROV &XUUHQWO\PRVW&,62VPDQDJHUVORRNDWRWKHUFRPSDQLHVDQGLPSOHPHQWVLPLODUWRFRPSHWLWRUV¶VHFXULW\PHDVXUHV >@,WLVDOVREHOLHYHGWKDWLWLVHQRXJKWREHSURWHFWHGVOLJKWO\EHWWHUWKDQFRPSHWLWRUVWREHRXWRIWKHDWWDFNHUVIRFXV 7KHUHPLJKWEHFRQIOLFWVRIRSLQLRQVEHWZHHQGLIIHUHQWPDQDJHUVDQGRU&,62ZKLFKPDNHDJUHHLQJDERXWWKH EXGJHWRIWKHFRPSDQ\GLIILFXOW6ROXWLRQVIRUWKLVSUREOHPFDQEHIRXQGZLWKWKHKHOSRIJURXSGHFLVLRQPDNLQJ DSSURDFKHVVHHHJ>@$IWHUWKHEXGJHWIRUSURWHFWLQJFRPSDQ\IURPSRWHQWLDODWWDFNVLVFKRVHQE\WRSPDQDJHUV &,62KDVWRPDNHGHFLVLRQVDERXWKRZWRVSHQGWKHDOORFDWHGEXGJHWZLVHO\ 2.2. Traditional security risk $ODUJHQXPEHURISRWHQWLDOWKUHDWVH[LVWWKDWPLJKWKDSSHQZLWKVRPHSUREDELOLW\WRDQ\FRPSDQ\JRYHUQPHQWDO RUJDQL]DWLRQ RU LQGLYLGXDOV 6HFXULW\ H[SHUWV FDQ VXEMHFWLYHO\HYDOXDWH WKH SUREDELOLW\ RU OLNHOLKRRG RI HDFK WKUHDW EDVHGRQWKHLUH[SHULHQFHDQGNQRZOHGJHRIUHFHQWWKUHDWVDQGDWWDFNVE\DQDO\]LQJH[LVWLQJYXOQHUDELOLWLHVRIYDOXDEOH FRPSDQ\¶VDVVHWV,QDGGLWLRQWRWKHSUREDELOLW\OLNHOLKRRGRIDWKUHDWDW\SLFDOULVNDVVHVVPHQWSURFHGXUHZLOOWDNH LQWRDFFRXQWWKHLPSDFWRIH[SORLWDWLRQ 7KHPRVWFRPPRQZD\&,62VWDNHWRSHUIRUPULVNDVVHVVPHQWRIWKHFRPSDQ\LVE\DVVHVVLQJH[SHFWHGORVVYDOXH 7KHLQLWLDOORVVYDOXHLZKHQQRVHFXULW\FRQWUROVDUHDSSOLHGFDQEHFRPSXWHGHJVLPLODUO\WR>@E\DQDO\]LQJ H[LVWLQJ YXOQHUDELOLWLHV RI WKH FRPSDQ\¶V DVVHWV Vi  ^` HVWLPDWLQJ SUREDELOLWLHVOLNHOLKRRG pij  >@ RI H[SORLWLQJYXOQHUDELOLWLHVViYLDSRWHQWLDOWKUHDWVTj  ^`DQGLPSDFWRIVXFKH[SORLWDWLRQVIi  ^`ZKHUH i={1,…,n}DQGj={1,…,m}LQGLFDWHYXOQHUDELOLWLHVDQGWKUHDWVUHVSHFWLYHO\ m

L

n

¦¦ p

ij

j  i 

˜Vi ˜I i  

















 

,QYHVWPHQWLQWKHVHFXULW\EXGJHWVKRXOGEHGRQHLQVXFKDZD\WRPLQLPL]HSRWHQWLDOORVVHV7RVSHQGWKHDYDLODEOH EXGJHWBIURPDOODYDLODEOHFRQWUROVl={1,…,k}VRPHVKRXOGEHVHOHFWHGWREHERXJKWxl  ^`ZKHUHVWDQGVIRU VHOHFWLQJlWKFRQWUROWREHERXJKWDQGIRUQRWVHOHFWLQJ DQGOHDGLQJWRLQWHJHUIRUPXODWLRQRIWKHSRUWIROLRVHOHFWLRQ SUREOHP ZKHQ FRPSDUHG WR VWDQGDUG FRQWLQXRXV  /HW x GHQRWH WKH FKRLFH RI VXEVHW RI FRQWUROV HJ x                       T PHDQVWKDWx2DQGx5FRQWUROVDUHVHOHFWHGERXJKW  )RUWKLVWKH&,62KDVWRHYDOXDWHKRZZHOOHDFKFRQWUROxlSURWHFWVHDFKYXOQHUDELOLW\Vi.6HH7DEOHIRUVXFKYDOXHV tli  ^`DVVXJJHVWHGLQ>@1RWHWKDWQHJDWLYHYDOXHVRItliVKRZWKDWQHZULVNVDUHLQWURGXFHGE\XVLQJ FRQWUROtli LIFRQWUROxlLVQRWFRYHULQJYXOQHUDELOLW\Vi, DQGFRPSOHWHFRYHUZLWKtli 

974

Iryna Yevseyeva et al. / Procedia Computer Science 100 (2016) 971 – 978

l

Px

m

n

¦ ¦¦ p

ij

k  j  j 

˜Vi ˜ I i ˜ tli ˜ xl  















7KHWRWDOFRVWCLVXVXDOO\FRPSRVHGIURPGLUHFWDQGLQGLUHFWFRVWVRIVHFXULW\FRQWUROVIRUEX\LQJDQGPDLQWDLQLQJ WKHPUHVSHFWLYHO\ ZKHUHclLVWKHFRVWRIWKHVHFXULW\FRQWURO xl k

Cx

¦ x ˜ c  l

l



















 

l 

7KHQVXFKVXEVHWRIVHFXULW\FRQWUROVKDVWREHVHOHFWHGWKDWPLQLPL]HVWKHWRWDOORVVULVNDIWHUDSSO\LQJFRQWUROV Rx L  Px WDNLQJLQWRDFFRXQWFRQVWUDLQHGEXGJHWB            PLQ Rx stCx d B xl +RZHYHULWLVQRWDOZD\VSRVVLEOHWRHYDOXDWHVHFXULW\LQWHUPVRIUHGXFLQJULVNRISRWHQWLDOORVVHVDQGYLHZ WKHVHORVVHVLQGHSHQGHQWO\IURPHDFKRWKHU+HUHZHVXJJHVWDQDOWHUQDWLYHYLHZWKDWFRQVLGHUVSUHYHQWLRQRIORVVHV DVJDLQVUHODWLYHWRWKHEDVHOLQHRIQRWLQYHVWLQJLQVHFXULW\7KLVFKDQJHRIYLHZDOORZVXVWRFRQVLGHUWKHVHOHFWLRQ RIVHFXULW\FRQWUROVDVZHOODVWKHEXGJHWDOORFDWLRQSUREOHPDVDQLQYHVWPHQWSRUWIROLRRSWLPL]DWLRQSUREOHPZLWK SRVLWLYHUHWXUQRQLQYHVWPHQWDQGYDULDQFHRIUHWXUQRQLQYHVWPHQWV 2.3. Security risk vs. rewarding security :HSURSRVHWRDSSURDFKLQYHVWPHQWLQWRVHFXULW\DVDSURILWDEOHDFWLYLW\WKDWZRXOGHQFRXUDJHPDQDJHUVWRLQYHVW LQWR$QH[DPSOHRISURILWDEOHLQYHVWPHQWLQWRVHFXULW\FDQEHFRQVLGHUHGZKHQDQDWWDFNKDVEHHQSUHYHQWHGE\RQH RIFRPSDQ\¶VHPSOR\HHVVXFKSUHYHQWLRQFDQDOVREHVHHQDVDJDLQIRUWKHFRPSDQ\VLQFHELJORVVKDVEHHQSUHYHQWHG 7KHQLQYHVWLQJWLPHHIIRUWDQGRWKHUUHVRXUFHVQHHGHGIRUGHWHFWLRQDQGSUHYHQWLRQRIDQDWWDFNLVVHHQDVQHFHVVDU\ VSHQGLQJLQYHVWPHQWIRUDYRLGLQJSRWHQWLDOO\ELJORVVHV ,Q WKH DERYHGLVFXVVHG VHWWLQJV &,62 LV LQWHUHVWHG LQ DOORFDWLQJ WKH DYDLODEOH EXGJHW LQWR EHVW FRQWUROV LH WKH FRQWUROVZLWKPD[LPDOWRWDOHIILFLHQF\RISURWHFWLQJWKHFRPSDQ\DJDLQVWDVPDQ\DVSRVVLEOHNQRZQDQGGHVLUDEO\ XQNQRZQSRWHQWLDOWKUHDWV7KLVZLOOPD[LPL]HWKHH[SHFWHGUHWXUQRUJDLQIURPWKHLQYHVWPHQW1RWHWKDWFRQWUROV ZLWK KLJK SURWHFWLRQ HIILFLHQF\ DJDLQVW SRWHQWLDOO\ DV PDQ\ WKUHDWV DV SRVVLEOH DUH SUHIHUUHG WR WKRVH ZLWK ORZ SURWHFWLRQHIILFLHQF\DJDLQVWVPDOOHUQXPEHURIWKUHDWV+HQFHFRYHUDJHRIDVPDQ\DVSRVVLEOHWKUHDWVLVHQFRXUDJHG LQWULQVLFDOO\ZLWKLQLQGLYLGXDOFRQWUROV¶HIILFLHQF\E\FRYHULQJPDQ\WKUHDWV 7KHQH[SHFWHGUHWXUQZKLFKLVQRW QHFHVVDU\ PRQHWDU\ RI D VHWRI VHFXULW\ FRQWUROV FDQEH FRPSXWHG DV WKH GLIIHUHQFHEHWZHHQ JDLQVREWDLQHGIURP LPSOHPHQWLQJFRQWUROVDQGWKHLUFRVWV            Ex Gx  Cx   7KHUHDUHGLIIHUHQWZD\VWRGHILQHJDLQ)RULQVWDQFHLWFDQEHWDNHQDVP(x)GHILQHGE\ 7KHODUJHUWKHYDOXHRI WKHH[SHFWHGJDLQWKHEHWWHUWKHFRPSDQ\LVSURWHFWHGIURPSRWHQWLDOWKUHDWVDQGDVXEVHWRIVHFXULW\FRQWUROVxlZKLFK PD[LPL]HVJDLQVKRXOGEHVHOHFWHG 2.4. Diverse controls selection $WWKHVDPHWLPHWKUHDWVFRYHUDJHFDQDOVREHWDNHQLQWRDFFRXQWH[WULQVLFDOO\E\FRPSDULQJKRZGLIIHUHQWVHWVRI FRQWUROVFRYHUVHWVRIWKUHDWV7UDGLWLRQDOO\LQILQDQFLDOZRUOGLQYHVWLQJLQWRVLPLODUILQDQFLDODVVHWVLVULVN\>@VLQFH VLPLODUDVVHWVRULQGXVWULHVPLJKWORRVHWKHLUYDOXHIRUWKHVDPHUHDVRQVHJRLODQGJDVEHFRPHVFKHDSHUGXHWRQHZ W\SHVRIHQHUJ\SURGXFWLRQDGYDQFHVVRLQYHVWLQJLQRQO\WKRVHWZRLQGXVWULHVLVULVN\6LPLODUO\ZKHQVHOHFWLQJVHYHUDO VSHFLHV RI ELRORJLFDO SRSXODWLRQ IRU IXWXUH SUHVHUYDWLRQ HJ VHYHUDO SODQWV VSHFLHV IRU WKHLU SRWHQWLDO IXWXUH \HW XQNQRZQ SKDUPDFHXWLFDOEHQHILWLWLVLPSRUWDQWWRVHOHFWDVGLYHUVHVSHFLHVDVSRVVLEOH>@

975

Iryna Yevseyeva et al. / Procedia Computer Science 100 (2016) 971 – 978

,QVHFXULW\WRDFFRXQWIRUGLYHUVLW\ LWLVDVVXPHGWKDWFRQWUROVRIWKHVDPHW\SHNLQGZRXOGSURYLGHSURWHFWLRQ DJDLQVWVLPLODUW\SHRIWKUHDWV7KHQLQRUGHUWRSURWHFWDFRPSDQ\IURPYDULRXVWKUHDWVYDULRXVRUGLYHUVHW\SHVRI FRQWUROVVKRXOGEHVHOHFWHGDQGVHOHFWLQJVLPLODURQHVLVFRQVLGHUHGWREHULVN\)ROORZLQJWKHFODVVLFDOILQDQFLDOPRGHO RI0DUNRZLW]>@WKHULVN V x FDQEHH[SUHVVHGLQWHUPVRIWKHFRYDULDQFHPDWUL[QDVIROORZV k

V  x

k

m

¦¦¦ x ˜ q l

lsi

˜ xs 











l  s  i 







 

$VDERYHxGHQRWHVWKHFKRLFHRIVXEVHWRIFRQWUROV(DFKHOHPHQWqlsiRIPDWUL[QUHSUHVHQWVKRZVLPLODUDUHWZR FRQWUROVxlDQGxRQYXOQHUDELOLW\Vi,WVKRXOGEHSRVVLEOHIRU&,62WRHYDOXDWHFRYDULDQFHVLPLODULW\ YDOXHVqlsi EDVHGRQSDLUZLVHFRPSDULVRQRIFRQWUROV1RWHWKDWQHJDWLYHFRYDULDQFHHJqlsi ± VKRZVGLVVLPLODULW\EHWZHHQ FRQWUROVDQGLVSUHIHUDEOHFRQWUDU\WRSRVLWLYHFRYDULDQFHHJqlsi  ZKLFKVKRXOGEHDYRLGHGDQGULVNWHUP V x LVWREHPLQLPL]HG 7KHQ VXFK D VXEVHW RI VHFXULW\ FRQWUROV KDV WR EH VHOHFWHG WKDW PD[LPL]HV WKH H[SHFWHG UHWXUQ IURP DSSO\LQJ VHOHFWHGFRQWUROV Ex DQGPLQLPL]HVULVNRIVHOHFWLQJVLPLODUFRQWUROV V x VLPXOWDQHRXVO\WDNLQJLQWRDFFRXQW OLPLWHGEXGJHW  PD[ E  x and PLQ V  x s t C  x d B         1RWHWKDWWKHUHPD\EHVHYHUDORIVXFKRSWLPDOVXEVHWVVHOHFWLQJRQHDPRQJZKLFKLVQRWWULYLDO 2.5. Risk-to-Return trade-offs for different budgets 2SWLPL]LQJ OHDGVWRILQGLQJQRWDVLQJOHEXWPXOWLSOHVRFDOOHG3DUHWRRSWLPDOVXEVHWVRIFRQWUROVHDFKRIZKLFK LVEHWWHURQDWOHDVWRQHRIWKHREMHFWLYHVUHWXUQRUULVN DQGQRWZRUVHRQWKHUHVWRIREMHFWLYHV7RVHOHFWRQHVROXWLRQ DPRQJPDQ\YDULRXVDSSURDFKHVFDQEHWDNHQIRULQVWDQFHRQHRIWKHPLVWRILQGDQRSWLPDOUDWLREHWZHHQULVNDQG UHWXUQVXEMHFWWREXGJHWFRQVWUDLQW)RULQVWDQFHUHWXUQWRULVN6KDUSHUDWLRZHOONQRZQLQILQDQFLDOOLWHUDWXUH>@FDQ EHXVHGKHUH

PD[ Sh x

E  x  s t C  x d B  V  x













 

7KHPD[LPL]DWLRQRIWKH6KDUSUDWLRW\SLFDOO\OHDGVWRDVRFDOOHGNQHHSRLQWVROXWLRQRQWKH3DUHWRIURQWZKLFKLV DSRLQWLQZKLFKWKHORVVHVDVFRPSDUHGWRWKHEHVWDWWDLQDEOHYDOXHIRUERWKREMHFWLYHVKHUHH[SHFWHGUHWXUQDQG VWDQGDUGGHYLDWLRQ DUHVPDOO4XDGUDWLFSURJUDPPLQJWHFKQLTXHVFDQEHXVHGWRGHWHUPLQHSRLQWVRQWKH3DUHWRIURQW $PRQJ WKHVH SRLQWV WKH SRLQW ZLWK PD[LPDO 6KDUSH UDWLR FDQ EH IRXQG HLWKHU E\ HQXPHUDWLRQ RU E\ JHRPHWULFDO FRQVWUXFWLRQ)RUWKHODWWHULQGLIIHUHQFHOLQHVFDQEHFRQVWUXFWHGDQGDPRQJWKHPWKHOLQHWDQJHQWLDOWRWKH3DUHWR IURQWLHUWKHVRFDOOHG&DSLWDO$OORFDWLRQ/LQH&$/ GHWHUPLQHVWKHSRLQWZLWKRSWLPDO6KDUSUDWLRRQWKH3DUHWR IURQW ([SHULPHQWDOUHVXOWV 1H[WZHH[HPSOLI\WKLVVWUDWHJ\E\PHDQVRIDUHDOLVWLFH[DPSOH7KHVFHQDULRDQGGDWDDUHWDNHQIURP>@ SRVVLEOHVHFXULW\FRQWUROVFDQEHDSSOLHGDOORIZKLFKZLWKDVSHFLILFFRVWDQGSURWHFWLQJPRUHRUOHVVHIIHFWLYHO\IRU DFHUWDLQVHWRIVHFXULW\YXOQHUDELOLWLHV0RUHRYHULQVRPHFDVHVWKH\KDYHDQDYHUVHHIIHFWRQWKHSURWHFWLRQHJ ZKLOHSURWHFWLQJIRURQHW\SHRIYXOQHUDELOLW\RSHQLQJXSWKHSRVVLELOLW\RIFHUWDLQRWKHUW\SHVRIYXOQHUDELOLWLHV $VVWDWHGDERYHWKHVHOHFWLRQRIFRQWUROVLVPRGHOHGE\PHDQVRIDELQDU\GHFLVLRQYHFWRUDQGWKHDLPLVWRILQG WKHRSWLPDOVHOHFWLRQZLWKUHVSHFWWRWKH6KDUSHUDWLR5HFDOOWKHH[SHFWHGUHWXUQE(x)LVWKHH[SHFWHGJDLQG(x)PLQXV FRVWC(x),QWKLVH[DPSOHDVLPSOLILHGYHUVLRQRIJDLQLVFRQVLGHUHG,WLVDVVXPHGWKDWLIFRQWUROxlLVVHOHFWHGWKHJDLQ ZLOOEHWKHVXPRIDOOYXOQHUDELOLW\LPSDFWVIiWLPHVWKHHIIHFWLYHQHVVtilPDWFKLQJ RIFRQWUROxlRQYXOQHUDELOLW\Vi 7KHSUHFLVHGDWDFDQEHREWDLQHGIURP7DEOHV

976

Iryna Yevseyeva et al. / Procedia Computer Science 100 (2016) 971 – 978

7DEOH,PSDFWRI9XOQHUDELOLWLHV

ͳ

9XOQHUDELOLW\ ,PSDFWRQ&,$ ,PSDFWIi …

333 

ʹ 333 

͵ &&& 

Ͷ 333 

ͷ 333 

͸ 113 

͹ 333 

ͺ &&& 

ͻ 333 

ͳͲ &&& 

7DEOH&RVWVRIFRQWUROVFRXQWHUPHDVXUHV  &RQWURO[O  &RVW…

x1 

x2 

&RQWURO‫ݔ‬௟  &RVW…

x13 

x14 

x3 

x4 

x5 

x6 

x7 

x8 

x9 

x10 

x11 

x12 

 x15 

x16 

x17 

x18 

x19 

x20 

x21 

x22 

x23 

x24 

7DEOH(IIHFWLYHQHVVRIVHFXULW\FRQWUROV¶SURWHFWLRQRIYXOQHUDELOLWLHV            &RQWUROV xl 

tli x1 x2 x3 x4 x5 x6 x7 x8 x9 x10 x11 x12 x13 x14 x15 x16 x17 x18 x19 x20 x21 x22 x23 x24

V1                        

V2                        

V3                        

9XOQHUDELOLWLHVVi  V4 V5                                                

V6                        

V7                        

V8                        

V9                        

V10                        

 

1RZ

Ex Gx  Cx ZLWK Gx

ª 

¦«¦t l 

¬i 

º ˜ I li i » ˜ xl ƒ† Cx ¼



¦C ˜x Ǥ 7KH UHWXUQ RI D VLQJOH l

l

l 

ª  º FRQWUROLVJLYHQE\ rl «¦ tli ˜ I i »  Cl ƒQGWRWDOH[SHFWHGUHWXUQLV E  x  r   r ˜ x Ǥ7KHFRYDULDQFHRIWKH ¬i  ¼ UHWXUQFDQEHFRPSXWHGDV Qls Covtl ˜ I  Cl  tl ˜ I  Cl  ts ˜ I  Cs  t s ˜ I  Cs ZKLFKLV HTXLYDOHQWWR Qls

    ¦¦ tli ˜ I i  Cl  tsi ˜ I i  Cs tlz ˜ I z  Cl  tsz ˜ I z  Cs  n l  s  

*LYHQDPD[LPDOEXGJHWBWKDWFDQEHVSHQWRQFRQWUROVZHFDQVROYHWKH6KDUSHLQGH[RSWLPL]DWLRQSUREOHP

Shx

Gx  Cx  r

V  x



o PD[ s t

¦C ˜ x d B  l

l 

l









 

977

Iryna Yevseyeva et al. / Procedia Computer Science 100 (2016) 971 – 978

ZKHUHr0LVULVNIUHHUHWXUQZKLFKZHDVVXPHKHUHWREHHTXDOWRLHr0  )RUVROYLQJWKHIRUPXODWLRQ ZLWKLQWHJHUYDULDEOHVxl  ^`KHUH0$7/$%TXDGUDWLFVROYHULVXVHG>@ 7KHUHVXOWVDUHVKRZQLQ)LJXUHOHIWDQGULJKW +HUHZHLOOXVWUDWHUHWXUQWRYDULDQFH3DUHWRIURQWDQG0D[LPDO 6KDUSHUDWLRIRUGLIIHUHQWYDULDQFHUHVSHFWLYHO\

 )LJXUH3DUHWRIURQWRIVHFXULW\FRQWUROSRUWIROLRVDQGPD[LPDO6KDUSHUDWLRV

 )LJXUH3DUHWRIURQWRIEXGJHWVYVPD[LPDO6KDUSHUDWLRV

)LJXUHOHIW VKRZVDOVRWKH&DSLWDO$OORFDWLRQ/LQH&$/ ZKLFKLVWDQJHQWLDOWRWKH3DUHWRIURQWLQWKHSRLQW RIWKHPD[LPDO6KDUSHUDWLR7KLVLVFRQILUPHGE\)LJXUHULJKW ZKHUHDWDYDOXHRIDERXW V x =WKHFXUYH UHDFKHVWKHPD[LPDOYDOXHRI6KDUSHUDWLR $QDGYDQWDJHRIDVLQJOHQXPEHUSHUIRUPDQFHLQGH[IRUDEXGJHWDOORFDWLRQDVLWLVSURYLGHGZLWKWKH6KDUSHUDWLR LVWKDWLWFDQEHXVHGIRUVXSSRUWLQJWRSOHYHOGHFLVLRQPDNLQJXVLQJWHFKQLTXHVIURPPXOWLFULWHULDGHFLVLRQPDNLQJ )RUWKLVZHSURSRVHWRFRPSXWHWKH3DUHWRIURQWRIEXGJHWVDQGRSWLPDO6KDUSHUDWLRVWKDWFDQEHDFKLHYHGIRUWKHVH EXGJHWVDQGSUHVHQWWKLVWRWKHWRSOHYHOGHFLVLRQPDNHU+HUH0$7/$%VROYHUZDVXVHGWRFRPSXWH3DUHWRIURQW >@DOWHUQDWLYHH[DFWVROYHUVFRXOGEHXVHG>@7KHSUREOHPFDQEHVROYHGHIILFLHQWO\DVEXGJHWLVDFRQVWDQWDQG GLIIHUHQWYDOXHVRILWFDQEHFKRVHQLQDQLQWHUYDOIURPWRWKHPD[LPDOSRVVLEOHEXGJHW7KHUHDIWHUIRUHDFKEXGJHW WKHPD[LPDO6KDUSHUDWLRLVFRPSXWHGZKLFKJLYHVULVHWRDQDSSUR[LPDWLRQRIWKH3DUHWRIURQW7KHUHVXOWVIRUWKH H[DPSOHDUHVKRZQLQ)LJXUH

978

Iryna Yevseyeva et al. / Procedia Computer Science 100 (2016) 971 – 978

&OHDUO\EXGJHWVDERYH…GRQRWLPSURYHDQ\PRUHWKHSHUIRUPDQFHPHDVXUHGE\6KDUSHUDWLR$VKDUSGURS LQSHUIRUPDQFHLVREVHUYHGIRUYDOXHVEHORZ…7KHDGYLFHZRXOGEHWKDWLQYHVWPHQWVEHORZWKLVYDOXHZRXOG GHWHULRUDWHVHFXULW\SHUIRUPDQFHVLJQLILFDQWO\7KHNQHHSRLQWUHJLRQRQWKH3DUHWRIURQWEHWZHHQ…WRFLUFD …UHSUHVHQWVJRRGFKRLFHVRIVHFXULW\EXGJHWV &RQFOXVLRQ ,Q WKLV UHVHDUFK ZH GLVFXVV WKH SUREOHP RI VHFXULW\ FRQWUROV VHOHFWLRQ IURP D PDQDJHULDO SRLQW RI YLHZ ,W LV DGYRFDWHGWRYLHZWKHLPSOHPHQWDWLRQRIVHFXULW\FRQWUROVDVDSURILWDEOHLQYHVWPHQW%\YLHZLQJWKHVFHQDULRRIQRW XVLQJDQ\VHFXULW\FRQWUROVDVWKHEDVHOLQHVFHQDULRLWLVSRVVLEOHWRDVVLJQSRVLWLYHJDLQVWRVHFXULW\LQYHVWPHQWV ZKLFKSXWVXVLQWRWKHSRVLWLRQWRDSSO\FODVVLFDODQGZHOOHVWDEOLVKHGWRROVIURPILQDQFLDOLQYHVWPHQWWKHRU\WRWKH SUREOHPRIVHOHFWLQJVHFXULW\FRQWUROV7KHVHWRROVEDODQFHULVNDQGUHWXUQLQDQRSWLPDOZD\HJE\PD[LPL]LQJWKH 6KDUSH UDWLR )URP RXU H[DPSOH LW EHFRPHV FOHDU WKDW WKH VWUDWHJ\ FDQ EH LPSOHPHQWHG EDVHG RQ UHDOLVWLF GDWD 0RUHRYHU LW LV HIILFLHQW WR FRPSXWH VXFKSRUWIROLRV DQG LWDOORZV IRU D ZHOOLQIRUPHG PXOWLFULWHULD DVVHVVPHQW RI DOWHUQDWLYHV%HVLGHVRIIHULQJDPHWKRGIRU&,62VWRDOORFDWHDJLYHQEXGJHWWKH3DUHWRIURQWRIWKH6KDUSHUDWLRWR EHPD[LPL]HG WRWKHVHFXULW\EXGJHWWREHPLQLPL]HG FDQEHXVHGWRPDNHGHFLVLRQVRQWKHULJKWEXGJHWDVVLJQHG WRVHFXULW\LQDFRPSDQ\ 5HIHUHQFHV   ,QIRUPDWLRQ VHFXULW\ EUHDFKHV VXUYH\ 3XEOLVKHG LQ 0DUFK  E\ 3:& LQ DVVRFLDWLRQ ZLWK ,QIR6HFXULW\ (XURSH KWWSVZZZSZFFRXNDVVHWVSGILVEVWHFKQLFDOUHSRUWEOXHSGI &RVWRI&\EHU&ULPH6WXG\8QLWHG6WDWHV3XEOLVKHGLQ2FWREHUE\3RQHPRQ,QVWLWXWHKWWSZZZSRQHPRQRUJOLEUDU\FRVWRI F\EHUFULPHXQLWHGVWDWHV +XEHU0%XWWHUPDQQ$7ULJR/'0|OOHU0'RUQEXVFK3=XQGW0HGLWRUV,7VHFXULW\LQJOREDOFRUSRUDWHQHWZRUNV7UHQGUHSRUW &HQWHUIRU'LJLWDO7HFKQRORJ\ 0DUNHW   6WHSV WR F\EHU VHFXULW\ H[HFXWLYH FRPSDQLRQ %,6 3XEOLVKHG RQ  6HSWHPEHU  KWWSVZZZJRYXNJRYHUQPHQWSXEOLFDWLRQVF\EHUULVNPDQDJHPHQWDERDUGOHYHOUHVSRQVLELOLW\  0RELOH 'HYLFHV *XLGH IRU ,PSOHPHQWHUV 3XEOLVKHG LQ )HEUXDU\  0:5 ,QIR6HFXULW\ KWWSVZZZFSQLJRYXN'RFXPHQWV3XEOLFDWLRQV1RQ&31,BSXEVPRELOHBGHYLFHVBJXLGHBIRUBLPSOHPHQWHUVSGI   ,62,(&  ,QIRUPDWLRQ 7HFKQRORJ\ ± 6HFXULW\ 7HFKQLTXHV ± &RGH RI SUDFWLFH IRU LQIRUPDWLRQ VHFXULW\ PDQDJHPHQW  KWWSZZZLVRRUJLVRFDWDORJXHBGHWDLO"FVQXPEHU    1,67 1DWLRQDO YXOQHUDELOLW\ GDWDEDVH DXWRPDWLQJ YXOQHUDELOLW\ PDQDJHPHQW VHFXULW\ PHDVXUHPHQW DQG FRPSOLDQFH FKHFNLQJ KWWSQYGQLVWJRYKRPHFIP 7KRPDV/1RUPDQ5LVN$QDO\VLVDQG6HFXULW\&RXQWHUPHDVXUH6HOHFWLRQQGHG%RFD5DWRQ&5&3UHVV7D\ORUDQG)UDQFLV*URXS 0DUNRZLW]+3RUWIROLRVHOHFWLRQJournal of Finance   6RORZ$3RODVN\60HDVXULQJELRORJLFDOGLYHUVLW\Environmental and Ecological Statistics  6DZLN76HOHFWLRQRIRSWLPDOFRXQWHUPHDVXUHSRUWIROLRLQ,7VHFXULW\SODQQLQJDecision Support Systems   9LGXWR 9 0DSOH & +XDQJ : /ySH]3HUp] ' $ QRYHO ULVN DVVHVVPHQW DQG RSWLPLVDWLRQ PRGHO IRU D PXOWLREMHFWLYH QHWZRUN VHFXULW\ FRXQWHUPHDVXUHVHOHFWLRQSUREOHPDecision Support Systems  6KDUSH:)7KH6KDUSHUDWLRThe journal of portfolio management  %HOWRQ96WHZDUW70XOWLSOH&ULWHULD'HFLVLRQ$QDO\VLV$Q,QWHJUDWHG$SSURDFK.OXZHU$FDGHPLF3XEOLVKHUV'RUGUHFKW 5DNHV75'HDQH-.5HHV/3,7VHFXULW\SODQQLQJXQGHUXQFHUWDLQW\IRUKLJKLPSDFWHYHQWVOmega  6PHUDOGL)0DODFDULD3+RZWRVSHQGLWRSWLPDOLQYHVWPHQWIRUF\EHUVHFXULW\,Q3URFHHGLQJVRIWKHVW,QWHUQDWLRQDO:RUNVKRSRQ$JHQWV DQG&\EHU6HFXULW\$&\6(  $&01HZ