2015 princeton quant trading conference, future of finance: cyber finance

Future of Finance Beyond Flash BoysRisk Modeling for Managing Uncertainty

in an Increasingly Non-Deterministic Cyber Worldwww.FutureOfFinance.org

[1]Copyright, Yogesh Malhotra,

PhD, 2015www.yogeshmalhotra.

com

Princeton Quant Trading Conference 2015 @ , April 04, 2015

Conference sponsors include:

Knight Reconsidered: Risk, Uncertainty, and Profit for the Cyber Era:Future of Finance: Cyber-Finance?:

Uncertainty Modeling & Model Risk Management

YogiYogesh Malhotra

PhD, MSQF, MSCS, MSNCS, MSAcc, MBAEco BE, CEng, CISSP, CISA, CEH, CCP/CDP

www.yogeshmalhotra.com (646) 770-7993 [email protected]

Global Risk Management Network, LLC757 Warren Road, Cornell Business & Technology Park, Ithaca, NY 14852-4892

http://www.FutureOfFinance.org/Princeton.ppsx





com



Knight’s Risk, Uncertainty, and Profit of 1921 - Emergence of the World Wide Web in early-1990s, - Derman’s Model Risk Management, Goldman Sachs,

mid-late-1990s,- Backlash against quantitative models after Financial

Crisis, 2008,- Basel to Consider Risk Metrics other than VaR, Feb 2012,

- Post-Snowden Cyber era starting May 2013... Information-based view of Financial risk modeling practices, - Exponentially increasing Cyber era uncertainty, - Cyber-Finance, the emerging Future of Finance? - Risk modeling focus on metaphorical ‘tip’ of the iceberg,- Significant risks not readily meet the human eye. - Cyber-risk, the predominant risk… subsumes traditional

risks.





com



Exponentially increasing tail risks and systemic risks- Characterize highly systemic, interdependent, correlated

Cyber-risks - Cyber risks in turn characterize financial risks. Based on research of two-decades - Starting around the emergence of the WWW (1993),

Philosophy of IS - How to ‘anticipate surprise’ when ‘prediction’ of

risk is infeasible,- Wall Street Chief Risk Officers, Top Investment Bank CxOs,

Fed/OCC - http://www.yogeshmalhotra.com/blackswans.html

- Explore advances in quantitative risk models, statistical methodologies, and, computational statistical technologies

Facilitate dialog on the above issues of central concern - Future of Finance - Future of Risk.

http://www.yogeshmalhotra.com/blackswans.html







com



SSRN Top-10 Papers: 20 Quantitative Finance-Risk Analytics Top-10 Rankings in recent 11 Weeks:1. Beyond ‘Bayesian vs. VaR’ Dilemma to Empirical Model Risk Management:

How to Manage Risk (After Risk Management Has Failed) for Hedge Funds (Malhotra 2014).

2. Risk, Uncertainty, and Profit for the Cyber Era: Model Risk Management of Cyber Insurance Models Using Quantitative Finance & Advanced Analytics (Malhotra 2015).

3. Markov Chain Monte Carlo Models, Gibbs Sampling & Metropolis Algorithm for High-Dimensionality Complex Stochastic Problems (Malhotra 2014).

4. Extending Above Observations to High Frequency Trading: FIX, FAST (Beyond ‘Flash Boys’).

5. A Risk Management Framework for Penetration Testing of Global Banking & Finance Networks VoIP Protocols (Malhotra 2014).

6. Future of Bitcoin & Statistical Probabilistic Quantitative Methods: Interview, Hong Kong Institute of CPAs (Malhotra 2014).

7. Bitcoin Protocol: Model of ‘Cryptographic Proof’ Based Global Crypto-Currency & Electronic Payments Systems (Malhotra 2013).

8. Cryptology Beyond Shannon's Information Theory: Number Field Sieve Cryptanalysis Algorithms for Most Efficient Prime Factorization on Composites (Malhotra 2013).

9. Quantum Computing, Quantum Cryptography, Shannon’s Entropy and Next Generation Encryption & Decryption (Malhotra 2013)… One more reference about Shannon’s Information Theory (Malhotra 2001)





com



How to Manage Risk (After Risk Management Has Failed) Fall 2010 Vol. 52 Bayesian modeling instead of VaR would minimize risk management failures - Given key role of ‘subjective judgment’ in the Bayesian methodology

Beyond ‘Bayesian vs. VaR’ Dilemma to Empirical Model Risk Management: How to Manage Risk (After Risk Management Has Failed) for Hedge Funds (Malhotra 2014)http://papers.ssrn.com/sol3/papers.cfm?abstract_id=2538401 - Subjective judgment … Bayesian priors… key limitation of Bayesian methodology- Since before the Crisis, non-Bayesian and Bayesian VaR models in Finance practice- Bayesian vs. VaR dilemma needs to be resolved - To minimize model specification and estimation errors.- Model Risk Management is crucial for VaR, Bayesian, and

Bayesian VaR

http://papers.ssrn.com/sol3/papers.cfm?abstract_id=2538401






com



Beyond ‘Bayesian vs. VaR’ Dilemma to Empirical Model Risk Management: How to Manage Risk (After Risk Management Has Failed) for Hedge Funds, 2014.

Examples of Multi-Portfolio Asset Classes Modeled Developed Large Equity Developed Small Equity Emerging Market Equity Listed Private Equity Various Commodities Government Bonds Investment Grade Bonds Inflation-Linked Bonds High Yield Corporate Bonds

Emerging Market Hard Currency Bonds Emerging Market Local Currency Bonds Major Currencies Statistical Arbitrage Hedge Fund Event Driven Hedge Fund

(HFRIEDI) Equity Hedge Fund

(HFRIEHI) Merger Arbitrage Hedge Fund Macro Strategy Hedge Fund Relative Value Hedge FundAdvancing upon: Measuring & Managing Financial Risks with Improved Alternatives Beyond

Value-At-Risk (VaR), Jan. 26, 2012. http://www.yogeshmalhotra.com/BeyondVaR_YogeshMalhotra.pdf

http://www.yogeshmalhotra.com/BeyondVaR_YogeshMalhotra.pdf





com



Beyond ‘Bayesian vs. VaR’ Dilemma to Empirical Model Risk Management: How to Manage Risk (After Risk Management Has Failed) for Hedge Funds





com






[10

]Copyright, Yogesh Malhotra,


com






[11



com




Historical Simulation VaR

Parametric VaR

Modified VaR

Expected Shortfall

05

101520253035404550

-220

0000

0-2

1000

000

-200

0000

0-1

9000

000

-180

0000

0-1

7000

000

-160

0000

0-1

5000

000

-140

0000

0-1

3000

000

-120

0000

0-1

1000

000

-100

0000

0-9

0000

00-8

0000

00-7

0000

00-6

0000

00-5

0000

00-4

0000

00-3

0000

00-2

0000

00-1

0000

00 010

0000

020

0000

030

0000

040

0000

050

0000

060

0000

070

0000

080

0000

090

0000

010

0000

0011

0000

0012

0000

0013

0000

0014

0000

00

Frequency

Simulated P&L ($)

VaR95% = -$783,190

VaR95% = -$783,190

05

101520253035404550

-220

0000

0-2

1000

000

-200

0000

0-1

9000

000

-180

0000

0-1

7000

000

-160

0000

0-1

5000

000

-140

0000

0-1

3000

000

-120

0000

0-1

1000

000

-100

0000

0-9

0000

00-8

0000

00-7

0000

00-6

0000

00-5

0000

00-4

0000

00-3

0000

00-2

0000

00-1

0000

00 010

0000

020

0000

030

0000

040

0000

050

0000

060

0000

070

0000

080

0000

090

0000

010

0000

0011

0000

0012

0000

0013

0000

0014

0000

00

Frequency

Simulated P&L ($)

VaR95% = -$1,284,507

VaR95% = -$1,284,507

05

101520253035404550

-220

0000

0-2

1000

000

-200

0000

0-1

9000

000

-180

0000

0-1

7000

000

-160

0000

0-1

5000

000

-140

0000

0-1

3000

000

-120

0000

0-1

1000

000

-100

0000

0-9

0000

00-8

0000

00-7

0000

00-6

0000

00-5

0000

00-4

0000

00-3

0000

00-2

0000

00-1

0000

00 010

0000

020

0000

030

0000

040

0000

050

0000

060

0000

070

0000

080

0000

090

0000

010

0000

0011

0000

0012

0000

0013

0000

0014

0000

00

Frequency

Simulated P&L ($)

MVaR95% = -$1,884,524

MVaR95% = -$1,884,524

PORT Index AuM ($) 100,000,000 Confidence Level 95%

Critical Value (z α ) 1.645Monthly VaR 95% ($)

-785,392 -783,190

PORT AuM ($) 100,000,000 Variance (Min.) 0.61

St. Dev. 0.78%Confidence Level 95%

Critical Value (z α ) 1.645

05

101520253035404550

-220

0000

0-2

1000

000

-200

0000

0-1

9000

000

-180

0000

0-1

7000

000

-160

0000

0-1

5000

000

-140

0000

0-1

3000

000

-120

0000

0-1

1000

000

-100

0000

0-9

0000

00-8

0000

00-7

0000

00-6

0000

00-5

0000

00-4

0000

00-3

0000

00-2

0000

00-1

0000

00 010

0000

020

0000

030

0000

040

0000

050

0000

060

0000

070

0000

080

0000

090

0000

010

0000

0011

0000

0012

0000

0013

0000

0014

0000

00

Frequency

Simulated P&L ($)

MVaR95% = -$1,681,629

MVaR95% = -$1,681,629



[12



com





Parametric VaR

Modified VaR

Expected Shortfall

05

101520253035404550

-220

0000

0-2

1000

000

-200

0000

0-1

9000

000

-180

0000

0-1

7000

000

-160

0000

0-1

5000

000

-140

0000

0-1

3000

000

-120

0000

0-1

1000

000

-100

0000

0-9

0000

00-8

0000

00-7

0000

00-6

0000

00-5

0000

00-4

0000

00-3

0000

00-2

0000

00-1

0000

00 010

0000

020

0000

030

0000

040

0000

050

0000

060

0000

070

0000

080

0000

090

0000

010

0000

0011

0000

0012

0000

0013

0000

0014

0000

00

Frequency

Simulated P&L ($)

VaR95% = -$783,190

VaR95% = -$783,190

05

101520253035404550

-220

0000

0-2

1000

000

-200

0000

0-1

9000

000

-180

0000

0-1

7000

000

-160

0000

0-1

5000

000

-140

0000

0-1

3000

000

-120

0000

0-1

1000

000

-100

0000

0-9

0000

00-8

0000

00-7

0000

00-6

0000

00-5

0000

00-4

0000

00-3

0000

00-2

0000

00-1

0000

00 010

0000

020

0000

030

0000

040

0000

050

0000

060

0000

070

0000

080

0000

090

0000

010

0000

0011

0000

0012

0000

0013

0000

0014

0000

00

Frequency

Simulated P&L ($)

VaR95% = -$1,284,507

VaR95% = -$1,284,507

05

101520253035404550

-220

0000

0-2

1000

000

-200

0000

0-1

9000

000

-180

0000

0-1

7000

000

-160

0000

0-1

5000

000

-140

0000

0-1

3000

000

-120

0000

0-1

1000

000

-100

0000

0-9

0000

00-8

0000

00-7

0000

00-6

0000

00-5

0000

00-4

0000

00-3

0000

00-2

0000

00-1

0000

00 010

0000

020

0000

030

0000

040

0000

050

0000

060

0000

070

0000

080

0000

090

0000

010

0000

0011

0000

0012

0000

0013

0000

0014

0000

00

Frequency

Simulated P&L ($)

MVaR95% = -$1,884,524

MVaR95% = -$1,884,524

PORT Index AuM ($) 100,000,000 Mean P&L ($) 533,059

St. Dev. P&L ($) 815,251 Confidence Level 95%


St. Dev. P&L ($) 815,251 Confidence Level 95%

05

101520253035404550

-220

0000

0-2

1000

000

-200

0000

0-1

9000

000

-180

0000

0-1

7000

000

-160

0000

0-1

5000

000

-140

0000

0-1

3000

000

-120

0000

0-1

1000

000

-100

0000

0-9

0000

00-8

0000

00-7

0000

00-6

0000

00-5

0000

00-4

0000

00-3

0000

00-2

0000

00-1

0000

00 010

0000

020

0000

030

0000

040

0000

050

0000

060

0000

070

0000

080

0000

090

0000

010

0000

0011

0000

0012

0000

0013

0000

0014

0000

00

Frequency

Simulated P&L ($)

MVaR95% = -$1,681,629

MVaR95% = -$1,681,629



[13



com






[14



com






[15



com





Parametric VaR

Modified VaR

Expected Shortfall

05

101520253035404550

-220

0000

0-2

1000

000

-200

0000

0-1

9000

000

-180

0000

0-1

7000

000

-160

0000

0-1

5000

000

-140

0000

0-1

3000

000

-120

0000

0-1

1000

000

-100

0000

0-9

0000

00-8

0000

00-7

0000

00-6

0000

00-5

0000

00-4

0000

00-3

0000

00-2

0000

00-1

0000

00 010

0000

020

0000

030

0000

040

0000

050

0000

060

0000

070

0000

080

0000

090

0000

010

0000

0011

0000

0012

0000

0013

0000

0014

0000

00

Frequency

Simulated P&L ($)

VaR95% = -$2,764,562

VaR95% = -$2,764,562

05

101520253035404550

-220

0000

0-2

1000

000

-200

0000

0-1

9000

000

-180

0000

0-1

7000

000

-160

0000

0-1

5000

000

-140

0000

0-1

3000

000

-120

0000

0-1

1000

000

-100

0000

0-9

0000

00-8

0000

00-7

0000

00-6

0000

00-5

0000

00-4

0000

00-3

0000

00-2

0000

00-1

0000

00 010

0000

020

0000

030

0000

040

0000

050

0000

060

0000

070

0000

080

0000

090

0000

010

0000

0011

0000

0012

0000

0013

0000

0014

0000

00

Frequency

Simulated P&L ($)

VaR95% = -$3,766,260

VaR95% = -$3,766,260

05

101520253035404550

-220

0000

0-2

1000

000

-200

0000

0-1

9000

000

-180

0000

0-1

7000

000

-160

0000

0-1

5000

000

-140

0000

0-1

3000

000

-120

0000

0-1

1000

000

-100

0000

0-9

0000

00-8

0000

00-7

0000

00-6

0000

00-5

0000

00-4

0000

00-3

0000

00-2

0000

00-1

0000

00 010

0000

020

0000

030

0000

040

0000

050

0000

060

0000

070

0000

080

0000

090

0000

010

0000

0011

0000

0012

0000

0013

0000

0014

0000

00

Frequency

Simulated P&L ($)

MVaR95% = -$5,733,689

MVaR95% = -$5,733,689

PORT Index AuM ($) 100,000,000 Confidence Level 95%

Critical Value (z α ) 1.645Monthly VaR 95% ($)

-785,392 -783,190

05

101520253035404550

-220

0000

0-2

1000

000

-200

0000

0-1

9000

000

-180

0000

0-1

7000

000

-160

0000

0-1

5000

000

-140

0000

0-1

3000

000

-120

0000

0-1

1000

000

-100

0000

0-9

0000

00-8

0000

00-7

0000

00-6

0000

00-5

0000

00-4

0000

00-3

0000

00-2

0000

00-1

0000

00 010

0000

020

0000

030

0000

040

0000

050

0000

060

0000

070

0000

080

0000

090

0000

010

0000

0011

0000

0012

0000

0013

0000

0014

0000

00

Frequency

Simulated P&L ($)

MVaR95% = -$4,575,377

MVaR95% = -$4,575,377

PORT AuM ($) 100,000,000 Variance (Min.) 5.24

St. Dev. 2.29%Confidence Level 95%

Critical Value (z α ) 1.645



[16



com





Parametric VaR

Modified VaR

Expected Shortfall

05

101520253035404550

-220

0000

0-2

1000

000

-200

0000

0-1

9000

000

-180

0000

0-1

7000

000

-160

0000

0-1

5000

000

-140

0000

0-1

3000

000

-120

0000

0-1

1000

000

-100

0000

0-9

0000

00-8

0000

00-7

0000

00-6

0000

00-5

0000

00-4

0000

00-3

0000

00-2

0000

00-1

0000

00 010

0000

020

0000

030

0000

040

0000

050

0000

060

0000

070

0000

080

0000

090

0000

010

0000

0011

0000

0012

0000

0013

0000

0014

0000

00

Frequency

Simulated P&L ($)

VaR95% = -$2,764,562

VaR95% = -$2,764,562

05

101520253035404550

-220

0000

0-2

1000

000

-200

0000

0-1

9000

000

-180

0000

0-1

7000

000

-160

0000

0-1

5000

000

-140

0000

0-1

3000

000

-120

0000

0-1

1000

000

-100

0000

0-9

0000

00-8

0000

00-7

0000

00-6

0000

00-5

0000

00-4

0000

00-3

0000

00-2

0000

00-1

0000

00 010

0000

020

0000

030

0000

040

0000

050

0000

060

0000

070

0000

080

0000

090

0000

010

0000

0011

0000

0012

0000

0013

0000

0014

0000

00

Frequency

Simulated P&L ($)

VaR95% = -$3,766,260

VaR95% = -$3,766,260

05

101520253035404550

-220

0000

0-2

1000

000

-200

0000

0-1

9000

000

-180

0000

0-1

7000

000

-160

0000

0-1

5000

000

-140

0000

0-1

3000

000

-120

0000

0-1

1000

000

-100

0000

0-9

0000

00-8

0000

00-7

0000

00-6

0000

00-5

0000

00-4

0000

00-3

0000

00-2

0000

00-1

0000

00 010

0000

020

0000

030

0000

040

0000

050

0000

060

0000

070

0000

080

0000

090

0000

010

0000

0011

0000

0012

0000

0013

0000

0014

0000

00

Frequency

Simulated P&L ($)

MVaR95% = -$5,733,689

MVaR95% = -$5,733,689

05

101520253035404550

-220

0000

0-2

1000

000

-200

0000

0-1

9000

000

-180

0000

0-1

7000

000

-160

0000

0-1

5000

000

-140

0000

0-1

3000

000

-120

0000

0-1

1000

000

-100

0000

0-9

0000

00-8

0000

00-7

0000

00-6

0000

00-5

0000

00-4

0000

00-3

0000

00-2

0000

00-1

0000

00 010

0000

020

0000

030

0000

040

0000

050

0000

060

0000

070

0000

080

0000

090

0000

010

0000

0011

0000

0012

0000

0013

0000

0014

0000

00

Frequency

Simulated P&L ($)

MVaR95% = -$4,575,377

MVaR95% = -$4,575,377


St. Dev. P&L ($) 2,218,136 Confidence Level 95%


St. Dev. P&L ($) 2,218,136 Confidence Level 95%



[17



com






[18



com






[19



com



Beyond ‘Bayesian vs. VaR’ Dilemma to Empirical Model Risk Management: How to Manage Risk (After Risk Management Has Failed) for Hedge FundsSophistication and Complexity of models… two-edged sword, -Simple models preferred… if help understanding the assumptions and limits, -Complex models increase model risk… if obfuscate understanding and clarity.Regardless of which model seems relatively superior… it may still not be a good model of the data, but the least worse of the models that are compared.

Evaluation of complex integrals [in denominator of Bayes’ formula] over high dimensional parameter space… major challenge for actual Bayesian analysis. - Model with 8 parameters, each with 1E3 values: 8-D parameter space contains 1E24 combinations of parameter values: computationally complex.



[20



com






[21



com






[22



com



To VaR or Not to VaR? Why VaR & Why ES or EVT?- Systemic, highly correlated, and interdependent nature

of Cyber risks- VaR not appropriate model given the ‘systemic’ nature of

Cyber risks- VaR doesn’t satisfy ‘subadditivity’ criterion of

‘coherent risk measures.’Historical Simulation Based VaR: relies upon historical correlations;MC based VaR: can use any statistical distribution (including normal), relies on several assumptions about specific statistical distributions chosen and extensive computing power or statistical computing algorithms (MCMC).Parametric VaR: relies upon statistical linearity and normality assumptions;

Risk, Uncertainty, and Profit for the Cyber Era: Model Risk Management of Cyber Insurance Models Using Quantitative Finance and Advanced Analytics. (Malhotra 2015)http://papers.ssrn.com/sol3/papers.cfm?abstract_id=2553547




[23



com



Modified VaR:

Expected Shortfall (ES, ETL, T-VaR, CTE):



[24



com



Markov Chain Monte Carlo Models, Gibbs Sampling & Metropolis Algorithm for High-Dimensionality Complex Stochastic Problems. (Malhotra 2014)http://papers.ssrn.com/sol3/papers.cfm?abstract_id=2553537 Bayesian inference for doing high dimension parameter space analyses- Feasible with Markov Chain Monte Carlo statistical

computing algorithms - Metropolis Hastings algorithm and Gibbs Sampling

algorithm

MCMC: A common general quantitative method to find approximate solutions to computationally complex problems in polynomial time…

Polynomial Time O(nk) s.t. k > 1Exponential Time O(kn) s.t. k > 1n = length of input

Source:stackoverflow.com




[25



com



Markov Chain Monte Carlo Models, Gibbs Sampling & Metropolis Algorithm for High-Dimensionality Complex Stochastic Problems.

Gibbs Sampling: Generating random variables from a marginal distribution indirectly without the need for calculating the distribution density.-E.g. Solve complex multivariate stochastic model with N parameters (i.e. N-Dim.) using N univariate (i.e., one-dimensional) conditional distributions.



[26



com



Dropping the burn-in sample of first m draws≈

Metropolis Algorithm :



[27



com



Metropolis-Hastings Algorithm :

Metropolis-Hastings Algorithm = Metropolis Algorithm when

Risk, Uncertainty, and Profit for the Cyber Era: Model Risk Management of Cyber Insurance Models Using Quantitative Finance and Advanced Analytics. (Malhotra 2015)http://papers.ssrn.com/sol3/papers.cfm?abstract_id=2553547




[28



com



Cyber risk insurance (CRI) modeling… nascent … sparse research & data. - VaR, Value-at-Risk, predominant model of choice for CRI

modeling - Model risk related to VaR key factor in the Global

Financial Crisis - Known limitations of VaR in modeling tail risks and

systemic risks - US Federal and OCC issued model risk guidance SR11-

7/OCC 2011-12- Basel Committee stopped reliance on VaR for risk

modeling.

Investigation: if current reliance of CRI modeling on VaR entails model risk. - Benchmark relative levels of tail risks and systemic risks for cyber risks - Based upon analysis of statistical correlations and dependence, systemic risks- Finding: Cyber risk entails exponentially higher tail risks and systemic risks- Hence, VaR unfit as primary risk model for CRI modeling- Coherent Risk Measures Beyond VaR: T-VaR/ES EVT Power Lawshttp://papers.ssrn.com/sol3/papers.cfm?abstract_id=2553547




[29



com



Cyber-Finance-Trust Framework for Cyber Risk Insurance Modeling Cyber risk inherent in all cyber activities including cyber-finance,-economics. Just like use of any model entails associated model risk, Similarly use of cyber activities entails associated cyber risk. Cyber risk is “risk affecting the confidentiality, availability, integrity, authentication, non-repudiation, or accessibility of information.”“Unlike other risks, cyber risk poses a uniquely different set of exposures as it is intertwined with the medium and the message in the increasingly global interconnected, distributed, and, networked world of digital communications powered by universal use and reuse of enabling global monocultures of information and communication technologies and standard computing network protocols.”

To VaR or Not to VaR? Why VaR & Why ES or EVT?http://papers.ssrn.com/sol3/papers.cfm?abstract_id=2553547




[30



com



“Cyberwarfare is not something theoretical or reserved for conflict in the distant future, but happening continuously right now… We're doing it all of the time. So is everybody else…”- Ability of incapacitating a country’s power grids as

early as 1994.- Ability to disable complete national critical

information infrastructure banking, railroads, airlines, sewage, water and electric power since 1999.

Global financial systems and national financial infrastructures have been explicitly specified as potential targets of Cyberwarfare by key representatives.



[31



com



In our information based view, all networked information based risks including market risks, credit risks, currency risks, interest rate risks, etc., are subject to cyber risks. In as much as all these risks are represented in terms of digital information which can be subject to information based manipulation or hacking, they are in fact cyber risks.Banking and Finance is the most information intensive industry given that most of its products and services, processes, as well as channels of distribution and consumption are all digital.Given common and shared platforms, hardware, software, exchanges, and networks across many of the players in the Finance industry, there is a greater probability of correlated cyber risks.

Risk, Uncertainty, and Profit for the Cyber Era: Model Risk Management of Cyber Insurance Models Using Quantitative Finance and Advanced Analytics. (Malhotra 2015) http://papers.ssrn.com/sol3/papers.cfm?abstract_id=2553547





[32



com



Cyber Finance (information networks based finance) – pretty much most of post-WWW contemporary finance of this century – all products (and services), processes, channels (of production, distribution, and consumption) increasingly more or less information-based, digital, cyber, and virtual.

Source of cyber risk and cyber loss is uncertain: In contrast to (traditional) financial risk realm of the finance domain, it is most challenging to even ascertain the source of cyberattack with certainty.“However you read it, this sort of evidence is circumstantial at best. It's easy to fake, and it's even easier to interpret it wrong.”



[33



com



Related examples include FIX (Financial Information eXchange) and FAST (FIX Adapted for STreaming) protocols that form the backbone of buy- and sell-side trading or SWIFT (Society for Worldwide Interbank Financial Telecommunication) protocol that forms the backbone of worldwide banking transactions and messaging.Regulated & Controlled Risks… Application Layer L7: Accounting & Auditing irregularities, Insider trading, Repo 105, LIBOR fixing, FOREX fixing, Credit ratings manipulations, Wash sales (High Frequency Trading), …Unregulated & Uncontrolled Risks… Network Layers L3-6: Same or similar impacts on specific information but through cyber manipulations and cyber attacks… at the Network Layer, Transport layer, related Security Protocols…Such cyber risk ‘losses’ remain substantially unaccounted & unreported.- SEC Corp Fin ‘materiality’ criteria guidance for self-reporting by firms.



[34



com



Source: microsoft.com

Source: indigoo.com

MODELS

RISKS

Increasing KnightianUncertainty

Model Risk ManagementCritical



[35



com



“The Heartbleed Bug is a serious vulnerability in the popular OpenSSL cryptographic software library. This weakness allows stealing the information protected, under normal conditions, by the SSL/TLS encryption used to secure the Internet. This allows attackers to eavesdrop communications, steal data directly from the services and users and to impersonate services and users.” “Half a million sites are vulnerable, including my own.” “Basically, an attacker can grab 64K of memory from a server. The attack leaves no trace, and can be done multiple times to grab a different random 64K of memory. This means that anything in memory -- SSL private keys, user keys, anything -- is vulnerable. And you have to assume that it is all compromised. All of it.”“The real question is whether or not someone deliberately inserted this bug into OpenSSL, and has had two years of unfettered access to everything.”

“"Catastrophic" is the right word. On the scale of 1 to 10, this is an 11.”www.schneier.com



[36



com



Source: Retained Search Model Risk Management Job Spec for Managing Director/Executive Director Role of a Top Wall Street Investment Bank, April 2014.“[T]he approaches to mitigate operating risk associated with the use of models need to evolve to reflect recent trends in the Finance Industry. In particular there are a number of new areas where it is not possible for the "human eye" to necessarily detect material flaws: in the case of models operating over very small time scales in high frequency algorithmic trading, or for portfolio risk measurement models where outputs lack interpretability due to high-dimensionality and complex interactions in inputs, the periodic inspection of predicted versus realized outcomes is unlikely to be an effective risk mitigate. These situations require a holistic validation framework of the system focused on identifying and mitigating potential failures, taking into account the models’ objectives, their implementation including the joint interaction of software and hardware, their response to potential input shocks in real time and the fail-safe mechanisms.”

“As much as $600 million in assets changed hands in the 7 milliseconds before traders in Chicago could learn of the Fed's ‘no taper’ decision made in Washington DC on Sep. 18, 2014.” - CNBC



[37



com



MODELS

RISKS

FIX AND XML: FIXML (fixprotocol.org)

Source: Canadian Securities Exchange vendorSource: b2bits.com



[38



com



A Risk Management Framework for Penetration Testing of Global Banking & Finance Networks VoIP Protocols, May 8, 2014. http://papers.ssrn.com/sol3/papers.cfm?abstract_id=2555098“A vulnerability inside all current

Cisco IP phones allows hackers to take complete control of the devices… It’s relatively easy to penetrate any corporate phone system, any government phone system… All current Cisco IP phones, including the ones seen on desks in the White House and aboard Air Force One, have a vulnerability that allows hackers to take complete control of the devices.”

Malhotra, Y. A Risk Management Framework for Penetration Testing & Security of

Global Banking & Finance networksVoice Over Internet Protocols (May 3, 2014), WWW: Columbia University and Palindrome Technologies.




[39



com



Future of Bitcoin & Statistical Probabilistic Quantitative Methods: Interview, Hong Kong Institute of CPAs, A+, January 20, 2014. http://yogeshmalhotra.com/Future_of_Bitcoin.html“Recently, such probabilistic, statistical, and numerical methods related concerns are in globally popular press related to cybersecurity controls and compliance. Earlier, similar probabilistic, statistical, and numerical methods related concerns were in the global popular press in the context of the global financial crisis. Future questions focused on the underlying assumptions and logic may focus on related implications for compliance, controls, valuation, risk management, etc. Likewise, recent developments about mathematical entropy measures shedding new light on apparently greater vulnerability of prior encryption mechanisms may offer additional insights for compliance and control experts. For instance, given related mathematical, statistical and numerical frameworks, analysis may also focus on potential implications for pricing, valuation and risk models. The important point is that many such fundamental assumptions and logic underlying widely used probabilistic, statistical, and numerical methods may not as readily meet the eye.”

http://yogeshmalhotra.com/Future_of_Bitcoin.html



[40



com



Bitcoin Protocol: Model of ‘Cryptographic Proof’ Based Global Crypto-Currency & Electronic Payments System, December 04, 2013. http://yogeshmalhotra.com/BitcoinProtocol.html“Money is an interesting construct that continues to occupy the fancy of many ranging from economists to quantum physicists... The future of money becomes “entangled” with future of money laundering when focus is not on privacy and anonymity alone, but also lack of traceability... Situated somewhere along the trajectory between real money and quantum money, virtual crypto-currencies based upon ‘cryptographic proof’ represent a natural stage in the evolution of global finance... The future of money, whatever form it may take – virtual or quantum, will quite likely be "entangled" with the future evolution of ‘cryptographic proof of work.’”

http://yogeshmalhotra.com/BitcoinProtocol.html



[41



com



Bitcoin Protocol: Model of ‘Cryptographic Proof’ Based Global Crypto-Currency & Electronic Payments System, December 04, 2013. http://yogeshmalhotra.com/BitcoinProtocol.html

SHA 256ECDSA (ECDRBG)

http://yogeshmalhotra.com/BitcoinProtocol.html



[42



com



Cryptology Beyond Shannon's Information Theory: Preparing for When the ‘Enemy Knows the System’ with Technical Focus on Number Field Sieve Cryptanalysis Algorithms for Most Efficient Prime Factorization on Composites, May 3, 2013. http://papers.ssrn.com/sol3/papers.cfm?abstract_id=2553544 Number Field Sieves: Most powerful family of factoring algorithms

1970: 20-digit becoming feasible1977: RSA “40 quadrillion years” challenge by R1980: 50-digit commonplace, 1984: 2251 – 1 (300 yr. ago…)1990: 116-digit quadratic sieve QS… Pomerance1994: 129-digit RSA challenge won… within 17 years!1996: 130-digit NFS … Pollard, 15% time of QS2003: 174-digit RSA-576 NFS number field sieve 2005: 193-digit RSA-640 NFS2009: 232-digit RSA-768 NFS 309-digit RSA-1024 Major security implications! $100K.2012: SNFS Factorization of Mersenne number, 21061 – 1

Size of composite of prime factors being factored.Number Field Sieve (NFS)

Special Number Field Sieve (SNFS)General Number Field Sieve (GNFS)Quadratic Sieve (QS)Rational Sieve (RS)





[43



com



Cryptology Beyond Shannon's Information Theory: Preparing for When the ‘Enemy Knows the System’ with Technical Focus on Number Field Sieve Cryptanalysis Algorithms for Most Efficient Prime Factorization on Composites, May 3, 2013. http://papers.ssrn.com/sol3/papers.cfm?abstract_id=2553544 “First, based on available evidence, it is not improbable that the current officially ‘recommended’ most widely used global standard of encryption [1024-bit RSA] may have already been compromised. Second, it would not really be a ‘surprise’ given that the infamous ‘40 quadrillion years’ challenge for an earlier version of the standard was unraveled in mere 17 years. Third, given recent multi-billion dollar global Finance deals blown by compromise of such technologies, it is increasingly critical to recognize the exponentially increasing cybersecurity risk among other Financial Risks.” – Number Field Sieve Cryptanalysis Algorithms for Most Efficient Prime Factorization on Composites presentation, May 1, 2013, Presentation 15 miles from AFRL.





[44



com



Congruent Squares: Legendre’s Congruence: Prime Factors p & q



[45



com





[46



com



1. Polynomial Selection Find f(x) irreducible over ℤ[x]

with root m modulo n, f(x) ϵ ℤ[x].2. Finding Factor Bases

Choose size for factor bases and set up: Rational Factor Base, RFB Algebraic Factor Base, AFB Quadratic Character Base, QCB

3. Sieving → Set S of relations (a, b) Find pairs of integers (a, b) with properties:

gcd(a, b) = 1 a, b are relative primes a + bm is smooth over RFB bdeg(f)f(a/b) is smooth over AFB

Pairs (a, b) with above properties: relation.



[47



com



4. Solving Linear Equations using Matrix Filter sieving results: remove duplicates and relations

containing a prime ideal not present in other relations. Put relations into relation-sets. Construct very large sparse matrix over GF(2) 2 = pm . Reduce the matrix resulting in some dependencies

Elements which lead to a square modulo n.5. Calculating Square Roots in Number Fields

Rational square root, y: y2 = Algebraic square root, x: x2 =

where = root of f(x) p is found by gcd(n, x-y) and gcd(n, x+y).



[48



com



Cryptology Beyond Shannon's Information Theory: Preparing for When the ‘Enemy Knows the System’ with Technical Focus on Number Field Sieve Cryptanalysis Algorithms for Most Efficient Prime Factorization on Composites, May 3, 2013. http://papers.ssrn.com/sol3/papers.cfm?abstract_id=2553544

Expert Systems for Knowledge Management: Crossing The Chasm Between Information Processing and Sense Making. Journal of Expert Systems with Applications (Malhotra, 2001).http://www.brint.org/expertsystems.pdf

Entropy increases with a larger repertoire of symbols.Entropy increases when meanings detached from symbols.

Complex Systems & Cybernetics: Ashby's Law of Requisite Variety



http://www.brint.org/expertsystems.pdf

http://www.brint.org/expertsystems.pdf



[49



com



Quantum Computing, Quantum Cryptography, Shannon’s Entropy and Next Generation Encryption & Decryption, November 2013. (Invited Presentation)Information entropy of 27-char. language ~ 4.8

bits per char.Information entropy of 5,000-char. language ~ 12.3 bits per char.Entropy increases with a larger repertoire of

symbols.Entropy increases when meanings detached from symbols.

Quantum computer: qubits… can be 0, 1, or any superposition of both. n-qubit system: superposition of up to 2n states simultaneously. 2k dimensional vector (a, b, c, d, e, f, g, h)… complex values: |a|2 + |b|2 + …+ |h|2 = 1, |x|2 is probability amplitude of respective state. Phase between any two states (complex-valued coefficients )… meaningful.



[50



com



Quantum Cryptography, Shor's algorithm, and Quantum MoneyInteger Factorization of large primes and Discrete Logarithm problem.Quantum computer efficiently find such factors using Shor's algorithm. Decrypt many critical cryptographic systems in polynomial time: RSA, secure Web pages, encrypted email, many other types of data.

“For a 1024-bit number, Shor's Algorithm requires on the order of 10243, about one billion, operations. If each quantum operation took one second, our factorization would last 34 years. If a quantum computer could run at the speed of today's electronic computers (100 million instructions per second and up) then factorization of the 1024-bit number would be a matter of seconds.”

IEEE



[51



com



N-dimensional Hilbert Space

+ OTHER BOOKS



[52



com



Knight’s Risk, Uncertainty, and Profit of 1921 - Emergence of the World Wide Web in early-1990s, - Derman’s Model Risk Management, Goldman Sachs,

mid-late-1990s,- Backlash against quantitative models after Financial

Crisis, 2008,- Basel to Consider Risk Metrics other than VaR, Feb 2012,

- Post-Snowden Cyber era starting May 2013... Information-based view of Financial risk modeling practices, - Exponentially increasing Cyber era uncertainty, - Cyber-Finance, the emerging Future of Finance? - Risk modeling focus on metaphorical ‘tip’ of the iceberg,- Significant risks not readily meet the human eye. - Cyber-risk, the predominant risk… subsumes traditional

risks.

CONCLUSION



[53



com



Exponentially increasing tail risks and systemic risks- Characterize highly systemic, interdependent, correlated

Cyber-risks - Cyber risks in turn characterize financial risks. Based on research of two-decades - Starting around the emergence of the WWW (1993),

Philosophy of IS - How to ‘anticipate surprise’ when ‘prediction’ of

risk is infeasible,- Wall Street Chief Risk Officers, Top Investment Bank CxOs,

Fed/OCC - Explore advances in quantitative risk models, statistical

methodologies, and, computational statistical technologies

Facilitate dialog on the above issues of central concern - Future of Finance - Future of Risk.

CONCLUSION



[54



com



SSRN Top-10 Papers: 20 Quantitative Finance-Risk Analytics Top-10 Rankings in recent 11 Weeks:1. Beyond ‘Bayesian vs. VaR’ Dilemma to Empirical Model Risk Management:

How to Manage Risk (After Risk Management Has Failed) for Hedge Funds (Malhotra 2014).

2. Risk, Uncertainty, and Profit for the Cyber Era: Model Risk Management of Cyber Insurance Models Using Quantitative Finance & Advanced Analytics (Malhotra 2015).

3. Markov Chain Monte Carlo Models, Gibbs Sampling & Metropolis Algorithm for High-Dimensionality Complex Stochastic Problems (Malhotra 2014).

4. Extending Above Observations to High Frequency Trading: FIX, FAST (Beyond ‘Flash Boys’).

5. A Risk Management Framework for Penetration Testing of Global Banking & Finance Networks VoIP Protocols (Malhotra 2014).

6. Future of Bitcoin & Statistical Probabilistic Quantitative Methods: Interview, Hong Kong Institute of CPAs (Malhotra 2014).

7. Bitcoin Protocol: Model of ‘Cryptographic Proof’ Based Global Crypto-Currency & Electronic Payments Systems (Malhotra 2013).

8. Cryptology Beyond Shannon's Information Theory: Number Field Sieve Cryptanalysis Algorithms for Most Efficient Prime Factorization on Composites (Malhotra 2013).

9. Quantum Computing, Quantum Cryptography, Shannon’s Entropy and Next Generation Encryption & Decryption (Malhotra 2013)… One more reference about Shannon’s Information Theory (Malhotra 2001).



[55



com



Knight Reconsidered: Risk, Uncertainty, and Profit for the Cyber Era:Future of Finance: Cyber-Finance?:

Uncertainty Modeling & Model Risk Management

YogiYogesh Malhotra

PhD, MSQF, MSCS, MSNCS, MSAcc, MBAEco BE, CEng, CISSP, CISA, CEH, CCP/CDP

www.yogeshmalhotra.com (646) 770-7993 [email protected]

Global Risk Management Network, LLC757 Warren Road, Cornell Business & Technology Park, Ithaca, NY 14852-4892

http://www.FutureOfFinance.org/Princeton.ppsx

2015 princeton quant trading conference, future of finance: cyber finance

Economy & Finance