HMWK 03 — Stochastic Penetration Processes, LLN & Central Limit Theorem

1. Stochastic Penetration Process & Monte Carlo Simulator

n Systems • m Attackers • i.i.d. Increments Xₖ

We model the sequential penetration of n systems by m independent attackers as a discrete-time stochastic process with independent and identically distributed (i.i.d.) increments X₁, X₂, …, Xₙ. At each step i ∈ {1, …, n}, an attacker attempts to compromise system i, yielding a step score Xₖ under one of two probabilistic regimes:

Bernoulli Model (Cumulative Breach Process): Xₖ ∈ {0, 1} with P(Xₖ = 1) = p and P(Xₖ = 0) = 1 − p. Each step represents a binary breach outcome (1 = compromised, 0 = defended), with step expectation μₓ = p and step variance σₓ² = p(1 − p).
Rademacher Model (Symmetric Zero-Mean Random Walk): Xₖ ∈ {−1, +1} with P(Xₖ = +1) = P(Xₖ = −1) = 1/2. This models a symmetric tug-of-war between offense (+1) and defensive remediation/pushback (−1), yielding exact zero drift μₓ = 0 and unit step variance σₓ² = 1.

Interactive Trajectory & Distribution Controls

Increment Model (Xₖ)

Systems (n steps)

Attackers (m trajectories)

Breach Probability p (Bernoulli)

Total Score Sₙ

Var: --

Average Score Sₙ / n

Var: --

Normalized Sₙ / √n

Var: --

Max Attacker Breach

CLT Fit: --

1. Total Score Trajectories: Sₚ = ∑ Xₖ

Variance grows linearly: Var(Sₙ) = nσ² = O(n) • Dashed: E[Sₚ] ± 2σ envelope

2. Average Score Trajectories: Sₚ / k (Law of Large Numbers)

Convergence in probability: Sₙ/n → μ • Variance collapses: Var(Sₙ/n) = σ²/n → 0

3. Normalized Score Trajectories: Sₚ / √k

Scale-invariant variance: Var(Sₙ/√n) = σ² = O(1) • Critical √n scaling

4. Terminal Distribution of Sₙ / √n & Central Limit Theorem

Histogram across m attackers vs. analytical Gaussian density N(μ√n, σ²) / N(0,1)

2. Multi-Scale Asymptotic Experiment (Increasing n)

n ∈ {10, 50, 100, 500, 1000, 5000} • Variance & LLN/CLT Verification

To rigorously compare how the three quantities behave as the number of systems n increases, the experiment below simulates m trajectories across six orders of system scale n ∈ {10, 50, 100, 500, 1000, 5000} and tracks the empirical variance and mean against theoretical predictions.

Asymptotic Scaling Benchmark across Increasing n

Evaluates empirical vs. theoretical variance scaling for the currently selected model.

Systems (n)	Sample Mean(Sₙ/n) [LLN Target: μ]	Var(Sₙ) [Theory: nσ²]	Var(Sₙ/n) [Theory: σ²/n]	Var(Sₙ/√n) [Theory: σ²]	Max\|CDF − Φ\| (KS Stat)

3. Mathematical Comparison of Normalizations, LLN & CLT

Asymptotic Probability Theory

Let X₁, X₂, …, Xₙ be i.i.d. random variables with finite mean μ = E[Xₖ] and finite positive variance σ² = Var(Xₖ). By linearity of expectation and independence of increments, scaling the partial sum Sₙ = ∑ Xₖ by n^−α scales the expectation by n^1−α and the variance by n^1−2α:

Quantity	Scaling Exponent (α)	Bernoulli (Xₖ ∈ {0,1}, μ=p, σ²=p(1-p))	Rademacher (Xₖ ∈ {-1,+1}, μ=0, σ²=1)	Variance Scaling as n → ∞	Asymptotic Behavior
Total Score: Sₙ	`α = 0` (No division)	`E = np` `Var = np(1 − p)`	`E = 0` `Var = n`	Diverges linearly: `O(n) → ∞`	Dispersion widens indefinitely; standard deviation grows as `σ√n`.
Average Score: Sₙ / n	`α = 1` (Divide by n)	`E = p` `Var = p(1 − p) / n`	`E = 0` `Var = 1 / n`	Collapses to zero: `O(1/n) → 0`	Law of Large Numbers: Converges in probability (`Sₙ/n →^P μ`) to a deterministic constant.
Normalized Score: Sₙ / √n	`α = 1/2` (Divide by √n)	`E = √n · p` (drifts to +∞) `Var = p(1 − p)`	`E = 0` `Var = 1`	Constant & invariant: `O(1) = σ²`	Central Limit Theorem: In Rademacher, `Sₙ/√n →^d N(0, 1)`. In Bernoulli, `(Sₙ − np)/√n →^d N(0, p(1−p))`.

1. Convergence in Probability (Law of Large Numbers)

For the sample average Sₙ/n, we have E[Sₙ/n] = μ and Var(Sₙ/n) = σ²/n. Applying Chebyshev's Inequality for any threshold ε > 0:

P(|Sₙ/n − μ| ≥ ε) ≤ Var(Sₙ/n) / ε² = σ² / (nε²) → 0

As n → ∞, the probability that the empirical penetration rate deviates from the true mean μ (p for Bernoulli, 0 for Rademacher) vanishes. Visually, the m trajectories form a narrowing funnel that pinches onto the horizontal line y = μ.

2. Variance Behavior under Normalizations

Because the increments Xₖ are independent, their variances add linearly: Var(Sₙ) = ∑ Var(Xₖ) = nσ². When we multiply Sₙ by a deterministic factor cₙ, the variance scales quadratically by cₙ²:

For cₙ = 1: Var(Sₙ) = nσ² → ∞ (unbounded spread).
For cₙ = 1/n: Var(Sₙ/n) = (1/n²)nσ² = σ²/n → 0 (degenerate point mass).
For cₙ = 1/√n: Var(Sₙ/√n) = (1/n)nσ² = σ² (non-degenerate, stable distribution).

Thus, √n is the unique critical scaling factor that neither blows up the variance nor crushes random fluctuations to zero.

3. Central Limit Theorem in the Rademacher Model

In the symmetric Rademacher model, E[Xₖ] = 0 and Var(Xₖ) = 1. Therefore, the normalized total score is already standardized:

Zₙ = (Sₙ − nμ) / (σ√n) = Sₙ / √n →^d N(0, 1)

Using characteristic functions, φ_Sₙ/√n(t) = E[e^itX₁/√n]ⁿ = [&cos;(t/√n)]ⁿ = (1 − t²/(2n) + O(n⁻²))ⁿ → e^−t²/2, which is the exact characteristic function of the Standard Normal N(0, 1). By contrast, in the Bernoulli model (μ = p > 0), Sₙ/√n = √n·p + √(p(1−p))Zₙ has constant variance p(1−p) but its center drifts to +∞ at rate √n·p.

4. Cybersecurity Interpretation: n Systems & m Attackers

Threat Modeling • Attack Surface vs. Adversary Population

Role of System Scale (n)

The parameter n represents the horizontal attack surface (number of hosts/endpoints audited by an attacker) or the depth of a multi-stage defense architecture:

Predictability of Compromise Rate (LLN): Across a large enterprise infrastructure (large n), the fraction of compromised systems Sₙ/n stabilizes tightly around the intrinsic vulnerability probability p. Security posture metrics measured over large asset inventories have minimal sampling noise (±1/√n).
Growth of Absolute Exposure (Total Score Sₙ): In the Bernoulli model, expected compromised assets grow linearly as np, while uncertainty grows as √(np(1−p)). Even in a balanced cyber conflict (Rademacher, zero average drift), an attacker can achieve large temporary excursions of order O(√n) purely by random fluctuation.

Role of Attacker Population (m)

The parameter m represents the number of concurrent threat actors (or automated botnet campaigns) probing the infrastructure simultaneously:

Empirical Resolution of Threat Distributions: While a single attacker (m = 1) traces one erratic random path, a large adversary population (large m) populates the entire probability distribution, making the Gaussian bell curve of Sₙ/√n empirically visible.
Extreme-Value Tail Risk (Worst-Case Breach): A defender must protect against the most successful attacker among all m adversaries: M_n,m = max_1≤j≤m Sₙ^(j). Because Sₙ/√n ≈ N(0, 1) in the Rademacher case, extreme value theory for Gaussian maxima implies that as m grows, the worst-case penetration scales as E[max Sₙ] ≈ √n · √(2 ln m). More attackers directly increase the probability of a low-probability, high-impact tail breach.