# Cascading Failures in the Global Financial System: A Dynamical Model

Leonardo Stella  Dario Bauso  Franco Blanchini  Patrizio Colaneri

###### Abstract

In this paper, we propose a dynamical model to capture cascading failures
among interconnected organizations in the global financial system and develop
a framework to investigate under which conditions organizations remain
healthy. The contribution of this paper is threefold: i) we develop a
dynamical model that describes the time evolution of the organizations’ equity
values given nonequilibrium initial conditions; ii) we characterize the
equilibria for this model; and iii) we provide a computational method to
anticipate potential propagation of failures.

###### keywords:

Systemic risk; Financial network; Financial contagion; Stability analysis.

††journal: Operations Research Letters

[1]organization=School of Computer Science, University of
Birmingham,country=United Kingdom

[2]organization=Jan C. Willems Center for Systems and Control, ENTEG,
University of Groningen,country=The Netherlands

[3]organization=Dipartimento di Ingegneria, University of
Palermo,country=Italy

[4]organization=Dipartimento di Matematica e Informatica, Università degli
Studi di Udine,country=Italy

[5]organization=Dipartimento di Elettronica, Informazione e Bioingeneria, and
IEIIT-CNR, Politecnico di Milano,country=Italy

##  1 Introduction

††Corresponding author: L. Stella; address: University of Birmingham,
Edgbaston, Birmingham, B15 2TT; e-mail<EMAIL_ADDRESS>
In the wake of recent events concerning the collapses of Silicon Valley Bank
and Credit Suisse (CS), the focus of this paper is to investigate the
propagation of failures in financial systems. The current global financial
system is the resultant of a large number of financial interdependencies among
governments, banks, firms, smaller and larger companies, private citizens,
etc. In the same spirit of the related literature, we make use of the term
organization in a broad sense including all these entities and individuals.
These organizations hold each other’s shares, debts and obligations in
variable proportions. As a result, when a failure occurs, this can propagate
through the network of interdependencies bringing other organizations to
bankruptcy. Failures can take the form of bankruptcies, defaults, and other
insolvencies. Indeed, cascading defaults and failures account for one of the
highest risks for the global financial system, let aside those institutions
that are considered too big to fail, e.g., central banks. A slightly less
recent example, but equally prominent, can be found in the interventions put
together by the European Commission to save Greece and Spain from default
following the historic quote “whatever it takes” by ECB President Mario Draghi
(July 23rd, 2012) [11].

In this paper, we study the role of cascading failures among organizations
linked through a network of financial interdependencies in the global
financial system. Our aim is to develop a model that describes the risks
associated with the propagation of failures in the network as well as the
design of effective responses to mitigate the impact of financial contagion.
Indeed, in the proposed model we highlight three relevant aspects: i) the
interdependencies in a financial system through cross-holdings of shares or
other liabilities; ii) the market price of assets owned by each organization;
iii) and a failure cost incurred by each organization. Indeed, when the value
of a financial organization attains a value that is below a failure threshold,
additional losses propagate through the network leading to a cascade of
failures.

Related Works. The first structural framework to study the propagation of
shocks in inter-bank lending was originally proposed in a pioneering work by
Eisenberg and Noe in 2001 [10]. The main contribution of that work is the
introduction of a model that captures the contagion from individual
organizations to other organizations in an inter-bank lending network. The
contagion occurs at individual nodes and propagates in the network, leading to
new equilibrium points representing the agreed mutual payments.

Their model illustrated how shocks to individual organizations can propagate
through inter-bank lending networks. Indeed, contagion develops
instantaneously, bringing the network to a new equilibrium on an agreed set of
mutual payments. Subsequently, there has been a substantial body of work
analyzing and generalizing this framework. For example, the authors in [8] and
[2] studied the way in which the structure of network graphs, such as hubs,
sparsity, and asymmetry structure, influences the shock propagation and the
magnitude of the aggregate fluctuation. Their study provides insights on the
optimal structure for inter-bank lending networks. Their model can accommodate
a variety of settings. For production networks, the model represents the
input-output relationship and determines the output equilibrium [2], whereas
for financial systems, it calculates the clearing loan repayments, involving
the systemic risk of default cascade [10].

Later, the preliminary research proposed by Eisenberg and Noe was extended in
several directions. A body of literature dating back to the work by Elsinger
[12] and then followed by Elliott _et al._ [11], Rogers and Veraart [19], and
Glasserman and Young [15] considered bankruptcy costs and their impact onto
the financial system. As a consequence of these costs, financial organizations
can in turn fail and drag other organizations to bankruptcy. Simultaneously,
cross-holdings were considered by Elsinger [12], Elliott _et al._ [11],
Fischer [14] and Karl and Fischer [17]. An important aspect in many of these
works is that cross-holdings inflate the value of the financial system and
thus the net value of each organization needs to be adjusted by a factor that
preserves the real value in the system [5]. The work by Weber and Weske
considers both these aspects and integrates them into a system that is able to
capture fire sales as well [20].

In particular, the work by Elliott _et al._ highlighted the fact that in the
current highly interconnected financial system, where banks and other
institutions are linked via a network of mutual liabilities, a financial shock
in one or few nodes of the network may hinder the possibility for these nodes
to fulfill their obligations towards other nodes, and therefore provoke
default [11]. A recent work by Birge [4] investigates an inverse optimisation
approach based on the decisions from national debt cross-holdings to address
the propagation and extent of failures in the network.

However, the common assumption that all payments are simultaneous is quite
unrealistic. For this reason, several recent works, e.g., see [3, 6, 9, 16],
propose time-dynamic extensions of this model. The work by Calafiore _et al._
considers the problem of reducing the financial contagion by introducing some
targeted interventions that can mitigate the cascaded failure effects. They
consider a multi-step dynamic model of clearing payments and introduce an
external control term that represents corrective cash injections made by a
ruling authority [7]. Similarly, a case study on the Korean financial system
is proposed by Ahn and Kim where the authors study the interventions in the
form of liquidity injection into the financial system under economic shocks
[1]. Finally, a recent work by Ramirez _et al._ investigated a stochastic
discrete-time model where the mean and covariance error are studied with focus
on the steady-state solution [18].

Contribution. The contribution of this work is threefold. Firstly, we
introduce the formulation of a dynamical model for cascading failures in
financial systems. This model is novel with respect to the literature, and in
particular to the work by Elliott _et al._ , as in the following:

  * 1.

Our model captures the transient response, allowing us to study the market
response to disturbances, and uncertainty in the form of initial conditions
not already at an equilibrium.

  * 2.

Our model can predict the future evolution of the market, allowing us to
characterize the equilibria and study local stability.

  * 3.

Finally, it allows for the study of sensitivity with respect to the
parameters. Moreover, in the case of time-varying parameters, e.g., the prices
of assets, our model is able to accommodate for fluctuations and convergence
to a stable trajectory.

The second contribution of this paper is the stability analysis of the
equilibrium points of the proposed system. In particular, we show the
existence of these equilibria, their uniqueness and provide an explicit
expression for them. The third contribution is a computational method via
sign-space iteration that allows us to compute the attractive equilibrium
point for given initial conditions.

The paper is organized as follows. First, we introduce the notation. In
Section 2, we develop the networked model. In Section 3, we investigate the
existence, uniqueness and stability of the equilibrium points of our system.
In Section 4, we illustrate the computational algorithm. Finally, in Section
5, we discuss concluding remarks and future directions.

Notation. The symbols $\mathbb{0}_{n}$ and $\mathbb{1}_{n}$ denote the
$n$-dimensional column vector with all entries equal to 0 and to 1,
respectively. The identity matrix of order $n$ is denoted by $I_{n}$. Let
$J^{[k]}:={\rm diag}(1-2\phi^{[k]})$, where vector $\phi^{[k]}$ represents the
integer $k$ in binary representation; we denote the generic orthant $k$ by
$\mathcal{X}^{k}$, namely,
$\mathcal{X}^{k}:=\\{x\in\mathbb{R}^{n}|J^{[k]}x\geq 0\\}$. Given a generic
vector $V\in\mathbb{R}^{n}$, let the operator $y=\phi(V)$ be such that the
$i$th component $y_{i}=0$ if $V_{i}\geq 0$ or $y_{i}=1$, otherwise. The
notation $V\geq 0$ for a generic vector $V$ or $M\geq 0$ for a generic matrix
$M$ is to be intended elementwise.

A square real matrix $M\in\mathbb{R}^{n\times n}$ is said to be _Metzler_ if
its off-diagonal entries are nonnegative, namely, $M_{i,j}\geq 0$, $i\neq j$.
Every Metzler matrix $M$ has a real dominant eigenvalue $\lambda_{F}(M)$,
which is referred to as _Frobenius eigenvalue_. The corresponding left and
right vectors associated with $\lambda_{F}(M)$ are referred to as left and
right _Frobenius eigenvectors_ , respectively. A square real matrix $M$ is
said to be _Hurwitz_ if all its eigenvalues lie in the open left half plane. A
square matrix is said to be _Schur_ if all its entries are real and its
eigenvalues have absolute value less than one [13].

##  2 Problem Formulation

In this section, we introduce the model of a networked financial system, where
a number of organizations are linked through financial interdependencies. To
this aim, we consider a set of organizations $N=\\{1,\dots,n\\}$. Each
organization $i\in N$ is described by an equity value $V_{i}\in\mathbb{R}$,
which represents the total values of its shares.Organizations can invest in
primitive assets, namely, mechanisms that generate income in the form of a net
flow of cash over time. We consider a set of primitive assets
$M=\\{1,\dots,m\\}$. We denote the market price of asset $k$ by $p_{k}$ and
the share of the value of asset $k$ held by organization $i$ by $D_{ik}\geq
0$. Each organization can also hold shares of other organizations; for any
pair of organizations $i,j\in N$, let $C_{ij}\geq 0$ be the fraction of
organization $j$ owned by organization $i$.

The equity values of organizations can be determined by the following
discrete-time dynamical model:

$V(t+1)=CV(t)+Dp-B\phi(V(t)-\underaccent{\bar}{V}),$ (1)

where $t\in{\mathbb{Z}}^{+}$, $C$ is a nonnegative and nonsingular matrix
where $C_{ii}=0$ and $\mathbb{1}_{n}^{\top}C<\mathbb{1}_{n}^{\top}$ which
means that the equity value of each organization held by other organizations
cannot exceed the equity value of the organization itself, $D$ is a positive
matrix, $p$ a nonnull nonnegative vector, $B={\rm diag}(\beta)$ is a
nonnegative diagonal matrix with entries $\beta_{i}>0$, $i=1,2,\cdots,N$,
$\underaccent{\bar}{V}$ is the vector of threshold values
$\underaccent{\bar}{V}_{i}$ for all $i$ below which organization $i$ incurs a
failure cost $\beta_{i}$ and $\phi(V-\underaccent{\bar}{V})$ the vector of
indicator functions taking value $1$ if $V_{i}<\underaccent{\bar}{V}_{i}$ and
$0$ if $V_{i}\geq\underaccent{\bar}{V}_{i}$. The first term in (1) takes into
account the cross-holdings, the second term describes the primitive assets
held by each organization and the last term accounts for the discontinuous
drop imposed by the cost of failure.

The main difference with the papers in the literature is that our model,
namely, system (1), captures the impact of the transient onto the steady-state
market values. In order to emphasize this, we present the following example.

###### Example 1

Consider system (1) with $N=2$ organisations, $M=2$ assets. The initial
condition $V(0)$ is set to be random in $[2,5]$. Let
$C=[0\;0.025;\;0.005\;0]$, $D=[0.05\;0.05;\;0.05\;0.05]$,
$\beta=\mathbb{1}_{2}$, and $\underaccent{\bar}{V}=1.5\;\mathbb{1}_{20}$.

Now, let us consider two scenarios and let the asset price be a time-varying
signal $p(t)$ that changes over time. In the first scenario, $p(t)$ is set to
20 at the start of the simulation for both assets, $M=1,2$; a perturbation of
one time instant in length occurs at $t=4$, making the price drop to 14.9.
Likewise, in the second scenario, $p(t)$ is set to 20 at the start of the
simulation for both assets, $M=1,2$; the size of the perturbation is the same
as before, namely changing the value of $p(t)$ to 14.9, but the time window in
which the perturbation occurs spans many time instants, namely, from $t=4$ to
$t=20$. Figure 1 depicts the two scenarios (top-left and bottom-left) and the
corresponding $p(t)$ (top-right and bottom-right). Figure 1 (top) shows the
time evolution of the system, where the dashed red line represents the
threshold: in this scenario, both companies remain healthy. Figure 1 (bottom)
shows the situation where a longer-lasting perturbation affects the dynamics
leading to an equilibrium point where one company fails.

Remark. Despite the simplicity of this toy problem, the example shows the
ability of our model to capture the impact of the transient response to the
system dynamics and, thus, the convergence to other potential equilibria, even
though the final value of $p(t)$ is the same in both scenarios. This nonlinear
behavior marks the difference with what was previously investigated in the
literature and allows us to study perturbations of the market rather than just
the system state at an equilibrium.

Figure 1: Example 1: given identical initial conditions and parameters, we
consider two scenarios where $p(t)$ is a time-varying signal with same size of
perturbation but different duration. In the first scenario, both companies
remain healthy (top), whereas, due to the transient, one company fails in the
second scenario (bottom).

##  3 Characterization of the Equilibria

In this section, we study the equilibria of system (1). From the condition
that $0\leq B\phi(V(t)-\underaccent{\bar}{V})\leq B$, and recalling that $C$
is nonnegative we derive the following preliminary result.

###### Theorem 1

$V(t)\geq 0,\forall t\geq 0$ and $V(0)\geq\mathbb{0}_{n}$ if and only if

$Dp-\beta\geq 0.$ (2)

$\square$

Under condition (2), system (1) is a positive nonlinear switched system since
vector $\phi(V(t)-\underaccent{\bar}{V})$ can take a finite number of values
$\phi^{[k]}$, with $k=0,1,2,\cdots,2^{n}-1$. For instance, with $n=3$ we have:

$\begin{array}[]{c}\phi^{[0]}=\mathbb{0}_{n},\phi^{[1]}_{3}=\left[\begin{array}[]{c}0\\\
0\\\ 1\end{array}\right],\phi^{[2]}=\left[\begin{array}[]{c}0\\\ 1\\\
0\end{array}\right],\phi^{[3]}=\left[\begin{array}[]{c}0\\\ 1\\\
1\end{array}\right],\\\ \phi^{[4]}=\left[\begin{array}[]{c}1\\\ 0\\\
0\end{array}\right],\phi^{[5]}=\left[\begin{array}[]{c}1\\\ 0\\\
1\end{array}\right],\phi^{[6]}=\left[\begin{array}[]{c}1\\\ 1\\\
0\end{array}\right],\phi^{[7]}=\mathbb{1}_{n}.\end{array}$

As such, system (1) may possess at most $2^{n}$ equilibria in total. The
equilibria in orthant $k$, denoted by $\overline{V}^{[k]}$ and characterized
by the index $k$ is given by

$\overline{V}^{[k]}=(I_{n}-C)^{-1}(Dp-B\phi^{[k]}),\quad
s.t.\quad\phi(\overline{V}^{[k]}-\underaccent{\bar}{V})=\phi^{[k]}.$ (3)

Note that $V=0$ cannot be an equilibrium of the system since $Dp>0$ and that,
if (2) holds, $\overline{V}^{[k]}>0$. In the $k$th orthant the difference
$Y^{[k]}(t)=V(t)-\overline{V}^{[k]}$ follows the autonomous dynamics

$Y^{[k]}(t+1)=CY^{[k]}(t).$ (4)

Since $C$ is nonnegative with $\mathbb{1}_{n}^{\top}C<\mathbb{1}_{n}^{\top}$,
it turns out that $C$ is Schur-stable. Therefore, the following theorem can be
stated.

###### Theorem 2

Any equilibrium $\overline{V}^{[k]}$ which is in the interior of the $k$th
orthant $\mathcal{X}^{k}$ is locally asymptotically stable. $\square$

Remark. Note that there could be equilibria on the discontinuity points, but
these are fragile (unstable) and are not considered.

Figure 2: Example 1: since condition (2) is satisfied, $V(t)\geq 0,\forall
t\geq 0$ (left); network topology in the first four time instants (right).

###### Example 2

Consider system (1) with $N=20$ organisations, $M=10$ assets. The initial
condition $V(0)$ is set to be random in $[0,30]$. Let $C$ be set to random
values in $[0,0.01]$ such that $C_{ii}=0$ and
$\mathbb{1}_{n}^{\top}C<\mathbb{1}_{n}^{\top}$. Finally, let

$\displaystyle D=0.05\;\mathbb{1}_{20}\mathbb{1}^{\top}_{10}\quad
p=10\;\mathbb{1}^{\top}_{10},$
$\displaystyle\beta=\mathbb{1}_{20},\quad\underaccent{\bar}{V}=10\;\mathbb{1}_{20}.$

It is straightforward to see that $Dp-\beta=4\mathbb{1}^{\top}_{20}\geq 0$.
Therefore, in accordance to Theorem 1, the values of all companies remain
positive, namely, $V(t)\geq 0,\forall t\geq 0$. Figure 2 depicts this
scenario. Figure 2 (left) shows the time evolution of the system, where the
dashed red line represents the threshold. Figure 2 (right) shows the network
topology in first four instants, where companies are indicated by colored
nodes and edges indicate the cross-holdings between companies: the companies
whose values are above the threshold are indicated in blue, and in red,
otherwise.

Remark. This example shows that if the condition in Theorem 1 holds true, the
equity values of all organizations will remain positive at all time. This
provides an important addition to previous studies on this topic, as we are
able to predict the behavior of the system at every time instant.

We now turn our attention to the existence and uniqueness of the equilibrium
points in orthants $0$ and $2^{n}-1$, which we henceforth refer to as
_positive_ and _negative_ equilibrium points, respectively. To this aim,
consider:

$\begin{array}[]{c}V(t+1)=CV(t)+Dp-B\phi(V(t)-\underaccent{\bar}{V}),\\\
x(t)=V(t)-\underaccent{\bar}{V}.\end{array}$

The above system can be rewritten as

$\begin{array}[]{c}x(t+1):=Cx(t)+r-B\phi(x(t)),\\\
r:=(C-I_{n})\underaccent{\bar}{V}+Dp.\end{array}$ (5)

The above is a monotone system since $\phi(y)\geq\phi(x)$ if $y\leq x$. We can
now prove the following theorem.

###### Theorem 3

Consider system (5). In each open orthant $\mathcal{X}^{k}$, there exists at
most one equilibrium. Furthermore, the following points hold true:

  1. 1.

There exists an equilibrium point $\bar{x}\geq 0$ if and only if
$(I_{n}-C)^{-1}r\geq 0$.

  2. 2.

If $(I_{n}-C)^{-1}(r-\beta)\geq 0$, then there exists an equilibrium point
$\bar{x}\geq 0$ and it is the unique equilibrium.

  3. 3.

There exists an equilibrium point $\bar{x}<0$ if and only if
$(I_{n}-C)^{-1}(r-\beta)<0$.

  4. 4.

If $(I_{n}-C)^{-1}r<0$, then there exists an equilibrium point $\bar{x}<0$ and
it is the unique equilibrium.

$\square$

Proof. First, let us prove the first statement, namely, if an equilibrium
exists in orthant $k$, it is unique. Let

$\bar{x}^{[k]}=(I_{n}-C)^{-1}(r-B\phi^{[k]})\in\mathcal{X}^{k}$

be the generic equilibrium point in the $k$th orthant. By contradiction, let
us assume that a second equilibrium point exists in the same orthant. It is
straightforward to see that the calculation with a given $\phi^{[k]}$ would
produce the same equilibrium point. Note that in the rest of the proof, since
$C$ is Schur, then $(C-I_{n})$ is Hurwitz and Metzler and, therefore, the
inverse of the negative, namely, $(I_{n}-C)^{-1}\geq 0$, elementwise [13].
Let us now prove the rest point by point.

  1. 1.

Let $(I_{n}-C)^{-1}r\geq 0$, then $\bar{x}=(I_{n}-C)^{-1}r\geq
0\in\mathcal{X}^{0}$. Vice versa, assume that there exists a generic
equilibrium $\bar{x}\geq 0$, then $\bar{x}\in\mathcal{X}^{0}$. Therefore,
$\phi(\bar{x})=0$ and $(I_{n}-C)^{-1}r\geq 0$.

  2. 2.

Let $(I_{n}-C)^{-1}(r-\beta)\geq 0$, then
$(I_{n}-C)^{-1}r\geq(I_{n}-C)^{-1}\beta\geq 0$. It follows from the first
point that there exists an equilibrium $\bar{x}\geq 0$. Moreover, assume there
exists an equilibrium $\bar{x}^{[k]}$ in orthant $\mathcal{X}^{k}$, i.e.,
$\bar{x}^{[k]}=(I_{n}-C)^{-1}(r-B\phi(x^{[k]}))\geq(I_{n}-C)^{-1}(r-\beta)\geq
0$. Then, the unique equilibrium is in orthant $\mathcal{X}^{0}$.

  3. 3.

Let $(I_{n}-C)^{-1}(r-\beta)<0$, then
$\bar{x}=(I_{n}-C)^{-1}(r-\beta)<0\in\mathcal{X}^{2^{n}-1}$. Vice versa,
assume that there exists a generic equilibrium $\bar{x}<0$, then
$\bar{x}\in\mathcal{X}^{2^{n}-1}$. Therefore,
$\bar{x}=(I_{n}-C)^{-1}(r-\beta)<0$.

  4. 4.

Let $(I_{n}-C)^{-1}r\leq(I_{n}-C)^{-1}(r-\beta)<0$, then from point 3, there
exists an equilibrium $\bar{x}^{[k]}<0$. Moreover, assume there exists an
equilibrium $\bar{x}^{[k]}$ in orthant $\mathcal{X}^{k}$, i.e.,
$\bar{x}^{[k]}=(I_{n}-C)^{-1}r-B\phi(x^{[k]})\leq(I_{n}-C)^{-1}r<0$. Then, the
unique equilibrium is in orthant $\mathcal{X}^{2^{n}-1}$.

This concludes our proof. $\blacksquare$

###### Example 3

Consider system (5) with $N=20$ organisations, $M=10$ assets. The initial
condition $x(0)$ is set to be random in $[0,30]$. Let $C$ be set to random
values in $[0,0.01]$ such that $C_{ii}=0$ and
$\mathbb{1}_{n}^{\top}C<\mathbb{1}_{n}^{\top}$. We provide two sets of
simulations. Table 1 includes all the other parameters for each simulation.

Table 1: Set of parameters for each simulation. Simulation | $D$ | $p$ | $\beta$ | $\underaccent{\bar}{V}$
---|---|---|---|---
I | $0.06\;\;\mathbb{1}_{20}\mathbb{1}^{\top}_{10}$ | $10\;\mathbb{1}^{\top}_{20}$ | $\mathbb{1}_{20}$ | $10\;\mathbb{1}_{20}$
II | $0.03\;\;\mathbb{1}_{20}\mathbb{1}^{\top}_{10}$ | $10\;\mathbb{1}^{\top}_{20}$ | $\mathbb{1}_{20}$ | $10\;\mathbb{1}_{20}$

In the first set of simulations, the positive equilibrium, namely,
$\bar{x}\geq 0$ exists and is unique. This is in accordance with condition 1
and condition 2 of Theorem 3. This can be seen in Fig. 3 (top-left).
Similarly, in the second set of simulations, since the third and last
conditions of Theorem 3 hold true, the negative equilibrium point, i.e.,
$\bar{x}<0$, exists and is unique. Figure 3 (bottom-left) shows the second set
of simulations. Figure 3 (right) shows the network topology in the first and
third instant for each set of simulations. Colors have the usual meaning.

Figure 3: Example 2: the equilibrium point $\bar{x}\geq 0$ exists and is
unique as condition 2 of Theorem 3 holds true (top); similarly, since the 4-th
condition of Theorem 3 holds true, the equilibrium point $\bar{x}<0$ exists
and is unique (bottom).

Remark. A physical interpretation of this example follows. The translated
variable $x$ allows us to study the propagation of failures over time. If the
conditions in Theorem 3 hold true, we can show whether the system converges to
the equilibrium point in which all organizations are healthy or to the
equilibrium point where all fail.

Now, we provide a sufficient condition that guarantees that no equilibrium
point in the negative orthant exists with respect to a subgraph of the cross-
sharing $C$.

###### Proposition 1

Given a square principal submatrix of $C$, denoted by $\tilde{C}$, if the
following holds:

$\underaccent{\bar}{V}_{i}<\frac{(Dp-\beta)_{i}}{1-\lambda_{F}(\tilde{C})},\quad\forall
i,$ (6)

where $\tilde{C}$ is a principal sparse subgraph of $C$, then there does not
exist the negative equilibrium point, i.e., at least one organization remains
healthy.

Proof. Assume that equation (6) holds true. Since
$\lambda_{F}(\tilde{C})\leq\lambda_{F}(C)$ [13], then

$\underaccent{\bar}{V}_{i}<\frac{(Dp-\beta)_{i}}{1-\lambda_{F}(C)},\quad\forall
i.$

Let $x>0$ be the left Frobenius eigenvector of $C$, i.e.,
$x^{\top}C=\lambda_{F}(C)x^{\top}$. Then,

$x^{\top}\underaccent{\bar}{V}<\frac{x^{\top}(Dp-\beta)}{1-\lambda_{F}(C)}=x^{\top}(I_{n}-C)^{-1}(Dp-\beta),$

so that, being $Dp+(C-I_{n})\underaccent{\bar}{V}=r$, we have:

$\begin{array}[]{lll}x^{\top}\underaccent{\bar}{V}<x^{\top}(I_{n}-C)^{-1}(r-(C-I_{n})\underaccent{\bar}{V}-\beta),\\\
x^{\top}\underaccent{\bar}{V}<x^{\top}\underaccent{\bar}{V}+x^{\top}(I_{n}-C)^{-1}(r-\beta),\\\
x^{\top}(I_{n}-C)^{-1}(r-\beta)>0.\end{array}$

The above implies $(I_{n}-C)^{-1}(r-\beta)\nless 0$. From point 3 of Theorem
3, then no equilibrium $\bar{x}<0$ exists. $\blacksquare$

Remark. Condition (6) provides a relation among three main elements of the
original system: the thresholds, the underlying topology and the external
assets. Therefore, since it is desirable that the system does not converge to
the negative equilibrium point, by violating this condition on
$\underaccent{\bar}{V}$ we ensure that at least one company is healthy.

##  4 Sign-space Iteration

In this section, we analyze the behavior of the trajectories of financial
organizations that are below and above the threshold. To this end, let us
rewrite system (5) in a more compact way as:

$x(t+1)=Cx(t)+\Psi(x(t)),$ (7)

where $\Psi(x):=r-B\phi(x)$ and, in particular, with a slight abuse of
notation, the following

$\Psi(x)=\Psi(\mbox{sign}(x)),\leavevmode\nobreak\ \leavevmode\nobreak\
\leavevmode\nobreak\ \Psi_{k}\in\\{\psi_{k}^{-},\psi_{k}^{+}\\}$

depends on the sign of $x$, $\psi_{k}^{-}=r_{k}-\beta_{k}$ and
$\psi_{k}^{+}=r_{k}$ can both take positive and negative values. Here, the
$\mbox{sign}(x)$ function is defined as:

$\mbox{sign}(x):=1-2\phi(x)=\left\\{\begin{array}[]{ll}+1,\quad\mbox{if}\;x\geq
0\\\ -1,\quad\mbox{if}\;x<0.\end{array}\right.$

Let $P=(I-C)^{-1}$. Then, an explicit expression for a candidate equilibrium
is given by

$x=P\Psi(x),$

for $\psi_{k}\in\\{\psi_{k}^{-},\psi_{k}^{+}\\}$. There are $2^{n}$ such
candidates.

Let $\sigma$ be a sign vector $\sigma(k)\in\\{-,+\\}$ and define the iteration

$\sigma(k+1)=\mbox{sign}\left[P\Psi(\sigma_{k})\right],$ (8)

and consider a fixed point of this iteration (if any)

$\bar{\sigma}=\mbox{sign}\left[P\Psi(\bar{\sigma})\right].$ (9)

The vector $x$ is a rest point if and only if $\sigma=\mbox{sign}(x)$
satisfies (9). In other words, equation (9) characterises all the rest points
and finding such rest points is equivalent to finding fixed points of the sign
iteration.

The next result follows immediately from the monotone nature of our system,
which builds on the condition that $\Psi(y)\geq\Psi(x)$ if $y\geq x$.

###### Lemma 1

Iteration (8) is monotone: if $\sigma^{A}(0)\leq\sigma^{B}(0)$ are initial
sign vectors, then the corresponding iteration satisfies
$\sigma^{A}(k)\leq\sigma^{B}(k)$.

To compute the worst case rest point we initialize
$\sigma(0)=[--\dots-]^{\top}$. If $\sigma(1)$ has all $-$ signs we have a rest
point (all organizations fail). Conversely, let us assume there are $+$ signs.
These are nodes that cannot fail. For instance,

$\sigma(0)=[--------]^{\top}\leavevmode\nobreak\ \leavevmode\nobreak\
\Rightarrow\sigma(1)=[-+--++--]^{\top}$

means that nodes $2$, $5$, and $6$ cannot be negative at the equilibrium, due
to the monotonicity. These are safe nodes. We denote by $I_{safe}(k)$ the set
of safe nodes, namely those that have $+$ signs at the $k$th iteration.
Initially, $I_{safe}(0)=\emptyset$, then it cannot reduce to

$I_{safe}(0)\subseteq I_{safe}(1)\subseteq I_{safe}(2)\dots$

Therefore, the iteration converges, stopping when
$\sigma(k+1)=\sigma(k)=\sigma^{W}$. In turn, this means
$I_{safe}(k+1)=I_{safe}(k)=I_{safe}^{W}$. This corresponds to the worst
equilibrium $\bar{x}^{W}:=P\Psi(\sigma^{W}))$.

By symmetry, we can iterate from the $+$ equilibrium. In this case the safe
node set cannot grow, namely,

$I_{safe}(0)\supseteq I_{safe}(1)\supseteq I_{safe}(2)\dots$

The iteration converges to some $\sigma^{B}$ and the set of safe nodes
converges to $I_{safe}^{B}$. This corresponds to the best equilibrium
$\bar{x}^{B}:=P\Psi(\sigma^{B}))$. The next result follows immediately from
the above.

###### Lemma 2

Any trajectory $\sigma(k)$ satisfies the property

$\sigma^{W}\leq\sigma(k)\leq\sigma^{B}.$

The above bounds hold true also for the fixed points, i.e.,

$\sigma^{W}\leq\bar{\sigma}\leq\sigma^{B}.$

This means that any fixed point for the system satisfies

$P\Psi(\sigma^{w}))=\bar{x}^{W}\leq\bar{x}\leq\bar{x}^{B}=P\Psi(\sigma^{B}).$

If $(P\psi^{-})_{i}>0$, the $i$th component is always positive (fixed point of
the iterative scheme). Likewise, if $(P\psi^{+})_{i}<0$, the $i$th component
is always negative.

Consider the trajectory of system (5) starting from the negative candidate
equilibrium as:

$x^{W}(t),\leavevmode\nobreak\ x^{W}(0)=P\Psi^{-}.$

This sequence is monotonically nondecreasing. Indeed,

$\displaystyle x^{W}(1)$ $\displaystyle=Cx^{W}(0)+\Psi^{-}$
$\displaystyle=P\Psi^{-}+\Psi(x^{W}(0))-(I-C)P\Psi^{-}$
$\displaystyle=x^{W}(0)+\Psi(x^{W}(0))-\Psi^{-}\geq x^{W}(0).$

Then, recursively, by monotonicity, we have

$x^{W}(t+1)\geq x^{W}(t).$

Therefore $x^{W}(t)$ converges to an equilibrium $\bar{x}^{W}$ from below.
Conversely, consider the trajectory of system (5) starting from the positive
candidate equilibrium as:

$x^{B}(t),\leavevmode\nobreak\ x^{B}(0)=P\Psi^{+}.$

This sequence is monotonically nonincreasing, and symmetrically to the above
$x^{B}(t)$ converges to an equilibrium $\bar{x}^{B}$ from above.

Necessarily, these equilibria are related to the bounds $\sigma^{W}$ and
$\sigma^{B}$ introduced before, then we have

$\bar{x}^{W}\geq P\Psi(\sigma^{w}),\leavevmode\nobreak\ \leavevmode\nobreak\
\leavevmode\nobreak\ \leavevmode\nobreak\ \leavevmode\nobreak\
\leavevmode\nobreak\ \bar{x}^{B}\leq P\Psi(\sigma^{B}),$

since these are conditions that hold true for all equilibria.

In fact, the inequalities are satisfied with equal sign. Indeed the initial
conditions satisfy

$x^{W}(0)=P\Psi^{-}\leq\bar{x}^{W},\quad x^{B}(0)=P\Psi^{+}\geq\bar{x}^{B},$

so $x^{W}(t)$ cannot become greater than $\bar{x}^{W}$ and $x^{B}(t)$ cannot
become smaller than $\bar{x}^{B}$.

Remark. Equilibria $\bar{x}^{W}$ and $\bar{x}^{B}$ are attractors w.r.t. the
initial conditions in othant $2^{n-1}$ and $0$, respectively.

As it is clear from the previous derivation, we further remark that there are
points where the $+$ and $-$ are fixed from initialization. In particular, the
indices where

$(Pr)_{i}<0$

holds true are $-$ in all iterations. Vice versa, the indices where

$(P(r-\beta))_{i}>0$

holds true are $+$ in all iterations.

###### Theorem 4

Consider system (7). Let $i=1,\dots,n$.

  * 1.

Case 1. Let $(Pr)_{i}<0$. Then, $\bar{x}_{i}<0$.

  * 2.

Case 2. Let $(P(r-\beta))_{i}\geq 0$. Then, $\bar{x}_{i}\geq 0$.

Proof. The proof addresses the above two points one by one.

  * 1.

Case 1. The following

$\bar{x}_{i}=\sum_{j}P_{ij}r_{j}-\Bigg{(}\sum_{j}P_{ij}\beta_{j}+\cdots\Bigg{)}$

is always negative as the first sum is negative and the quantity after the
subtraction is positive.

  * 2.

Case 2. The following

$\bar{x}_{i}=\Bigg{(}\sum_{j}P_{ij}r_{j}-\sum_{j}P_{ij}\beta_{j}\Bigg{)}+\cdots$

is always positive as the first components in parentheses are positive and the
other quantities are also positive.

This concludes our proof. $\blacksquare$

Remark. The convergence of the trajectory to a specific configuration of signs
means that there exist no oscillations for the dynamical system in the
corresponding orthant and the market values converge to the equilibrium point
in that orthant.

A direct consequence of Theorem 4 is the following result, which provides a
bound on the number of failed organizations (and saved ones).

###### Corollary 1

The number of failed organisations $n_{F}$ is such that
$\mathbb{1}^{\top}_{n}\phi((I_{n}-C)^{-1}r)\leq
n_{F}\leq\mathbb{1}^{\top}_{n}\phi((I_{n}-C)^{-1}(r-\beta))$. $\square$

Proof. From Theorem 3, $\bar{x}^{\rm max}=(I_{n}-C)^{-1}r$ and $\bar{x}^{\rm
min}=(I_{n}-C)^{-1}(r-\beta)$ such that a generic equilibrium $\bar{x}$, it
holds $\bar{x}^{\rm min}\leq\bar{x}\leq\bar{x}^{\rm max}$. Since
$\mathbb{1}^{\top}_{n}\phi(\bar{x})=n_{F}$, the number of failed organizations
obeys the stated inequality, equivalent to

$\mathbb{1}^{\top}_{n}\phi(-\underaccent{\bar}{V}+(I_{n}-C)^{-1}Dp)\leq
n_{F}\leq\mathbb{1}^{\top}_{n}\phi(-\underaccent{\bar}{V}+(I_{n}-C)^{-1}(Dp-\beta)).$

This concludes our proof. $\blacksquare$

###### Example 4

Before concluding the paper, we provide one last example in the spirit of [4,
11]. We now consider system (1) with $N=9$ organisations, $M=9$ assets. In
particular, our analysis involves the cross-holdings among nine countries,
i.e., France (FR), Germany (DE), Greece (GR), Italy (IT), Japan (JP), Portugal
(PT), Spain ( ES), United Kingdom (GB) and USA (US).

The matrix of cross-holdings $C$ is summarised in Table 2. We assume that
$D=I_{N}$, and $p$ is proportional to the countries GDP as shown in Table 3.
The initial condition $V(0)$ is set to be
$V(0)=[15.2838,19.9137,0.9863,9.0642,28.3350,0.7829,8.8020,$
$12.1361,59.8130]^{\top}$. We set $\beta=0.5\;\mathbb{1}_{20}$ and
$\underaccent{\bar}{V}=10\;\mathbb{1}_{20}$.

Table 2: Table providing the values of the matrix of cross-holdings $C$, adapted from [4]. | FR | DE | GR | IT | JP | PT | ES | GB | US
---|---|---|---|---|---|---|---|---|---
FR | $0$ | $.03$ | $.01$ | $.07$ | $.01$ | $.04$ | $.04$ | $.05$ | $.04$
DE | $.04$ | $0$ | $.06$ | $.03$ | $.00$ | $.05$ | $.04$ | $.09$ | $.04$
GR | $.00$ | $.00$ | $0$ | $.00$ | $.00$ | $.00$ | $.00$ | $.00$ | $.00$
IT | $.01$ | $.03$ | $.00$ | $0$ | $.00$ | $.01$ | $.02$ | $.01$ | $.00$
JP | $.04$ | $.02$ | $.00$ | $.02$ | $0$ | $.01$ | $.01$ | $.06$ | $.10$
PT | $.00$ | $.00$ | $.00$ | $.00$ | $.00$ | $0$ | $.00$ | $.00$ | $.00$
ES | $.01$ | $.02$ | $.01$ | $.02$ | $.00$ | $.15$ | $0$ | $.09$ | $.02$
GB | $.03$ | $.02$ | $.01$ | $.01$ | $.01$ | $.02$ | $.01$ | $0$ | $.04$
US | $.04$ | $.02$ | $.01$ | $.02$ | $.02$ | $.02$ | $.02$ | $.09$ | $0$
Table 3: Original primitive asset values $p$ [4]. Country | Relative GDP
---|---
FR | $12.29$
DE | $16.81$
GR | $1.02$
IT | $9.30$
JP | $20.00$
PT | $1.00$
ES | $6.00$
GB | $12.99$
US | $75.70$

We show the behaviour of the nine countries and their convergence to
$\overline{V}\geq 0$. This is in accordance with Theorem 1. Figure 4 shows
this scenario.

Figure 4: Behaviour of the system representing 9 countries and the cross-
holdings among them.

Remark. This last example provides an application of Theorem 1 in a real life
scenario where the organizations are represented by a set of countries.
Analogously to Example 2, we can determine the evolution of the equity values
since the condition of Theorem 1 holds true, meaning that the equity value of
every country will remain positive at all times.

##  5 Conclusions

In this paper, we study the propagation of failures in financial systems.
Future works include: i) the characterization of the invariance of each
orthant of the $2^{n}$ space and of the equilibria in each orthant, ii) the
study of the worst-case scenario where all organizations fail and the
conditions to prevent it, and iii) asset investments as feedback control
design.

## Acknowledgments

LS has been partly supported by the HUMAT Research Project, financed by the US
Army Research Lab, USA, in collaboration with the Alan Turing Institute, UK.
DB has been supported the SMiLES Research Project, part of the Research
Programme Sustainable Living Labs, which is co-financed by the Dutch Research
Council (NWO), the Ministry of Infrastructure and Water Management, The
Netherlands, the Taskforce for Applied Research (SIA), The Netherlands, and
the Top Sector Logistics, The Netherlands. FB and PC has been partly supported
by the Italian grant PRIN 2017 “Monitoring and Control Underpinning the
Energy-Aware Factory of the Future: Novel Methodologies and Industrial
Validation” (ID 2017YKXYXJ). FB has been supported by the European Union -
NextGenerationEU.

## References

  * [1] D. Ahn, K. Kim, Optimal intervention under stress scenarios: A case of the Korean financial system, Oper. Res. Lett. 47 (4) (2019) 257–263.
  * [2] D. Acemoglu, V.M. Carvalho, A. Ozdaglar and A. Tahbaz-Salehi, The network origins of aggregate fluctuations, Econometrica 80 (2012) 1977–2016.
  * [3] D. Acemoglu, A. Ozdaglar and A. Tahbaz-Salehi, Systemic risk and stability in financial networks, Am. Econ. Rev. 105 (2) (2015) 564–608.
  * [4] J.R. Birge, Modeling Investment Behavior and Risk Propagation in Financial Networks, SSRN (2021).
  * [5] F. Brioschi, L. Buzzacchi and M.G. Colombo, Risk capital financing and the separation of ownership and control in business groups, J. Bank. Financ. 13 (4) (1989) 747–772.
  * [6] A. Cabrales, P. Gottardi and F. Vega-Redondo, Risk sharing and contagion in networks, Rev. Financ. Stud. 30 (9) (2017) 3086–3127.
  * [7] G.C. Calafiore, G. Fracastoro and A.V. Proskurnikov, Control of dynamic financial networks, IEEE Control Syst. Lett. 6 (2022) 3206–3211.
  * [8] V.M. Carvalho, Aggregate fluctuations and the network structure of intersectoral trade, The University of Chicago.
  * [9] H. Chen, T. Wang and D.D. Yao, Financial network and systemic risk – a dynamic model, Prod. Oper. Manag. 30 (8) (2021) 2441–2466.
  * [10] L. Eisenberg and T.H. Noe, Systemic risk in financial systems, J. Manag. Sci. 47 (2) (2001) 236–249.
  * [11] M. Elliott, B. Golub and M.O. Jackson, Financial networks and contagion, Am. Econ. Rev. 104 (10) (2014) 3115–3153.
  * [12] H. Elsinger, Financial networks, cross holdings, and limited liability, Working Papers 156, Österreichische Nationalbank (Austrian Central Bank) (2009).
  * [13] L. Farina and S. Rinaldi, Positive linear systems – Theory and applications, Wiley & Sons, New York, 2000.
  * [14] T. Fischer, No-arbitrage pricing under systemic risk: Accounting for cross-ownership, Math. Financ. 24 (1) (2014) 97–124.
  * [15] P. Glasserman and H.P. Young, How likely is contagion in financial networks? J. Bank. Financ. 50 (2015) 383–399.
  * [16] P. Glasserman and H.P. Young, Contagion in financial networks, J. Econ. Lit. 54 (3) (2016) 779–831.
  * [17] S. Karl and T. Fischer, Cross-ownership as a structural explanation for over- and underestimation of default probability. Quant. Finance 14 (6) (2014) 1031–1046.
  * [18] S. Ramirez, M.v.d. Hoven and D. Bauso, A stochastic model for cascading failures in financial networks, IEEE Trans. Control. Netw. Syst. doi: 10.1109/TCNS.2023.3256273.
  * [19] L.C.G. Rogers and L.A.M. Veraart, Failure and rescue in an interbank network, J. Manag. Sci. 59 (4) (2013) 882–898.
  * [20] S. Weber and K. Weske, The joint impact of bankruptcy costs, fire sales and cross-holdings on systemic risk in financial networks, Probability, Uncertainty and Quantitative Risk 2 (9) (2017).


# An Analysis of Security Vulnerabilities in Container Images for Scientific
Data Analysis

Bhupinder Kaur, Mathieu Dugré, Aiman Hanna, Tristan Glatard
Department of Computer Science and Software Engineering
Concordia University
Montreal, Canada

###### Abstract

Software containers greatly facilitate the deployment and reproducibility of
scientific data analyses in various platforms. However, container images often
contain outdated or unnecessary software packages, which increases the number
of security vulnerabilities in the images, widens the attack surface in the
container host, and creates substantial security risks for computing
infrastructures at large. This paper presents a vulnerability analysis of
container images for scientific data analysis. We compare results obtained
with four vulnerability scanners, focusing on the use case of neuroscience
data analysis, and quantifying the effect of image update and minification on
the number of vulnerabilities. We find that container images used for
neuroscience data analysis contain hundreds of vulnerabilities, that software
updates remove about two thirds of these vulnerabilities, and that removing
unused packages is also effective. We conclude with recommendations on how to
build container images with a reduced amount of vulnerabilities.

##  1 Introduction

Software containers have emerged has an efficient solution to deploy
scientific data analyses in various platforms, due to their portability, ease
of use, and limited overhead. Taking advantage of core Linux kernel features
such as namespaces, control groups, and chroot, containers isolate processes
from the host computer and often can control the memory, CPU, network, and
file-system resources assigned to them. However, containers still share the
kernel, mounted file systems and some devices with the host, which raises
security concerns [8, 11, 1] and opens the door to privilege escalation,
denial of service, information leak, and other types of attacks [2].

Container images typically include full operating system (OS) distributions in
addition to data analysis software and their dependencies. They are rarely
updated due to concerns that updated software may be incompatible or may
interfere with the results via numerical perturbations propagating in the
analyses in unknown ways [6, 4]. Images also typically include more
dependencies than required, to make them easier to reuse between experiments.
As a result, over 30% of official images in DockerHub have been shown to
contain high-priority security vulnerabilities [7], images on average contain
over 180 vulnerabilities [10], and vulnerabilities are often caused by
outdated packages [12].

Scientific data analyses typically involve a range of computational
infrastructures, including personal workstations, lab servers, HPC clusters,
and cloud computing platforms. It is common for researchers to have access to
multiple systems through a combination of credentials and to migrate analyses
depending on their evolution. As a result, an attacker gaining access to one
of these systems, possibly through a vulnerable container, might be able to
compromise an extensive infrastructure and use it for malicious purposes.

In this study, we focus on the vulnerabilities present in container images
used in scientific data analysis, in particular in the neuroimaging domain. We
address the following questions:

What is the current amount of vulnerabilities in container images used in
scientific analyses? Vulnerabilities are possible attack vectors that can
seriously compromise the security of computing systems and the integrity of
user data. We report vulnerability scans produced by four popular image
scanning tools: Anchore, Vuls, Clair, and Singularity tools.

Can the amount of vulnerabilities be reduced by updating the images? To avoid
breaking software dependencies and introducing numerical perturbations,
container images used in scientific analyses often include outdated software.
We report on the effect of software updates on the amount of vulnerabilities
found in images.

Can the amount of vulnerabilities be reduced by minifying images? Container
images often include more software packages than necessary for a typical
analysis. We report on the impact of unused software packages on the presence
of vulnerabilities.

The remainder of this paper describes the container images and scanners used
in our experiment, and our methodology for updating and minifying images.
Results present the vulnerabilities detected in container images, quantify the
effectiveness of updating and minifying images, and explain the differences
observed between scanners. In conclusion, we provide a set of image creation
guidelines for a more secure deployment of containers in scientific analyses.

##  2 Materials and Tools

We used container images from two popular application frameworks, as well as
four of the major image scanners.

###  2.1 Container Images

We scanned all container images available at the time of this study on two
containerization frameworks used in neuroscience: BIDS apps [5] (26 images)
and Boutiques [3] (18 images), totalling 44 container images. At the time of
the study, BIDS apps had 27 images, out of which one wasn’t available on
DockerHub. Boutiques had 49 images, however, only 23 unique images were
listed, out of which 3 couldn’t be retrieved and 2 were already included in
BIDS apps. All the final 26 images from BIDS apps were Docker images, whereas
the 18 Boutiques images contained 12 Docker images and 6 Singularity images.

###  2.2 Image Scanners

We compared the results obtained with four container image scanners: Anchore,
Vuls, and Clair to scan Docker images, and Singularity Container Tools
(Stools) to scan Singularity images.

Anchore is an end-to-end, open-source container security platform. It analyzes
container images and lists vulnerable OS packages, non-OS packages (Python,
Java, Gem, and npm), and files. In our experiments, we used Anchore Engine
version 0.5.0 through Docker image anchore/anchore-engine:v0.5.0, and Anchore
vulnerability database version 0.0.11.

OS | Anchore | Vuls | Clair
---|---|---|---
Alpine | Alpine-SecDB | Alpine-SecDB | Alpine-SecDB
CentOS | Red Hat OVAL Database | Red Hat OVAL Database and Red Hat Security Advisories | Red Hat Security Data
Debian | Debian Security Bug Tracker | Debian OVAL Database and Debian Security Bug Tracker | Debian Security Bug Tracker
Ubuntu | Ubuntu CVE Tracker | Ubuntu OVAL Database | Ubuntu CVE Tracker
Table 1: Vulnerability databases used by scanners for different OS
distributions. All scanners also refer to the National Vulnerability Database
(NVD) for vulnerability metadata.

Vuls is an open-source vulnerability scanner for Linux and FreeBSD. It offers
both static and dynamic scanning, and both local and remote scanning. In our
experiments, we used Vuls 0.9.0, executed through Docker image vuls/vuls:0.9.0
in remote dynamic mode.

Clair is an open-source and extensible vulnerability scanner for Docker and
OCI (Open Container Initiative) container images, developed by CoreOS (now
Container Linux), a Linux distribution to deploy container clusters. We used
Clair through Clair-scanner, a tool to facilitate the testing of container
images against a local Clair server. We used Clair version 2.0.6, executed
through Docker image arminc/clair-local-scan:v2.0.6. For the vulnerability
database, we used Docker image arminc/clair-db:latest, last updated on
2019-09-18.

Singularity Tools (Stools) are an extension of Clair for Singularity images.
Stools exports Singularity images to tar.gz format, acting as a single layer
Docker image to circumvent the Docker-specific requirements in the Clair API.
In our experiments, we used Singularity Tools version 3.2.1 through Docker
image vanessa/stools-clair:v3.2.1. Since Stools uses Clair internally for
scanning, the vulnerability databases used by Stools are the same as mentioned
for Clair. To scan Singularity images, we followed the steps mentioned in the
Stools documentation.

###  2.3 Vulnerability Databases

Scanners refer to two types of vulnerability databases (Table 1). The first
one is the Open Vulnerability and Assessment Language (OVAL) database, an
international open standard that supports various OS distributions including
Ubuntu, Debian and CentOS but not Alpine. The second one are vulnerability
databases from specific OS distributions, such as Alpine-SecDB, Debian
Security Bug Tracker, Ubuntu CVE Tracker, or Red Hat Security Data. In these
databases, OS distributions often assign a status to each vulnerability, to
keep track of required and available security fixes in different versions of
the distribution. Vuls uses OVAL databases for all distributions except
Alpine. On the contrary, Clair exclusively refers to distribution-specific
databases. Anchore uses OVAL only for CentOS, as distribution-specific
databases are assumed to be more complete. It is also worth noting that there
is no vulnerability data for Ubuntu 17.04 and 17.10 distributions in the OVAL
database, since these distributions have reached end of life, meaning that
images with these distributions cannot be scanned with Vuls.

For CentOS images, Anchore and Clair report scanning results using Red Hat
Security Advisory (RHSA) identifiers, whereas Vuls uses the Common
Vulnerabilities and Exposures (CVE) identifiers used in OVAL. We mapped RHSA
identifiers to corresponding CVE identifiers, to allow for a comparison
between scanners.

Different vulnerabilities may be reported by scanners if scanning experiments
take place on different dates. To avoid such discrepancies, we froze the
vulnerability databases used by these scanners as of 2019-09-25.

###  2.4 Image Update

A first approach to reduce the number of vulnerabilities in container images
is to update their packages to the latest version available in the OS
distribution. To study the effect of such updates, we created a script
(available here) to identify the package manager in the image, and invoke it
to update all OS packages. We updated images on 2019-11-05.

###  2.5 Image Minification

A second approach to reduce the number of vulnerabilities in the images is to
remove unnecessary packages, an operation potentially specific to each
analysis. Although vulnerabilities in unused packages could not be directly
exploited when running the analysis provided by the container image, they
still increase the risk of escalation attacks and should therefore be avoided.

We used the open-source ReproZip tool [9] to capture the list of packages used
by an analysis. ReproZip first captures the list of files involved in the
analysis, through system call interception, then retrieves the list of
associated software packages, by querying the package manager. We extend this
list with a passlist of packages required for the system to function, such as
coreutils and bash, and with all the dependencies of the required packages,
retrieved using Debtree. Repoquery could be used in RPM-based distributions
instead. Our minification script, available here, installs ReproZip in the
image to minify, runs an analysis to collect a ReproZip trace, and finally
deletes all unnecessary packages. We had used the Neurodocker tool initially,
but it did not affect the detected vulnerabilities as it was removing unused
files without using the package manager.

Image minification is a tedious operation, as it requires (1) creating
relevant analysis examples and (2) running these examples in the container
image, to identify the packages required by the application. The resulting
minified container image is only valid for the examples selected in the
minification process, as other executions might require a different set of
packages.

While the Boutiques specification allows developers to specify analysis tests,
we found that this feature was not consistently used in the studied container
images. Therefore, we relied on analysis examples found in the documentation
of the applications. Using this approach, we minified five Debian- or Ubuntu-
based BIDS app images.

##  3 Results

Figure 1 presents our results. All the collected data are available in our
GitHub repository at https://github.com/big-data-lab-team/container-
vulnerabilities-paper with a Jupyter notebook to regenerate the figures.

###  3.1 Detected Vulnerabilities

Figure 1:  Number of vulnerabilities detected by Anchore and Stools in
container images. (A) Number of vulnerabilities by container image and
severity, showing hundreds of detected vulnerabilities per image. Images
s*,t*,u*,v*,w* and x* are Singularity images scanned by Stools and others are
Docker images scanned using Anchore. High and critical vulnerabilities are
represented with the same solid color and critical vulnerabilities are
reported between brackets. (B) Effect of image minification and package update
on 5 container images, showing that both techniques are complementary (C)
Number of vulnerabilities by number of packages, showing a strong linear
relationship. (D) Number of vulnerabilities by number of packages _after
package update_ , showing that software updates importantly reduce the number
of detected vulnerabilities.

An important amount of vulnerabilities were found in the tested container
images (Fig 1-A), with an average of 460 vulnerabilities per image and a
median of 321. Moreover, a significant fraction of detected vulnerabilities
are of high severity (CVSS score ¿=7.0) and a few of them are of critical
severity (CVSS ¿= 9.0). Remote attackers could possibly exploit these
vulnerabilities to execute arbitrary code in the container or to store
arbitrary files in the system. For instance, vulnerability CVE-2019-3462 could
lead to remote code execution through human-in-the-middle attacks and
vulnerability CVE-2018-1000802 could lead to arbitrary file injections in the
filesystem through unfiltered Python user input. Among other consequences,
remote code execution and injection of arbitrary files could be leveraged to
steal user credentials, to use CPU cycles or storage space for illegitimate
purposes, or to attempt denial-of-service attacks against the system.

Images based on the Alpine distribution had the lowest numbers of
vulnerabilities, but no significant difference in the numbers of
vulnerabilities detected in Ubuntu, Debian or CentOS distributions was
observed.

Unsurprisingly, a strong linear relationship is found between the number of
detected vulnerabilities and the number of packages present in the image (Fig
1-C, r=0.82, $p\textless 10^{-11}$). On average, 1.7 vulnerabilities are
introduced for each new package installation. This observation motivates a
systematic review of software dependencies by application developers, to avoid
unnecessary packages in container images. Compared to Ubuntu and Debian
distributions, CentOS images seem to have a lower number of vulnerabilities by
package on average, although data is too scarce to conclude.

###  3.2 Effect of image update

Updating container images reduces the number of vulnerabilities by package by
a factor of 3 on average, resulting in only 0.6 extra vulnerabilities by
package (Fig 1-D, r=0.81, $p\textless 10^{-7}$). Twelve container images are
missing on this figure. Six of them are Singularity images that we did not
update and six of them could not be updated by our script due to the following
issues. One image was built from base Docker image CentOS 7.1.1503 that
includes package fakesystemd conflicting with several other distribution
packages: updating would require either updating the base image or swapping
package fakesystemd for systemd. Three images were build from Ubuntu 17.04 or
Debian 8 that reached end of life: updading would require changing the source
list to make it point to old releases. Two images could not be updated because
some files previously installed through the package manager were removed by
other means, leading to failure of the update process. Software updates did
not break the tested analyses in the remaining images. We did not investigate
the potential consequences of image updates on numerical stability as it would
require a full separate study. Updating packages appears to be an efficient
way to avoid vulnerabilities. It is not an ultimate solution though, as a
substantial number of vulnerabilities remain.

###  3.3 Effect of minification

Using the ReproZip-based approach described previously, we minified 5
different images covering the spectrum of detected vulnerabilities (Fig 1-B).
We find that minification reduces the number of vulnerabilities, albeit less
systematically than package update. For some container images, such as image
S, minification removes more than 70% of the detected vulnerabilities. For
other images, such as image g, it only reduces the number of vulnerabilities
by less than 1%. The effect of minification stems from the number of packages
that can be removed, which varies greatly across images. For instance, images
g and a have a large number of packages, but the last majority of them is
required by the analysis, which makes minification less useful. In other
cases, a limited number of unnecessary packages contain a significant number
of vulnerabilities, which makes minification very impactful. This was the case
in images d, S and U, where removing compilers and kernel headers reduced the
number of vulnerabilities by an important fraction. Minification did not
create any errors in these images as all the dependencies were taken care of
properly. Common packages removed by the minification process were compilers,
unused Python packages, and unused file compression utilities.

###  3.4 Combined effect of image update and minification

Package update and image minification remove different types of
vulnerabilities. The former is efficient against vulnerabilities that have
been fixed by package maintainers, while the latter targets unused software.
In two of the five tested images (images S and U), we find that combining
update and minification further reduces the number of vulnerabilities compared
to using only one of these processes (Fig 1-B).

###  3.5 Differences between scanners

The results presented so far were obtained with Anchore (Docker images) and
Stools (Singularity images). We scanned the Docker images with two other
tools, Clair and Vuls, to evaluate the stability of our results. Important
discrepancies were found between scanners (Fig 2), in particular between
Anchore and the other two scanners, for which Jaccard coefficients as low as
0.6 were found, meaning that scanning results only overlapped by 60%. Vuls and
Clair appear to be in better agreement, with a Jaccard coefficient of 0.8.

We analyzed these results and explained some reasons behind the observed
discrepancies. Out of 4453 vulnerabilities detected by Anchore only (region 1
in Fig 2), 4443 are found in the development package of the C library (linux-
libc-dev in Ubuntu and Debian). Clair detects only Debian vulnerabilities in
linux-libc-dev, whereas Vuls do not detect vulnerabilities in this package at
all. Since Anchore ignores Debian vulnerabilities flagged as minor, it might
either detect (region 2) or ignore (region 3) the Debian vulnerabilities
detected by Clair in linux-libc-dev. The remaining 10 vulnerabilities in
region 1 are found in sub-packages of vulnerable packages: they are correctly
reported by Anchore and missed by Vuls and Clair.

Many vulnerabilities in region 3 and 4 are from images based on Ubuntu 14.04.
In the Ubuntu CVE tracker database used by Clair and Anchore, there are two
entries for Ubuntu 14.04: one for LTS (Long-Term Support), a Ubuntu release
with 5 years of technical support, and another one for ESM (Extended Security
Maintenance), a release that provides security patches beyond the 5 years
covered by LTS. Although all the scanned images are LTS, Clair refers to the
ESM database entry while Anchore and Vuls refer to the LTS database entry. The
vulnerabilities present in region 3 due to this discrepancy are incorrectly
missed by Anchore and Vuls: they have been detected in ESM but were already
present in LTS. The vulnerabilities in region 4 are incorrectly missed by
Clair: they have been fixed in ESM but are still present in LTS.

Some vulnerabilities in region 6 are due to bugs in Anchore: the epoch bug
ignores vulnerabilities related to package versions that contain an epoch (:);
the out of standard bug ignores vulnerabilities that are ignored by the Ubuntu
distribution. We reported these bugs to the Anchore developers through their
Slack channel. Some vulnerabilities in region 6 are also due to the fact that
Anchore intentionally ignores Debian vulnerabilities flagged as minor.

Finally, 32 vulnerabilities that are flagged temporary by the Debian
distribution are reported by Vuls but not by Anchore or Clair (region 7). The
remaining 504 vulnerabilities in this region are all found in CentOS images.
We weren’t able to explain why they were detected by Vuls only.

Figure 2:  Differences between vulnerabilities detected by the different
scanners. The Jaccard coefficients between the sets of detected
vulnerabilities are quite low, showing important discrepancies between the
scanners: Jaccard(Anchore, Clair) = 0.63, Jaccard(Anchore, Vuls) = 0.59,
Jaccard(Vuls, Clair) = 0.80. Two Ubuntu 17.04 images weren’t included in this
comparison as they cannot be scanned by Vuls.

##  4 Discussion

There is a widespread issue with security vulnerabilities in container images
used for neuroimaging analyses, and it is likely to impact other scientific
disciplines as well. As shown in our results, it is common for container
images to hold hundreds of vulnerabilities, including several of critical
severity. Container images are impacted regardless of the type of analyses
that they support, and the main OS distributions Ubuntu, Debian and CentOS are
all affected.

Software updates remove about two-thirds of the vulnerabilities found and
should certainly be considered the primary solution to this problem. However,
in neuroimaging as in other disciplines, software updates are generally
discouraged because they can affect analysis results by introducing numerical
perturbations in the computations [6, 4]. We believe that this position is not
viable from an IT security perspective, and that it could endanger the entire
Big Data processing infrastructure. Instead, we advocate a more systematic
analysis of the numerical schemes involved in data analyses, which, coupled
with software testing, would make the analyses robust to software updates. As
a first step, the packages impacting the analyses could be specifically
identified and the others updated, which would largely remove vulnerabilities.

Ultimately, software updates should even occur at runtime rather than when the
container image is built. Indeed, it is likely that container images used for
scientific data analyses be built only occasionally, perhaps every few weeks
when a release becomes available, which may not be compatible with the
frequency of required security updates. In fact, there is no definite reason
for the application software release cycle to be synchronized with security
updates, and security updates shouldn’t be dependent on application software
developers. Instead, we think it would be relevant for analytics engines to
(1) systematically apply security updates when containers start, and (2) run
software tests provided by application developers, including numerical tests,
before running analyses.

Implementing such a workflow, however, requires a long-term endeavour to
evaluate broadly the stability of data analysis pipelines, and to develop the
associated software tests. For the shorter term, we identified the following
recommendations for application developers to reduce the number of security
vulnerabilities in container images:

  1. 1.

_Introduce software dependencies cautiously_. Software dependencies come with
a potential security toll that is often neglected. For instance, it can be
tempting to add a complete toolbox to implement a relatively minor operation
in a data analysis pipeline, such as a data format conversion, while the same
functionality might be available in the existing dependencies of the pipeline,
albeit in a less convenient way. Some package managers such as apt also
support “weak” package dependencies that are recommended but not necessarily
required for installation. Installation of such suggested packages can be
avoided using specific options of the package manager (\--no-install-
recommends in the case of apt). Using lightweight base OS images such as
Alpine Linux can also reduce the number of unnecessary dependencies. However,
developers should ensure that this doesn’t lead to installing extra
dependencies without using the package manager, as mentioned in point (iv)
below.

  2. 2.

_Minify container images._ Minifying container images is another way to reduce
software dependencies. However, the automated minification process that we
used in our study is unwieldy for a routine use, as it requires capturing
execution traces with ReproZip to reconstruct the graph of package
dependencies required for the analysis. In practice, it would be more
practical for software developers to identify and remove unnecessary
dependencies when they build containers, based on their knowledge of the
application.

  3. 3.

_Use OS releases with long-term support._ Security updates are not provided
for OS distributions that reached end of life. When a given release of a data
analysis pipeline is expected to be used over a long period of time, typically
several years as it is common in neurosciences, the life cycle of the
distribution release should be considered when choosing a base container
image. OS distributions have very different life cycle durations, as long and
short life cycles serve different purposes. For instance, among RedHat-based
distributions, Fedora release a new version every 6 months and provide
maintenance for about a year, while CentOS release every 3-5 years and provide
maintenance for 10 years. Similarly, Ubuntu and Debian LTS (long-term support)
distributions provide security updates for at least 5 years.

  4. 4.

_Install packages, not files_. Regardless of their support status, base OS
distributions covered by the previous recommendation rarely include scientific
software. Since vulnerability scanners detect vulnerabilities from the list of
installed packages, vulnerabilities contained in files installed without the
package manger remain undetected. To reduce such occurrences, scientific
software should as much as possible be linked dynamically against libraries
provided by the base OS distribution. The use of domain-specific repositories
such as NeuroDebian or NeuroFedora in neuroimaging is also useful in this
respect, as these distributions facilitate transparent software updates and
might be covered by image scanners in the future.

  5. 5.

_Run image scanners during continuous integration._ Scanning container images
can be a cumbersome process that could be asynchronously executed during
continuous integration (CI), through tools such as Travis CI or Circle CI.
Including security scans in CI also allows developers to identify
vulnerabilities quickly, before new software versions are released. The
Anchore documentation includes specific instructions on how to do so at
https://anchore.com/cicd. The Stools repository also includes a Travis CI file
that can be reused for this purpose.

Describing specific attacks that would exploit vulnerabilities in container
images is out of the scope of our study. We believe that such attacks are
likely to exist given that critical vulnerabilities allowing for arbitrary
code execution or file injection were found. Attacking systems through
containers remains challenging due to their relative isolation from the host
system. Under the assumption that container host users can be trusted,
attackers would have to be remote, either in the same network or on a remote
network. Two main types of attacks can be envisaged in these conditions:
network-based attacks, exploiting vulnerabilities in network clients installed
in the container, and data-based attacks, exploiting vulnerabilities through
the processing of malicious data injected through third-party systems.

Several types of escalation attacks could be envisaged once remote attackers
gain access to the container, in particular related to (1) stealing user
credentials, (2) using the resources allocated to the container for malicious
use, resulting in denial of service, and (3) attacking a host network service,
for instance a locally-accessible server or a file system daemon. Exploits in
the host kernel to break out of the container are always possible but unlikely
assuming that the host system is maintained by professional system
administrators.

##  5 Conclusion

Most container images used in scientific data analyses contain hundreds of
security vulnerabilities, many of which are critical. In the short term,
application software developers can address this issue by: (1) reducing
software dependencies, and (2) applying regular security updates, which
requires using OS distributions with long-term support. Longer term, data
analysis pipelines would benefit from in-depth stability analysis, to ensure
that analytical results are not affected by security updates.

This conclusion is not an alarming message urging system administrators to ban
containers from their systems. User-controlled container images are just one
of many end-user artifacts that could serve as attack vectors, and to our
knowledge no attack has been described to exploit them. More traditional types
of attacks targeting user credentials or network connections are likely to
remain more common.

##  6 Availability of Data and Materials

The data and scripts used in this study are available on GitHub with a Jupyter
notebook to regenerate the figures:

  1. 1.

Project name: container-vulnerabilities-paper

  2. 2.

Project home page:
https://github.com/big-data-lab-team/container-vulnerabilities-paper

  3. 3.

Operating system: Platform independent

  4. 4.

Programming language: Python

  5. 5.

Other requirements: Jupyter ¿= 1.0.0, Matplotlib ¿= 3.3.0, NumPy ¿= 1.19.1,
Pandas ¿=1.0.5, SciPy ¿= 1.6.0

  6. 6.

License: GNU General Public License v3.0

##  7 Availability of Supporting Data

Kaur B; Dugré M; Hanna A; Glatard T: Supporting data for “An Analysis of
Security Vulnerabilities in Container Images for Scientific Data Analysis”
GigaScience Database. 2021. http://dx.doi.org/10.5524/100880

##  8 Competing interests

The authors declare that they have no competing interests.

## References

  * [1] T. Combe, A. Martin, and R. Di Pietro.  To docker or not to docker: A security perspective.  IEEE Cloud Computing, 3(5):54–62, 2016.
  * [2] H. Gantikow, C. Reich, M. Knahl, and N. Clarke.  Providing security in container-based HPC runtime environments.  In International Conference on High Performance Computing, pages 685–695, 2016.
  * [3] T. Glatard, G. Kiar, T. Aumentado-Armstrong, N. Beck, P. Bellec, R. Bernard, A. Bonnet, S. T. Brown, S. Camarasu-Pop, F. Cervenansky, et al.  Boutiques: a flexible framework to integrate command-line applications in computing platforms.  GigaScience, 7(5):giy016, 2018.
  * [4] T. Glatard, L. B. Lewis, R. Ferreira da Silva, R. Adalat, N. Beck, C. Lepage, P. Rioux, M.-E. Rousseau, T. Sherif, E. Deelman, et al.  Reproducibility of neuroimaging analyses across operating systems.  Frontiers in neuroinformatics, 9:12, 2015.
  * [5] K. J. Gorgolewski, F. Alfaro-Almagro, T. Auer, P. Bellec, M. Capotă, M. M. Chakravarty, N. W. Churchill, A. L. Cohen, R. C. Craddock, G. A. Devenyi, et al.  Bids apps: Improving ease of use, accessibility, and reproducibility of neuroimaging data analysis methods.  PLoS computational biology, 13(3):e1005209, 2017.
  * [6] E. H. Gronenschild, P. Habets, H. I. Jacobs, R. Mengelers, N. Rozendaal, J. Van Os, and M. Marcelis.  The effects of freesurfer version, workstation type, and macintosh operating system version on anatomical volume and cortical thickness measurements.  PloS one, 7(6):e38234, 2012.
  * [7] J. Gummaraju, T. Desikan, and Y. Turner.  Over 30% of official images in DockerHub contain high priority security vulnerabilities.  In Technical Report. 2015.
  * [8] A. Martin, S. Raponi, T. Combe, and R. Di Pietro.  Docker ecosystem–vulnerability analysis.  Computer Communications, 122:30–43, 2018.
  * [9] R. Rampin, F. Chirigati, D. Shasha, J. Freire, and V. Steeves.  Reprozip: The reproducibility packer.  Journal of Open Source Software, 1(8):107, 2016.
  * [10] R. Shu, X. Gu, and W. Enck.  A study of security vulnerabilities on DockerHub.  In Proceedings of the Seventh ACM on Conference on Data and Application Security and Privacy, CODASPY ’17, pages 269–280, New York, NY, USA, 2017.
  * [11] S. Sultan, I. Ahmad, and T. Dimitriou.  Container security: Issues, challenges, and the road ahead.  IEEE Access, 7:52976–52996, 2019.
  * [12] A. Zerouali, T. Mens, G. Robles, and J. M. Gonzalez-Barahona.  On the relation between outdated Docker containers, severity vulnerabilities, and bugs.  In 2019 IEEE 26th International Conference on Software Analysis, Evolution and Reengineering (SANER), pages 491–501. IEEE, 2019.