Attributing hacks with survival trend filtering (Q1688999)

The authors describe an interesting algorithm for provenance of hacks on web-sites. The construction of the proposed algorithm is based on the hazard regression model (see for example [\textit{A. Perperoglou}, Biom. J. 55, No. 1, 38--51 (2013; Zbl 1441.62462)]), Cox model (see [\textit{D. R. Cox}, J. R. Stat. Soc., Ser. B 34, 187--220 (1972; Zbl 0243.62041); \textit{J. Bradic} and \textit{R. Song}, Electron. J. Stat. 9, No. 1, 492--534 (2015; Zbl 1312.62041)] or [\textit{M. Woodward}, Epidemiology. Study design and data analysis. 3rd ed. Boca Raton, FL: CRC Press (2014; Zbl 1293.62003)]) and the trend filtering (see [\textit{S.-J. Kim} et al., SIAM Rev. 51, No. 2, 339--360 (2009; Zbl 1171.37033)] or [\textit{R. J. Tibshirani}, Ann. Stat. 42, No. 1, 285--323 (2014; Zbl 1307.62118)]). More specifically, the model provides a clear description of the probability of a site getting hacked conditioned on its time-varying features. Two good examples are given, in the both cases the authors simulate the data. Another very good example uses the real data from the work of \textit{K. Soska} and \textit{N. Christian} [``Automatically detecting vulnerable websites before they turn malicious'', in: Proceedings of the 23rd USENIX security symposium. Berkeley, CA: USENIX. 625--640 (2014)]. These examples confirm the accuracy and consistency of the proposed algorithm.