mihir2007/Cyber-Risk

1# AI-Powered Continuous Cyber Risk Quantification (CRQ) & Investment Optimization Platform2 3Quantifies enterprise cyber risk in Indian Rupees (₹), computes Expected Annual Loss (EAL)4and Value at Risk (VaR) via Monte Carlo simulation, maps exposure to RBI CSF / SEBI CSCRF /5NIST CSF 2.0, and solves a budget-constrained security investment optimization problem6(0/1 knapsack via Integer Linear Programming).7 8## Quick start9 10```bash11pip install -r requirements.txt --break-system-packages   # or use a virtualenv12 13# Option A: standalone terminal demo (no server needed)14python run_simulation.py15 16# Option B: full REST API17uvicorn main:app --reload --port 800018# then open http://127.0.0.1:8000/docs for interactive Swagger UI19```20 21The first run creates `cyber_risk.db` (SQLite) in the working directory and is safe to22re-run — seeding is idempotent.23 24## Architecture25 26| Module | Responsibility |27|---|---|28| `database.py` | SQLAlchemy 2.0 engine, `SessionLocal`, `get_db` FastAPI dependency |29| `models.py` | ORM models: `Asset`, `Vulnerability`, `SecurityControl`, `SimulationRun` |30| `schemas.py` | Pydantic v2 request/response DTOs |31| `seeder.py` | Idempotent synthetic telemetry generator (18 assets, 48 CVEs, 15 controls) |32| `graph_engine.py` | NetworkX attack graph; computes path exposure coefficient per asset |33| `quant_engine.py` | Logistic-sigmoid likelihood calibration, financial impact modeling (outage, breach, DPDPA/RBI/SEBI penalties, forensics), vectorized compound-Poisson Monte Carlo (10,000 iterations) |34| `optimizer.py` | PuLP 0/1 knapsack MILP for budget-constrained control selection, with an overlap-based diminishing-returns discount and ROSI computation |35| `compliance.py` | Maps active controls to RBI CSF / SEBI CSCRF / NIST CSF 2.0 categories and reports gaps |36| `main.py` | FastAPI REST server wiring all of the above together |37| `run_simulation.py` | Standalone CLI runner exercising the full pipeline end-to-end |38 39## API summary40 41- `POST /api/seed` — seed the database42- `GET /api/assets` — assets + vulnerabilities + per-asset EAL43- `GET /api/quantification/enterprise` — EAL, VaR95/99, top-5 riskiest assets, regulatory exposure, loss exceedance curve (also logs a `SimulationRun`)44- `GET /api/quantification/loss-exceedance` — loss exceedance curve only45- `POST /api/optimize/budget` — `{"budget_inr": float}` → optimal control portfolio + ROSI (also activates the chosen controls and logs a `SimulationRun`)46- `GET /api/compliance/status` — framework compliance scores and gaps47- `GET /api/simulations/history` — all past `SimulationRun` records48 49## Modeling notes (for the AIML reviewers)50 51- **Likelihood**: each asset's annual breach frequency (λ, a Poisson rate) is calibrated52  from its *worst* unpatched vulnerability's `CVSS + 10·EPSS + 10·GraphExposure` score53  through a logistic-sigmoid link, with a small additive bonus per extra unpatched CVE54  (avoiding runaway multiplicative compounding across many CVEs), then capped by a55  tier-specific maximum realistic annual frequency. Active controls reduce λ56  multiplicatively via `(1 - likelihood_reduction)`.57- **Severity**: each simulated event's loss is a composite of Beta-PERT-distributed58  downtime cost, a Beta-PERT breach-fraction applied to PII/financial record costs, a59  DPDPA-2023-style penalty (log-normal regulator-discretion multiplier), an RBI/SEBI fine60  gated on regulated status and reportable downtime, and a uniform forensics/IR cost.61- **Monte Carlo**: a vectorized compound-Poisson process — for each asset, `n_iterations`62  Poisson draws give the event count per simulated year; a matrix of candidate severities63  is masked per iteration and summed, avoiding Python-level event loops.64- **Optimizer**: the MILP objective uses each control's *standalone* marginal ΔEAL65  (from an isolated Monte Carlo run), discounted by an overlap factor when multiple66  candidates target the same asset tier, to keep the objective linear despite the67  underlying multiplicative risk model. The final reported ΔEAL/ROSI comes from a joint68  re-simulation of the actually selected portfolio.69 70## For the CSE-core reviewers71 72- Explicit SQLAlchemy 2.0 `Mapped[...]` declarative models with real foreign keys,73  cascading deletes (`Vulnerability` cascades from `Asset`), and `lazy="selectin"`74  eager loading for the nested vulnerability relationship.75- Session lifecycle is dependency-injected via `get_db()` for FastAPI and used directly76  with `SessionLocal()` in the standalone CLI runner.77- Pydantic v2 schemas are strict on `*Create` DTOs (`extra="forbid"`) and use78  `from_attributes=True` for ORM-to-DTO reads.79