Vulnerability Webs: Systemic Risk in Software Networks
Modern software development is a collaborative effort that re-uses existing code to reduce development and maintenance costs. This practice exposes software to vulnerabilities in the form of undetected bugs in direct and indirect dependencies, as demonstrated by the Crowdstrike and HeartBleed bugs. The economic costs resulting from such vulnerabilities can be staggering. We study a directed network of 52,897 software dependencies across 16,102 Python repositories, guided by a strategic model of network formation that incorporates both observable and unobservable heterogeneity. Using a scalable variational approximation of the conditional distribution of unobserved heterogeneity, we show that outsourcing code to other software packages by creating dependencies generates negative externalities. Modeling the propagation of risk in networks of software packages as an epidemiological process, we show that increasing protection of dependencies based on popular heuristics is ineffective at reducing systemic risk. By contrast, AI-assisted coding enables developers to replace dependencies with in-house code and reduces systemic risk.
Code (0)
등록된 구현이 없습니다.
Similar Papers 제목 키워드 기반
On Vulnerability Conditional Risk Measures: Comparisons and Applications in Cryptocurrency Market
We introduce a novel class of systemic risk measures, the Vulnerability Conditional risk measures, which try to capture the "tail risk" of a risky position in scenarios where one or more market participants is experienci…
PositionAssessing systemic risk due to fire sales spillover through maximum entropy network reconstruction
Assessing systemic risk in financial markets is of great importance but it often requires data that are unavailable or available at a very low frequency. For this reason, systemic risk assessment with partial information…
LLMs in Web Development: Evaluating LLM-Generated PHP Code Unveiling Vulnerabilities and Limitations
This study evaluates the security of web application code generated by Large Language Models, analyzing 2,500 GPT-4 generated PHP websites. These were deployed in Docker containers and tested for vulnerabilities using a …
Financial Risk Spillover Effects Among China's Crude Oil Futures Market, Stock Market, and Bond Market During the COVID-19 Pandemic
This paper unravels the dynamics of financial risk transmission across China’s crude oil futures, stock, and bond markets, spotlighting the period during and subsequent to the COVID-19 pandemic. Leveraging the generalize…
Vulnerability-CoVaR: Investigating the Crypto-market
This paper proposes an important extension to Conditional Value-at-Risk (CoVaR), the popular systemic risk measure, and investigates its properties on the cryptocurrency market. The proposed Vulnerability-CoVaR (VCoVaR) …