Fabio Martinelli
email: fabio.martinelli@iit.cnr.it

Ganbayar Uuganbayar
email: ganbayar.uuganbayar@iit.cnr.it

Artsiom Yautsiukhin
email: artsiom.yautsiukhin@iit.cnr.it

Optimal security configuration for cyber insurance

Keywords: security investment, optimal investment, knapsack problem, cyber insurance, risk management

Losses due to cyber security incidents could be very significant for organisations. This fact forces managers to consider cyber security risks at the highest management level. Cyber risks are usually either mitigated by technical means (countermeasures) or transferred to another party (i.e., insurer). Both options require significant investments and organisations face the problem of optimal distribution of cyber security budget between these risk treatment options. In this paper, we propose an approach for optimal distribution of investments between self-protection and cyber insurance. The key difference of our paper with respect to others in the field is that our model helps to identify the required security controls, rather than implicitly assuming a relation between security investments, security configuration and expected probability of attack. Our approach exploits a discrete model of investment in self-protection, which is more challenging for analysis but is more realistic and convenient for the application. Our model further considers several threats and allows threats to occur more than once.

Introduction

One of the biggest challenges organisations face is the protection of their valuable assets against cyber attacks. Symantec report [1] reveals that more than 7.1 billion identities had been exposed due to data breaches within the last eight years. Although most organisations believe in their security, around 30% of them are breached in reality (according to the annual Cisco report (2017) [START_REF]Cisco: Annual Cybersecurity Report[END_REF]). Thus, there is always a residual risk which cannot be eliminated with technical means.

The residual risk could be either accepted or insured, i.e., transferred to another party (so-called insurer) in return for a premium, a fee an organisation (called insured) pays to an insurer in return for risk coverage. Since cyber insurance was introduced, the market has been growing [START_REF] Marotta | Cyber-insurance survey[END_REF][START_REF] Partnerre | Survey of Cyber Insurance Market Trends[END_REF][START_REF]ENISA: Incentives and barriers of the cyber insurance market in europe[END_REF], although slower than predicted because of a number of challenges this young market faces.

Availability of cyber insurance market makes organisations to decide whether to buy cyber insurance or invest in self-protection. Some researchers adapted models from general insurance for analysis of various properties of cyber insurance market and security levels of organisations and society, in general. In particular, many authors tried to answer whether cyber insurance is an incentive for security investments or it is not [START_REF] Lelarge | Economic incentives to increase security in the internet: The case for insurance[END_REF][START_REF] Ogut | Cyber insurance and it security investment: Impact of interdependent risk[END_REF][START_REF] Shetty | Can competitive insurers improve network security?[END_REF][START_REF] Schwartz | Cyber-insurance framework for large scale interdependent networks[END_REF][START_REF] Majuca | The evolution of cyberinsurance[END_REF]. However, some of these authors [START_REF] Ogut | Cyber insurance and it security investment: Impact of interdependent risk[END_REF][START_REF] Shetty | Can competitive insurers improve network security?[END_REF][START_REF] Schwartz | Cyber-insurance framework for large scale interdependent networks[END_REF] consider a continuous investment model (any investment in self-protection reduces the probability of an incident). On the other hand, an organisation invests in self-protection by implementing various countermeasures, i.e., discretely. Other researchers, i.e., [START_REF] Lelarge | Economic incentives to increase security in the internet: The case for insurance[END_REF][START_REF] Yang | Security adoption and influence of cyber-insurance markets in heterogeneous networks[END_REF], use an oversimplified discrete model of security investment, which simply assigns low or high level of security depending on whether investments exceed some threshold. Such model is not realistic either, as it does not allow improving security (i.e., reducing the probability of attack) if the threshold is not crossed. Moreover, both these models do not explain how the probability of attack could be computed and do not provide a way to establish the link with the available countermeasures for installation. Thus, these models cannot help to decide how to improve their cyber security.

In this paper, we provide an approach for optimal distribution of investments between cyber insurance and self-protection. The key difference of our approach with others is the discrete model of cyber security investments, explicitly taking into account the contribution of the security controls which are or can be implemented. Such an approach will help organisations to make the decisions on which countermeasures to install, keeping in mind that the rest of residual risk will be covered by cyber insurance. We consider a competitive cyber insurance market where insurers are non-profitable and assume a generic utility function without either information asymmetry or security interdependence.

The remainder of the paper unfolds as follows. In Section 2, we provide the basic formalisation to clarify the problem statement. We further analyse the problem and propose our solution in Section 3. Section 4 contains an example of application of our solution. We follow with a literature review [START_REF]ENISA: Incentives and barriers of the cyber insurance market in europe[END_REF] and then draw our conclusion [START_REF] Lelarge | Economic incentives to increase security in the internet: The case for insurance[END_REF].

Problem Specification

Consider an organisation which would like to devise the most efficient strategy for security investments, combining risk mitigation and risk transfer. Risk mitigation requires specification of additional security controls for self-protection and cyber insurance needs the decision on the amount of insurance coverage (indemnity) to be bought. The goal of this paper is to combine these options efficiently.

Let W be some amount of wealth an agent expects to possess after some period of time, assuming that initial wealth is W 0 . Let T R be a set of size n t (n t ∈ N + ) of all possible threats. Let pr q (x) ∈ [0; 1] be the probability of W 0 -initial wealth π -probability of a threat survival x -security investment F -expected number of threat attempts c -cost of a countermeasure pr -probability of a threat occurrence P -premium z -real number of threat occurrence K -a set of available countermeasures L -loss K i -a set of installed countermeasures Ī -indemnity Table 1. Notations adopted in this work a threat tr q ∈ T R occurrence if the organisation invests x in self-protection. Naturally, we expect this probability to decrease with increase of investments (∀x 1 < x 2 (pr q (x 1 ) ≥ pr q (x 2 )). Let pr(x) = pr 1 (x), pr 2 (x), ..., pr nt (x) be a vector of such probabilities for all threats. In the future, we always use a bar for vectors. All vectors in our paper are of size n t . We also use superscripts for denoting a member of a vector, e.g., pr q (x), and subscripts for a more precise specification of a variable. We also use two vector operations in the paper. Hadamard product of two vectors ā and b, denoted as ā• b, is a vector c = a 1 * b 1 , a 2 * b 2 , ..., a nt * b nt . We also use the same symbol • for a multiplication of a vector by a scalar. Usual matrix multiplication of two vectors ā and b is denoted as ā × b and is a scalar value equal to nt q=1 a q * b q . Let F = F 1 , F 1 , ..., F nt be a vector of an expected amount of breaches for some period if no countermeasures are installed. Then, with investment x, the expected amount of breaches is a vector: F • pr(x); and, if we know a single loss expectancy for every single threat occurrence L = L 1 , L 1 , ..., L nt , we are able to compute the overall expected loss for the considered period, i.e., risk:

risk(x) = ( F • pr(x)) × L. ( 1
)
Since the organisation is allowed to buy insurance, it pays a premium P in order to cover some part of its losses in case of an incident (called indemnity Ī, ∀q, I q ≤ L q ). In this paper, we use a simple cyber insurance market model [START_REF] Ogut | Cyber insurance and it security investment: Impact of interdependent risk[END_REF][START_REF] Lelarge | Economic incentives to increase security in the internet: The case for insurance[END_REF][START_REF] Ehrlich | Market Insurance, Self-Insurance, and Self-Protection Foundations of Insurance Economics[END_REF], called competitive market, which demands the premium to be equal to the expected losses of the insurer (as the market has so many insurers that no one is able to propose a better contract):

P (x) = ( F • pr(x)) × Ī.
In the current literature on cyber insurance, e.g., [START_REF] Ogut | Cyber insurance and it security investment: Impact of interdependent risk[END_REF], pr q (x) is simply assumed to exist and does not define how the required security level could be reached. In practice, organisations spend their money in portions buying new controls or implementing security practices. Let K be a set of available countermeasures and K i ⊆ K be a subset of these countermeasures which the organisation decides to apply. K i is to be determined by the available amount of self-investments x (See Section 3.2), and we re-write pr q (x) as pr q (K i |x) to explicitly indicate the dependency of the probability of survival on K i .

Finally, similar to other economic models [START_REF] Rothschild | Equilibrium in competitive insurance markets: An essay on the economics of imperfect information[END_REF][START_REF] Ehrlich | Market Insurance, Self-Insurance, and Self-Protection Foundations of Insurance Economics[END_REF][START_REF] Marotta | Cyber-insurance survey[END_REF][START_REF] Ogut | Cyber insurance and it security investment: Impact of interdependent risk[END_REF], we reason with the utility of possessing certain amount of wealth U (W ), rather than with the wealth W itself. The utility function is assumed to be continuous, non-decreasing, concave, and twice differential (i.e., U (W ) > 0 and U (W ) < 0). Let z = z 1 , z 2 , ..., z nt be a random vector of numbers of threat occurrences (one per threat) and pr(z|K i , x) be the probability that the company will face z incidents in the considered period of time under the condition that investments in selfprotection are x and implemented countermeasures are K i . Also, F • pr(K i |x) = ∀z pr(z|K i , x) • z. The expected wealth is the amount left after subtraction from the initial wealth the premium, the self-investment, and the loss:

W (z, x, Ī, K i ) = W 0 -( F • pr(K i |x)) × Ī -x -z × ( L -Ī), (2)
U (z, x, Ī, K i ) = U (W 0 -( F • pr(K i |x)) × Ī -x + z × ( L -Ī)). ( 3
)
where

Ī -L = I 1 -L 1 , I 2 -L 2 , ..., I nt -L nt .
Finally, the expected utility is equal to:

E[U ] = ∀z pr(z|K i , x)U (W 0 -( F • pr(K i |x)) × Ī -x + z × ( Ī -L)), (4)
The goal of the organisation, is to maximise E[U ] by selecting x, Ī and

K i . max x, Ī,Ki ∀z pr(z|K i , x)U (W 0 -( F • pr(K i |x)) × Ī -x + z × ( Ī -L)). (5)
3 Utility maximisation

Indemnity

Consider Equation 4and apply Jensen's inequality for a concave function (for any concave function

φ(t) E[φ(t)] ≤ φ(E[t])): ∀z pr(z|K i , x)U (W 0 -( F • pr(K i |x)) × Ī -x + z × ( Ī -L)) ≤ U ( ∀z pr(z|K i , x) W 0 -( F • pr(K i |x)) × Ī -x + z × ( Ī -L) ) = U ( ∀z pr(z|K i , x) (W 0 -x) - ∀z pr(z|K i , x) ( F • pr(K i |x)) × Ī + ∀z pr(z|K i , x) • z × Ī - ∀z pr(z|K i , x) • z × L). Since ∀z pr(z|K i , x) = 1 and F • pr(K i |x) = ∀z pr(z|K i , x) • z, we get: U (W 0 -x -( F • pr(K i |x)) × Ī + ( F • pr(K i |x)) × Ī -( F • pr(K i |x)) × L) = U (W 0 -x -( F • pr(K i |x)) × L). The last part (U (W 0 -x -( F • pr(K i |x)) × L)) is the expected utility if Ī = L.
In other words, Equation 4 is maximal if Ī = L.

Security controls

As Ī = L, our maximisation problem (Equation 5) could be reduced to:

max x,Ki U (W 0 -x -( F • pr(K i |x)) × L). (6)
Since the utility function is non-decreasing, we need to maximise its argument, or simply minimise the following part (called as expenditure in the sequel):

min x,Ki (x + ( F • pr(K i |x)) × L). (7)
Since, K i affects only ( F • pr(K i |x)) × L and U () is concave, in order to maximise U () we need to select K i in such a way to minimise this component and we have to ensure that we do this with investments less or equal to x. Let π q (k) ∈ [0; 1] be the probability that a threat q passes through (survives) countermeasure k ∈ K i ; countermeasure k completely eliminates threat q if π q (k) = 0, and is entirely powerless against the threat if π q (k) = 1. Let π(k) be a vector of all probabilities of survival if countermeasure k is installed, then the overall probability of survival can be computed as3 :

π(K i ) = ∀k∈Ki π(k), (8)
where ∀k∈Ki stands for the Hadamard product. Every countermeasure has its cost, denoted as function c and is assumed to provide a finite non-negative integer value c : K → N + . Naturally, the cost of installed countermeasures K i ⊆ K (c(K i )) can be computed as:

c(K i ) = ∀k∈Ki c(k). (9)
Now, we are able to connect π(K i |x) and pr(x). The most efficient money distribution (minimal expenditure) is if K i minimises the premium:

min ∀Ki⊂K ( F • ∀k∈Ki π(k) ) × L and ∀k∈Ki c(k) ≤ x. (10)
The sub-problem of finding the optimal set of countermeasures K * i , for which we say that π(K * i |x) = pr(x) reminds 0-1 multi-objective Knapsack problem [START_REF] Bazgan | Solving efficiently the 01 multi-objective knapsack problem[END_REF], but instead of summing of values per objectives, we multiply them, and, thus, look for the minimal overall value.

Security investments

Finally, we may return to the main problem, i.e., how to find the right amount of investments in self-protection. From Equation 7investments must be as low as possible, but they also must be high enough to keep the insurance premium low. Moreover, the solution for Equation 7 depends on solving the 0-1 multi-objective knapsack problem Equation 10.

We propose a solution that is based on the dynamic programming algorithm for solving 0-1 multi-objective knapsack problem [START_REF] Bazgan | Solving efficiently the 01 multi-objective knapsack problem[END_REF]. We assume that the cost of countermeasures could be seen as positive integer values (or, can be seen as ∀k ∈ K (c(k) = C * m k ), where C and m k are positive natural values, and C is the greatest common divisor for countermeasures' costs). Let all elements of K be enumerated with j = 1, ..., n K (where n K is the size of K). For every amount of investments x we consider (accept or reject) the first j countermeasures. For those accepted K i , we compute the overall probability of threat's survival pr(K i |x) (see Equation 8). The overall probability of survival for every K i is stored in a corresponding cell T [j][x] of an auxiliary matrix T .

Since for our problem we cannot store only the optimal value at every intermediate step (as it is done for a simple 0-1 knapsack problem), we remember (in a matrix cell T [j][x]) all non-dominant probability vectors, i.e., vectors which potentially could lead to the optimal solution. In the most simple case, we may see selection of non-dominant vectors as those which cannot be rejected using the Pareto optimality criteria (i.e., ∀ t1 , t2 ∈ T [j][x] (∃q (t q 1 > t q 2 ))). As it was shown by Bazgan et. al, [START_REF] Bazgan | Solving efficiently the 01 multi-objective knapsack problem[END_REF] other dominance relations could be applied to speed up the algorithm. Since, this is not crucial for our paper, we refer the interesting reader to the original paper of the authors for a more detailed discussion on the non-dominant relations, which can be applied to our problem.

In short, the core part of the solution for 0-1 multi-objective knapsack problem could be seen as the following recursive algorithm:

1. T [0][x] = 1; 2. T [j][x] = T [j -1][x] if c(k j ) > x (the
new item is more expensive than the current cost limit); 3.

T add = ∀ t∈T [j-1][x-c(kj )] t • π(k j ) T [j][x] = non -dominant(T [j -1][x] ∪ T add ) if c(k j ) ≤ x.
Naturally, every last cell in a column T [n k ][x] returns the overall probability of survival for x investments and all n k countermeasures taken into account. It is required only to find the K i which causes the minimal total expenditure, using the vectors from T [n k ][x] as pr(K i |x) and applying Equation 7.

To get the final solution for optimal investments x * , i.e., T [n K ][x * ], we need to know x * . It is important to note that the core part of the recursive algorithm does not require the knowledge of maximal investments in order to count values for any intermediate x. In other words, we may start the algorithm with x = 0 and continue as much as we need or until we find our solution (also extending matrix T for new x to check). Now, our goal is to find the way to minimise the amount of required iterations and ensure that the solution to Equation 7 will be found.

Let P * (x) be the optimal insurance premium if x amount of money invested in self-protection. According to Equation 10:

P * (x) = min ∀ t∈T [nt][x] (( F • t) × L). (11)
Then, we can simplify Equation 7 as:

min ∀x (P * (x) + x). (12)
Consider some amount of investments x r ∈ [0, W 0 ] to be evaluated at step r ∈ [0; W 0 /C]. We are interested only in the following future steps p:

x r + P * (x r ) > x r+p + P * (x r+p );

x r+p < P * (x r ) + x r -P * min ;

P * min = F • ∀k∈K π(k) ) × L. ( (14)
) 15
Out of these two relations we can derive the following observations. First, Equation 13 shows that we should select the optimal value by iterating sequential comparison of the current best value (i.e., up to step r) with the next ones (p > 0). Equation 14tells us the maximal steps we should look forward, since no more efficient total expenditure is possible for the steps higher than this limit. Finally, we also may find the first limit, which is: x limit 0 = P * (0) -P * min , where P * min is the minimal possible premium/risk, computed with all possible countermeasures K i = K installed.

It is also important to note, that once we find a better x, we can re-set the limit, since it will be less than the previous one. This observation can be easily proved as follows. Let x r be the previous best value (i.e., for all r + p -1 steps) and x r+p be even better than x r , i.e.,:

P * (x r ) + x r > P * (x r+p ) + x r+p . (16)
The limits defined at steps r and step r + p are x limit r and x limit r+p consequently:

P * (x r ) + x r -P * min = x limit r ; P * (x r+p ) + x r+p -P * min = x limit r+p . (17)
We conclude that x limit r > x limit r+p .

Algorithm for computation of optimal self-investments

Now, we are able to define an algorithm for finding the optimal amount of investments x * , which is based on the dynamic programming approach for solving 0-1 multi-objective knapsack problem. Although, we use the core part of the well-known algorithm, we adapt it to our task: instead of receiving the limit for investments as an input, our algorithm should return it as an output, ensuring that it is the most optimal amount of investment.

Algorithm 1 Selecting the best set of countermeasures if (c(kj) ≤ x ) then check the cost limit 19:

T [j][x] ⇐ non -dominant ∀l π(kj) • T [j -1][x -c(kj)][l] T [j -1][x]
store all non-dominant vectors comparing two sets: with new control and without. 20: else 21:

T [j][x] ⇐ T [j -1][x]
continue without adding new control j 22:

end if 23:

end for 24:

for l ⇐ 0, |T [n k ][x]| do for all vectors stored in T [n k ][x] 25: if ( F • T [n k ][x][l]) × L + x + xinit < exp then reduced the expenditure? 26: exp ⇐ F • T [n k ][x][l]) × L + x + xinit
Store this expenditure as optimal 27:

x * ⇐ x Remember these investments as optimal 28: end if 29: end for 30:

x ⇐ x + C 31:

end while 32: return [exp, x * ] 33: end procedure

In the Algorithm 1, we demonstrate the core part of our solution which: a) finds the optimal investments in self-protection x * ; b) ensures the lowest expenditure (( F • pr(

K * i |x * )) × L + x * ).
We start with all initial variables and functions provided. Moreover, we assume that the company has already some countermeasures K init installed, spending already x init amount of money and getting the initial overall probability of survival equal to pr init . Note that it is not important if the initial countermeasures K init are efficient or they are not, but these controls should not be considered in the further analysis:

K init ∩ K = ∅.
Lines 9-14 initialise the values for further processing. First, we store the initial expenditure and find the minimal premium P min . We also initialise the auxiliary table of probabilities T with the initial column for additional investments x = 0 (the first column) and with all cells initialised as { pr init } (Line 12). There is no need to compute values for x = 0 as no countermeasures could cost less than or equal to 0, i.e., ∀j(c(k j ) > x = 0); so, we start with x = C, where C is some fixed greatest common divisor for the cost of all controls.

We are going to increase gradually the investments unless we reach the limit set by parameter exp -P min , as Equation 14states (line 15). For all countermeasures (line 17), we select all non-dominating overall survival probability vectors by comparing two sets: 1) a set of previously selected controls with k j (

∀l π(k j ) • T [j -1][x -c(k j )][l]), 2
) and the best selection of controls without [START_REF] Fielder | Decision support approaches for cyber security investment[END_REF]. We should note here that both compared sets contain non-dominant vectors (as ensured at the previous steps), but two vectors from different sets could be dominating and dominated.

k j (T [j -1][x])(line
Since we use a modified knapsack problem, we multiply values when adding new countermeasure to the selected set, rather than summing values as the classical knapsack problem does. Note that we must respect the additional selfinvestments x, so the contribution of the considered countermeasure k j is added to overall probability of survival computed for self-investment limit x -c(k j ). Naturally, if the cost of the countermeasure k j (c(k j )) is higher than the additional self-investments x (line 18), we simply take the previously selected set of countermeasures and the corresponding overall probability of survival is

T [j -1][x] (line 21).
When all countermeasures are considered for the current self-investments x, we use Equation 13to check if the newly computed overall amount of expenditure is lower than the previous one (line 25). Here we would like to remind that a cell of matrix T contains a set of vectors, i.e., we should evaluate all of them (T [n k ][x]). If the best current expenditure is lower than the previous optimal one, we set the current value as a new lowest expenditure and as the new limit (line 26) for further computations (according to the condition in Equation 14), plus we remember the current self-investments x as optimal x * (line 27).

Algorithm 1 stops when further increase of the self-investments x becomes so inefficient that it exceeds overall best-so-far expenditure exp (line 15), i.e., the current optimal total expenditure for both insurance (P * (x * )) and selfinvestment (x * ). As a result, the algorithm returns the optimal self-investment limit x * and the optimal total expenditure. With a slightly modified standard backward algorithm it is also possible to find the most efficient set of countermeasures K * i .

Case study

As a case study, we consider an organisation with initial wealth W 0 = 100000 which decides how to distribute the available funds to reduce cyber risks. First, five main threats are identified, as well as their average frequency ( F ) and single loss expectancy ( L = 3000, 1800, 2800, 4000, 3800 ). So far, only the basic cyber security countermeasures are implemented (with the total initial investments (x init = 200) and initial probabilities of survival pr init ) but an analyst has identified eight additional countermeasures which can be installed

(|K| = n k = 8), their relative costs (c(k 1 ) = 480; c(k 2 ) = 240; c(k 3 ) = 120; c(k 4 ) = 80; c(k 5 ) = 200; c(k 6 ) = 120; c(k 7 ) = 280; c(k 8 ) = 200
) and the probabilities of survival (π function). All input vectors are defined in Table 2.

pr init F πk1 πk2 πk3 πk4 πk5 πk6 πk7 πk8 0.6 0.8 0.3 0.9 0.5 0.8 0.9 0.8 0.8 0.6 0.7 0.5 0.2 0.8 0.7 0.6 0.5 0.7 0.1 0.7 0.8 0.4 0.5 0.9 0.9 0.9 0.8 0.5 0.4 0.5 0.6 0.7 0.7 0.2 0.8 0.8 0.6 0.8 0.9 0.8 0.6 0.5 0.3 0.7 0.6 0.2 0.5 0.6 0.8 0.5

Table 2. Input vectors

If we apply our approach based on the dynamic programming proposed in Section 3.4, we start with initial expenditure exp equal to 5986. This expenditure will be our first limit for searching the optimal investment level. Naturally, pr(K i |x)) equals to vector pr init in the beginning. The minimal premium is equal to P * min = 136. Table 3 contains the result for the first 21 rounds of the algorithm. In the first round, our expenditure increases by the investment increment C = 40 since there are no countermeasures of the cost below the current investment level x = 40. After the first two rounds of investment (x = 2 * C = 80), we find a possible solution, if countermeasure k 4 (with c(k 4 ) = 80) is selected (overall expenditure exp becomes 4188, which is lower than previous limit 5986). Thus, we raise the current optimal value of X * to 80. The next increment of x (x = 120) increases the expenditure up to 4228 and we see that there is no more efficient countermeasure set than previous choice {k 4 }. As we continue the analysis, we see that, although, in general, the overall expenditure falls, in some cases (e.g., for 1). Note that initially we planned to check the selfinvestment values up to 5986, but eventually stopped at x = 1280, preventing the unnecessary computational resource usage.

Related work

Cyber insurance is a young market which slowly matures facing a number of challenges [START_REF]ENISA: Incentives and barriers of the cyber insurance market in europe[END_REF][START_REF] Biener | Insurability of cyber risk: an empirical analysis[END_REF][START_REF] Marotta | Cyber-insurance survey[END_REF]. Some of these challenges (e.g., lack of data, definition of contractual language, specification of standards for cyber insurance underwriting process) are of practical nature and mostly require insurers to gain more experience in the field. On the other hand, such challenges as correlated risks, interdependent security and information asymmetry require careful theoretical analysis in order to help the market to flourish and the society to benefit from it.

One of the central problems considered by several researchers is proving that availability of insurance incentivises agents to invest more in self-protection [START_REF] Lelarge | Economic incentives to increase security in the internet: The case for insurance[END_REF][START_REF] Pal | Will cyber-insurance improve network security? a market analysis[END_REF][START_REF] Ogut | Cyber insurance and it security investment: Impact of interdependent risk[END_REF][START_REF] Shetty | Can competitive insurers improve network security?[END_REF]. Many well-known cyber security researchers believed that this is true [START_REF] Schneier | Insurance and the computer industry[END_REF][START_REF] Anderson | Security economics and the internal market[END_REF][START_REF] Majuca | The evolution of cyberinsurance[END_REF], but a thorough mathematical analysis has proved that sometimes agents may simply decide to insure the future losses rather than increase their protection [START_REF] Ogut | Cyber insurance and it security investment: Impact of interdependent risk[END_REF][START_REF] Ehrlich | Market Insurance, Self-Insurance, and Self-Protection Foundations of Insurance Economics[END_REF], especially if interdependent security and information asymmetry take place [START_REF] Pal | Will cyber-insurance improve network security? a market analysis[END_REF][START_REF] Ogut | Cyber insurance and it security investment: Impact of interdependent risk[END_REF][START_REF] Shetty | Can competitive insurers improve network security?[END_REF][START_REF] Schwartz | Cyber-insurance framework for large scale interdependent networks[END_REF]. Thus, researchers considered various regulatory mechanisms which can ensure high enough investments in self-protection and acceptable cyber insurance contracts: fines and rebates [START_REF] Pal | Will cyber-insurance improve network security? a market analysis[END_REF][START_REF] Yang | Security adoption and influence of cyber-insurance markets in heterogeneous networks[END_REF], liability coverage [START_REF] Ogut | Cyber insurance and it security investment: Impact of interdependent risk[END_REF], non-competitive market [START_REF] Martinelli | Preventing the drop in security investments for non-competitive cyberinsurance market[END_REF]. For performing these analysis, the researchers applied two types of models for modelling the relation between investments and the probability of attack: 1) a continuous model, decreasing the probability with any investment [START_REF] Pal | Will cyber-insurance improve network security? a market analysis[END_REF][START_REF] Ogut | Cyber insurance and it security investment: Impact of interdependent risk[END_REF][START_REF] Shetty | Can competitive insurers improve network security?[END_REF]; and 2) a simplistic discrete model, allowing two levels for the probability (high and low), depending on whether investments exceed a threshold or they do not [START_REF] Lelarge | Economic incentives to increase security in the internet: The case for insurance[END_REF][START_REF] Yang | Security adoption and influence of cyber-insurance markets in heterogeneous networks[END_REF]. In contrast to these papers, we propose a more realistic model which increases protection only when enough investments for installation of the next countermeasures are available and allows as many of such increases as required. We have shown how the probability of survival (or a probability of attack) could be computed using a set of available countermeasures, and how the investments could be distributed between the self-investment and cyber insurance. One may argue that the continuous model is just an approximation of the reality, which skips the low-level details for the sake of simplicity of the more complex analysis. This may well be true, but then our approach could be seen as the link between the low level details and high level model, as well as the instrument for proving that such approximation is valid.

The problem of selecting the right set of countermeasures for cyber security is not new. For example, T. Sawik [START_REF] Sawik | Selection of optimal countermeasure portfolio in IT security planning[END_REF] conceptualises the selection of countermeasures based on their efficiency of blocking threats and cost of countermeasures. For doing this, he applies single-or bi-objective mixed integer program and conditional value-at-risk approach. The variety of knapsack problems [START_REF] Bartholdi | The knapsack problem[END_REF] and their solutions are natural choices for being applied in optimisation of cyber security. For example, F. Smeraldi et. al., [START_REF] Smeraldi | How to spend it: optimal investment for cyber security[END_REF] introduced a framework which combines combinatorial optimisation with classical Knapsack Problem in order to spend security investment optimally. A. Fielder et. al., [START_REF] Fielder | Decision support approaches for cyber security investment[END_REF] investigated both game theoretic and Knapsack approaches for efficient security investment in Small and Medium Enterprises (SMEs). L. Krautsevich et. al., [START_REF] Krautsevich | Risk-Based Usage Control for Service Oriented Architecture[END_REF] applied the 0-1 knapsack problem to selection of the most secure web-service. In contrast to these papers, we considered the problem of minimisation of the probability of survival, adapting the problem to the 0-1 multi-objective knapsack problem. But, it is more important to note that were looking for the optimal specification of the investment limit, which is the input to classical knapsack problems. In short, we did not simply applied the knapsack problem to our scenario, but have solved a different problem (i.e., defining the optimal investment in self-protection and insurance) using the solution of the knapsack problem only as its integral part.

Conclusion

In this paper, we have proposed a viable solution for maximising the utility of an organisation by finding an efficient distribution of investments in self-protection and cyber insurance. In contrast to the exiting models used for the definition of such distribution, we applied a discrete model of self-investments which allows selecting concrete countermeasures that efficiently protect the organisation and reduce the insurance premium. For selection of countermeasures we applied a solution based on the 0-1 multi-objective knapsack problem, but our solution goes beyond this well-known problem and looks for efficient investments (which is a prerequisite for the knapsack problems). The algorithm developed on the theoretical background ensures that only the minimal amount of evaluation cycles are executed.

Not only does our model provide a more practical approach for investment distribution and helps to select the concrete countermeasures to install, but it is also able to conduct the analysis of the planned configuration which is not 100% efficient from security point of view. Such configuration could be enforced by the global enterprise rules, Service Level Agreements or by the law (e.g., GDPR). Although the enforced configuration may be not the most efficient, it still reduces the probability of threat survival and cannot be ignored in the analysis (especially, because it has its own cost).

So far, this paper mostly focuses on the modelling of investments. In contrast to other models, we did not analyse how discrete investments affect the incentive of insureds to invest in self-protection with and without insurance. We also did not include security interdependence and information asymmetry problems into our model. These future steps are required in order to make more precise (and practical) predictions about cyber insurance market behaviour.

Fig. 1 .

 1 Fig. 1. (Exp) expenditure for security self-investments x

Table 3 .

 3 Selection of best countermeasures within security investment

We assume effects of countermeasures independent from each other.

This work was partially supported by projects H2020 MSCA NeCS 675320 and H2020 MSCA CyberSure 734815.


Jukka Ruohonen

Joonas Salovaara

Ville Leppänen
email: ville.leppanen@utu.fi

On the Integrity of Cross-Origin JavaScripts

Keywords: same-origin, cross-domain, remote inclusion, subresource integrity

The same-origin policy is a fundamental part of the Web. Despite the restrictions imposed by the policy, embedding of third-party JavaScript code is allowed and commonly used. Nothing is guaranteed about the integrity of such code. To tackle this deficiency, solutions such as the subresource integrity standard have been recently introduced. Given this background, this paper presents the first empirical study on the temporal integrity of cross-origin JavaScript code. According to the empirical results based on a ten day polling period of over 35 thousand scripts collected from popular websites, (i) temporal integrity changes are relatively common; (ii) the adoption of the subresource integrity standard is still in its infancy; and (iii) it is possible to statistically predict whether a temporal integrity change is likely to occur. With these results and the accompanying discussion, the paper contributes to the ongoing attempts to better understand security and privacy in the current Web.

Introduction

Most current websites load numerous resources from many distinct third-party sources. Among these resources is JavaScript that is executed by clients visiting the websites. There are many viewpoints to this execution of third-party code.

One relates to network protocols [START_REF] Kumar | Security Challenges in an Increasingly Tangled Web[END_REF]. The hypertext transfer protocol (HTTP) over the transport layer security protocol (a.k.a. HTTPS) can only authenticate the server to which a client connects. It does not provide any guarantees about the authenticity of the encrypted content transmitted after the authentication. From this perspective, the authenticity (integrity) of web content has become a pressing concern as more and more content is transmitted through content delivery networks (CDNs) and cloud services, while at the same time legislations all over the world have seen amendments toward mass surveillance. Another viewpoint relates to privacy [START_REF] Nikiforakis | You Are What You Include: Large-Scale Evaluation of Remote JavaScript Inclusions[END_REF][START_REF] Somé | Control What You Include! Server-Side Protection Against Third Party Web Tracking[END_REF]. In many respects, the execution of arbitrary third-party code is in the interests of those involved in the tracking of the Web's client-side. A further viewpoint relates to web security and web standards.

The execution of third-party JavaScript occurs in the same context as the execution of the primary code present in a website [START_REF] Bielova | Survey on JavaScript Security Policies and Their Enforcement Mechanisms in a Web Browser[END_REF][START_REF] Magazinius | Architectures for Inlining Security Monitors in Web Applications[END_REF]. To patch this limitation, the so-called subresource integrity standard has recently been introduced for allowing enumeration of cryptographic hashes that clients verify before execution. 1 Although the standard is oddly restricted only to certain web elements [START_REF] Cucurull | A Javascript Voting Client for Remote Online Voting[END_REF], it is an important step toward at least some theoretical integrity guarantees. The standard and associated considerations are also adopted as frames for this paper. In particular, the paper's motivation builds on the practical challenges facing the widespread adoption of the standard. As will be elaborated, it is also these practical challenges through which the wider security and privacy viewpoints can be reflected. To these ends, the following contributions are made:

1. The paper presents the first empirical study on the temporal (data) integrity of cross-origin JavaScript code used and executed in the wild. 2. The paper shows that temporal integrity changes are relatively common on one hand and subresource integrity checks very uncommon on the other. 3. The paper demonstrates that a limited set of information can be used to predict whether cross-origin JavaScript code is likely to change temporally.

The remainder of the paper is structured into four straightforward sections. Namely: Section 2 discusses the background, Section 3 introduces the dataset, Section 4 presents the results, and Section 5 concludes with a few remarks.

Background

In what follows, the rationale for the empirical study is motivated by briefly discussing the background related to remote cross-origin JavaScript inclusions.

The Same-Origin Policy

The same-origin policy (SOP) is a fundamental part of the Web. It governs the ways elements in a hypertext markup language (HTML) document can interact. An origin is defined as a tuple containing a scheme, a host name, and a port [START_REF] Barth | Internet Engineering Task Force (IETF)[END_REF]. The tuple can be elaborated with the syntax for uniform resource identifiers: scheme:// [user : password@]host : port authority /path?query#fragment, [START_REF] Abdelhamid | Multi-Label Rules for Phishing Classification[END_REF] where host is a fully qualified domain name or an Internet protocol address [START_REF] Berners-Lee | Uniform Resource Identifiers (URI): Generic Syntax (RFC 2396)[END_REF]. If and only if the scheme, the host, and the port fields are equal between two uniform resource locators (URLs), the two locators have the same origin. When this condition is not satisfied, the antonym term cross-origin is often used.

A couple of additional points are warranted about the syntax and its semantics. The first point is about the scheme. The inclusion of this protocol field is essential for isolating websites served via plain HTTP from those served via HTTPS [START_REF] Barth | Internet Engineering Task Force (IETF)[END_REF]. The second point is about the port field: when it is missing, the information is derived from the mandatory scheme. Thus, the same-origin condition holds for the two tuples within the following two example URLs: http://example.com/index.html SOP ≡ http://example.com:port [START_REF] Barth | Internet Engineering Task Force (IETF)[END_REF] when either port ≡ 80 or the two URLs are queried with Internet Explorer, which disregards port when deducing about origins [START_REF] Mozilla Foundation | Same-Origin Policy[END_REF]. For this particular web browser, the tuples from (2) have the same origin for any port ∈ [START_REF] Abdelhamid | Multi-Label Rules for Phishing Classification[END_REF]65535].

The SOP is used for many functions explicitly or implicitly related to privilege separation [START_REF] Bielova | Survey on JavaScript Security Policies and Their Enforcement Mechanisms in a Web Browser[END_REF][START_REF] Dong | A Quantitative Evaluation of Privilege Separation in Web Browser Designs[END_REF]. While these functions cover numerous web elements, the most important function is to restrict the execution of JavaScript by a web browser (refer to [START_REF] Zalewski | Browser Security Handbook, Part 2[END_REF] for slightly outdated but still useful, extensive technical discussion). In essence, two same-origin documents have full access to each other's web resources. They can make HTTP requests to each other via JavaScript, they can manipulate each other's document object model (DOM) that acts as an interface between JavaScript and HTML, and they can even share information about cookies. Thus, without the SOP, a JavaScript running in one tab of a user's browser could do practically anything with the content in another tab.

Despite the SOP restrictions, cross-origin embedding is often allowed [START_REF] Mozilla Foundation | Same-Origin Policy[END_REF]. In particular, cross-origin requests are allowed for <script> tags equipped with the src attribute. When a client's browser encounters such a tag, it will issue a HTTP GET request to retrieve the content, which is executed immediately in the current origin's context. Although additional (security) information can be added to the GET requests via the query and fragment fields [START_REF] Jayaraman | Enforcing Request Integrity in Web Applications[END_REF], the basic security issue thus is that the JavaScript response has full privileges within the requesting web page [START_REF] De Ryck | Security of Web Mashups: A Survey[END_REF][START_REF] Magazinius | Architectures for Inlining Security Monitors in Web Applications[END_REF]. In addition, the cross-origin resource sharing (CORS) standard [START_REF]W3C: Cross-Origin Resource Sharing, W3C Recommendation[END_REF] can be used to relax the SOP policy by whitelisting (in HTTP header responses) those hosts from which cross-origin resources can be loaded dynamically with JavaScript. Either way, the fundamental security risk remains identical: if the host behind a script's source is compromised, arbitrary code can be executed in the context of all websites having included the script. The risk is not only theoretical; a recent data breach allegedly involved a single line of misplaced JavaScript and a compromised third-party [START_REF] Varghese | UK Researcher Says One Line of Code Caused Ticketmaster Breach[END_REF]. One way to analytically approach the risk is to consider the integrity of remote JavaScripts.

Integrity of Cross-Origin JavaScripts

There are numerous distinct aspects to the integrity of websites. For instance, at the DOM and HTML levels, integrity "ensures that the contents of an interaction cannot be modified without the knowledge of the interacting components" [START_REF] De Ryck | Security of Web Mashups: A Survey[END_REF]. Another example would be the concept of web session integrity, which "ensures that an attacker can never force the browser into introducing unintended messages in sessions established with trusted websites, or into leaking the authentication credentials (cookies and passwords) associated to these sessions" [START_REF] Bugliesi | Formal Methods for Web Security[END_REF]. When remote JavaScripts are included in a website, a prerequisite for this notion of web session integrity is the integrity of the remote JavaScripts themselves. For this purpose, the traditional notion of data integrity is suitable.

Thus, let h(•) denote a cryptographic hash function and H a message digest outputted by the function for a given input. (For Internet measurement research, the first secure hash algorithm, or SHA-1, is sufficient and used also in the empirical part of this paper.) Let J further denote a unique cross-origin JavaScript that was included by a web page P with a <script> tag whose src attribute pointed to a unique uniform resource locator, U. Consider then that this URL,

U ∈ P but U SOP ≡ P, (3)
was downloaded at time index t through f (U, t) = { J t if HTTP GET of U was succesful at time t and ∅ otherwise (including all network errors, etc.). ( 4)

By further defining t = 1, 2, . . . , T and

h(f (U, t)) = H t if f (U, t) ≡ ∅ and ∅ otherwise, (5)
the integrity of the remote J from the viewpoint of P can be evaluated by comparing the output from h(•) for two inputs f (U, t) ≡ ∅ and f (U, t + k) ≡ ∅ with k = 0 and 0 < t + k ≤ T . To a reasonable degree for empirical research purposes, the integrity has been intact if and only if H t ≡ H t+k (see [START_REF] Geihs | A Security Analysis of Techniques for Long-Term Integrity Protection[END_REF] for a formal exposition of the same temporal idea). In theory, an integrity violation might be defined to occur also when

h(f (U, t)) ≡ H t but h(f (U, t + k)) ≡ ∅.
As the Internet is not entirely reliable in terms of content transmission via either HTTP or HTTPS, the weaker definition is used in the empirical analysis. The use of cryptographic hashes has been adopted also for recent web standards, recommendations, and guidelines. Namely, the subresource integrity standard allows to specify one or more hashes for <script> and <link> tags with an additional integrity attribute [START_REF]W3C: Subresource Integrity, W3C Recommendation[END_REF]. When a client's browser retrieves the content referenced with these tags and a correctly specified integrity is present, it refuses to process the content in case the predefined hashes do not match the hash of the content retrieved. Furthermore, the content security policy (CSP) dialect can be used to instruct browsers to enforce the subresource integrity constraint for all external (non-inline) scripts [START_REF] Mozilla Foundation | Subresource Integrity[END_REF]. In this case a browser refuses to execute a JavaScript either in case a valid integrity attribute is missing or the integrity check fails. Additional information can be passed to browsers by using the crossorigin attribute from the CORS standard to tell browsers that credentials (including cookies and certificates) are not transmitted through the tags equipped with the subresource integrity checks. By using the symbol H to again denote a message digest, g(•) a base64-encoding function, and referring to the earlier example in (2), the following excerpt can be used to illustrate the syntax of a subresource integrity check enforced for a cross-origin JavaScript: <script src="https://example.com/javascript.js"

integrity="sha256-g(H)" crossorigin="anonymous"></script> Thus, the basic idea is simple but not bulletproof. The standard mentions three potential weaknesses [START_REF]W3C: Subresource Integrity, W3C Recommendation[END_REF]. The first weakness is cryptographic: potential hash collisions undermine the foundations of all integrity checks done with a particular algorithm. The second weakness relates to transmissions: a malicious proxy can obviously strip the attributes in case plain HTTP is used or the context is otherwise insecure (see [START_REF] Conti | A Survey of Man in the Middle Attacks[END_REF] for a survey of these man-in-the-middle scenarios). The third weakness originates from information leakages: it may be possible to deduce about the critical parts of a website protected by integrity checks. By repeatedly loading resources for which integrity checks are enforced, it may be possible to gain information about whether the content protected is static or dynamic. Particularly in case CORS is not used in conjunction with the integrity checks, these information leakages may allow an attacker to eventually guess authentication details [START_REF]W3C: Subresource Integrity, W3C Recommendation[END_REF], for instance. In addition to these three explicitly mentioned weaknesses, so-called browser cache poisoning may potentially circumvent the integrity checks [START_REF] Jia | Man-in-the-Browser-Cache: Persisting HTTPS Attacks via Browser Cache Poisoning[END_REF]. As always, there may be also other already known or yet unknown weaknesses affecting the subresource integrity standard.

Practical Integrity Challenges

There are many practical challenges for widespread integrity checking of crossorigin scripts. Arguably, the cardinal challenge has never been the lack of technical solutions and standards, but rather the adoption of these solutions and standards among clients, servers, software producers, web developers, and numerous other actors involved. In terms of the standardized solutions, a major practical challenge relates particularly to web development practices and the manual work entailed in the implementation and enforcement of the solutions [START_REF] Prokhorenko | Web Application Protection Techniques: A Taxonomy[END_REF]. The pocketsized analytical framework from the previous section can be used to exemplify three practical scenarios on how integrity may vary for cross-origin scripts.

First, two distinct websites P ≡ P may include a script with the same unique U pointing to the same unique J with the same unique H. Second, it is possible that two unique URLs from two distinct websites point to the same unique JavaScript content, possibly at different times t and t + k. In this case

h(f (U, t)) ≡ h(f (U , t + k)) ≡ H t (7)
holds for U ∈ P, U ∈ P , U ≡ U , and P ≡ P . These cases occur because web developers may copy JavaScripts from different Internet sources to their own websites. Furthermore, it is relatively common that a same small script is used in various parts of a website, such that (7) holds for U ∈ P, U ∈ P, and U ≡ U . In other words, certain JavaScripts are included by many websites, scripts from one website may be plagiarized to other sites, and some JavaScripts are used in multiple parts of a single website. All three scenarios have security implications. Besides outright duplicates, the common occurrence of approximately highly similar JavaScript code (a.k.a. code clones) [START_REF] Cheung | Development Nature Matters: An Empirical Study of Code Clones in JavaScript Applications[END_REF] is problematic because a cloned script may contain vulnerabilities. Cloned scripts are also unlikely to be rigorously maintained already due to the lack of strict references to the original sources for which vulnerabilities may be fixed by the original authors. The problem is not only theoretical: recent Internet measurement studies indicate that many websites include vulnerable and outdated JavaScript libraries [START_REF] Lauinger | Thou Shalt Not Depend on Me: Analysing the Use of Outdated JavaScript Libraries on the Web[END_REF]. Regardless whether a vulnerable script is cloned or original, the potential attack vector also increases in case the script is used in multiple parts of a website.

The inclusion of certain cross-origin scripts by numerous websites raises the attack surface to an entirely different level. By compromising a popular CDN used to distribute JavaScript code, arbitrary code may be injected to thousands (or even millions) of websites, and this code may be executed by millions (or even billions) of clients. Even though this scenario has not fortunately realized, the theoretical possibility cannot be ruled out. On the other hand, the scenario has already realized on the side of privacy: "arbitrary code" is executed by billions of web clients due to the inclusion of cross-origin scripts by millions of websites. By assumption, it is also the third-party tracking infrastructures and web advertisements served via these infrastructures that make it difficult for web developers to enforce temporal integrity checks. In fact, it has been argued that web developers no longer even know who they are trusting with their remote JavaScript inclusions [START_REF] Kumar | Security Challenges in an Increasingly Tangled Web[END_REF][START_REF] Ruohonen | Crossing Cross-Domain Paths in the Current Web[END_REF]. Given this motivation, the remainder of this paper focuses on the question of how common temporal integrity changes are in reality.

Data

In what follows, the dataset is elaborated by discussing the sampling and polling routines used to assemble the dataset and the measurement framework for it.

Sampling

By following common research approaches for retrieving JavaScript code [START_REF] Krueger | Intelligent Defense against Malicious JavaScript Code[END_REF][START_REF] Nikiforakis | You Are What You Include: Large-Scale Evaluation of Remote JavaScript Inclusions[END_REF], the initial collection of JavaScripts was done by sampling ten thousand unique second-level domain names from a ranking list made available by Cisco [8]. It is worth remarking that Cisco's lists have been used also previously [START_REF] Mayer | Turning Active TLS Scanning to Eleven[END_REF] as an alternative to Alexa's lists, which are no longer available free of charge. More importantly, each domain in the list was transformed to a second-level domain name. This transformation is justified because the ranks are based on the volume of domain name system (DNS) traffic passing through Cisco's (OpenDNS) servers. For this reason, the list contains separate entries for example for microsoft.com and its subdomains such as data.microsoft.com and ipv6.microsoft.com.

Five further remarks are required about the sampling. To begin with, (a) each domain was queried with the http scheme. Thus, Microsoft's main domain was queried by passing http://microsoft.com to a browser, for instance. That said, (b) it is important to emphasize that redirections were followed for all queries. In terms of the running example, the URL requested was actually redirected to a location https://www.microsoft.com/fi-fi/. These redirections involved both the DNS and the HTTP protocol; typically, HTTP redirections upgraded the http scheme requested to HTTPS connections, while either HTTP or DNS redirections occurred to the subdomains (such as the www-prefixed ones) of the requested second-level domains. The accounting of these redirections is essential for deducing about cross-origin scripts. In addition: when dealing with mostly dynamic content in the contemporary Web, a JavaScript-capable browser is required particularly for executing inline JavaScripts, which may interfere with the execution of external scripts [START_REF] Nikiforakis | You Are What You Include: Large-Scale Evaluation of Remote JavaScript Inclusions[END_REF]. Therefore, (c) a custom WebKit/Qt-powered headless browser was used with JavaScript enabled for all queries. By again following common practices [START_REF] Ruohonen | Whose Hands Are in the Finnish Cookie Jar?[END_REF][START_REF] Ruohonen | Crossing Cross-Domain Paths in the Current Web[END_REF], (d) a 30 second timeout was used for all queries to ensure that the majority of scripts were successfully executed. Finally, (e) all domains were queried two times in order to account temporary failures.

Polling

The domains sampled were used to construct a pool for temporal integrity polling. To construct the pool, all scripts were collected from each domain sampled, but only cross-origin scripts were qualified to the polling pool. All crossorigin comparisons were done based on the visited URLs (and not the requested ones), which were used also for transforming relative URLs to absolute ones. Thus, an initial redirection to a HTTPS connection or a subdomain did not qualify an entry to the pool. During the construction of the pool, each crossorigin U in <script src=" U "> was downloaded via a GET request. After observing that many prior test requests failed when the query and related fields were stripped, all downloads were made with the exact same URLs used in the websites sampled. Although no extensive attempts were made to verify that a given URL actually pointed to a valid JavaScript, Content-Type and related HTTP header fields were recorded for the initial downloads. In addition, each download was passed through a program for checking the multipurpose Internet mail extension (MIME) type. Finally, the downloads that returned non-empty buffers with a HTTP status code 200 were used to construct the polling pool, [U 1 , . . . , U 35417 ]. The URLs within the pool were then polled with HTTP GET requests consecutively for T = 10 days starting from March 23, 2018.

The empirical focus is on the following representation of the polling pool:

[h(f (U, t)), h(f (U, t + 1)), . . . , h(f (U, t + T -1))] i , i ∈ [1, 35417], (8)
where U satisfies (3) with respects to a sampled P. To account for temporary transmission errors, domain name resolution failures, and other related networking shortages, the cases marked with a symbol ∅ in (4) were first removed from each vector. After this removal, each vector was transformed to a set, such that only unique hashes are observed for each script. (None of the transformations resulted a ∅, which would indicate that all polls would have failed.) This simple operationalization provides a straightforward way to observe the temporal integrity of cross-origin scripts: if H U denotes a set of unique hashes, the temporal integrity of a given script residing at U was intact during the polling period if and only if

|H U | = 1.
Although the polling period allows to only observe a rather short time span, a simple subtraction |H U | -1 gives the number of changes.

In what follows, the main empirical insights are summarized by presenting a few descriptive statistics on the dataset and then discussing the classification results.

Descriptive Statistics

Temporal integrity changes are relatively common: more than a quarter of the polls indicated at least one integrity change. The shape of the distribution in Fig. 1 is also interesting: it seems that integrity changes may tend to converge toward a bimodal distribution. In other words, the dataset contains a majority class of scripts for which temporal integrity remained intact, and a minority class for which each daily download resulted in a different hash. The two right-hand side plots also tell that the contents downloaded are indeed mostly JavaScripts. The temporal integrity changes observed go hand in hand with the lack of integrity checks. There are one-to-many references from the URLs polled to the <script> tags that included the sources behind the URLs with cross-origin references. To briefly probe the attributes within these tags, the percentage share of URLs with at least one "back-reference" to a given attribute can be used. Given the few interesting, JavaScript-specific attributes, the shares are: 42.2% for async, 3.7% for defer, 2.4% for crossorigin, and 0.34% for integrity. Thus, it is safe to generalize that subresource integrity checks are rarely used in the current Web. Given the integrity changes observed, widespread future adoption of the subresource integrity standard seems also somewhat unlikely.

However, this tentative prediction partially depends on the cloud service and CDN companies who are hosting and distributing popular JavaScripts. For pointing out the main players, Fig. 2 shows the second-level domain names of the fifteen most frequent sources behind the cross-origin scripts observed. The two plots largely confirm the existing wisdom: common locations of remote JavaScript code are extremely concentrated, tracing only to a few companies [START_REF] Kumar | Security Challenges in an Increasingly Tangled Web[END_REF][START_REF] Nikiforakis | You Are What You Include: Large-Scale Evaluation of Remote JavaScript Inclusions[END_REF]. In particular, Google continues to be the leading distributor of common JavaScript snippets, although Facebook has recently been catching up.

Classification

It is interesting to examine how systematic the temporal integrity changes are statistically. For this purpose, the conditional probability that a change occurs, |H U | > 1, is a sensible measurement target. As for features potentially explaining a change, a good point of reference is provided by the literature on classifying URLs pointing to malware and phishing websites. This literature typically operates with numerous simple metrics extracted from URLs, DNS, and related sources [START_REF] Abdelhamid | Multi-Label Rules for Phishing Classification[END_REF][START_REF] Ma | Beyond Blacklists: Learning to Detect Malicious Web Sites from Suspicious URLs[END_REF][START_REF] Vasek | Empirical Analysis of Factors Affecting Malware URL Detection[END_REF]. To illustrate a few of such metrics, Fig. 3 displays six socalled mosaic plots. Interpretation of the plots is easy: in each plot the area of a rectangle corresponds with the frequency of a cell in a contingency table. Although the first plot indicates that HTTPS does not explain temporal integrity changes, it is still noteworthy-and troublesome-that many of the scripts were included by the websites sampled with the http scheme. As was discussed in Subsection 2.2, subduing the use of plain HTTP is a prerequisite for sound integrity checks. The two remaining plots on the upper row foretell about an association between integrity changes and the presence of query fields but not fragment fields. These observations are reinforced by the three plots on the second row. In particular, a path ending to .js is associated with integrity changes, the domains sampled often appear in the query fields of those URLs whose content changed during the polling, and, finally, the probability of a temporal integrity change is slightly higher for URLs blocked by a common ad-blocking list [START_REF] Petnel | EasyList[END_REF] according to an offline parser [START_REF] Korobov | adblockparser[END_REF]. These observations hint that temporal integrity changes are typical with respect to scripts used for advertisement and tracking purposes. While this conclusion may seem unsurprising, it is important in terms of future adoption of integrity checks for cross-origin JavaScript code. Because many websites rely on advertisements and analytics for business reasons, but the corresponding scripts tend to violate temporal integrity premises, it seems that many websites are simply unable to enforce subresource integrity checks-even when these would be widely endorsed by web developers.

After empirically reviewing over 25 metrics, the ten metrics enumerated in Table 1 turned out to be relevant for statistical prediction. The metrics that did not improve prediction include all of the standardized <script> attributes, all of the Content-Type and MIME types present in the sample, top-level domain names extracted from the URLs, and numerous dummy variables such as whether a host field refers to an Internet protocol (IPv4) address. Given the limited amount of information used for predicting whether a temporal integrity change occurs, the results summarized in Fig. 4 are even surprisingly good. The average classification accuracy is 0.85. It can be concluded that the temporal integrity of cross-origin JavaScripts vary systematically, and that it is possible to predict whether a change occurs to a reasonable degree even with limited information.

Discussion

This paper presented the first empirical study on temporal integrity of remote, cross-origin JavaScript code commonly used in the current Web. According to the empirical results, temporal integrity changes-or, depending on the viewpoint, temporal integrity violations-are relatively common. Given over 35 thousand URLs observed in a short polling period of ten days, about 31% of the JavaScript content behind the URLs witnessed at least one temporal integrity change. One way to digest this result is to simply state that arbitrary code is commonly executed on the client-side of the current Web. Because temporal integrity is not guaranteed, a cryptomining script [START_REF] Eskandari | A First Look at Browser-Based Cryptojacking[END_REF], for instance, can easily replace an existing legitimate script without any alerts for the clients executing the script.

There are many potential solutions but all of these contain limitations. The simplest solution would be to block all cross-origin content on the client-side, but this would severely impact functionality and user experience. Another solution would be to transform cross-origin script tags to iframe tags [START_REF] Bugliesi | Formal Methods for Web Security[END_REF], but this solution has performance implications, and it cannot solve the privacy problems. Analogously: using code clones solves the reliance on dynamically loaded thirdparty code, but at the expense of maintenance and the security risks entailed by in-house maintenance of third-party code [START_REF] Nikiforakis | You Are What You Include: Large-Scale Evaluation of Remote JavaScript Inclusions[END_REF][START_REF] Somé | Control What You Include! Server-Side Protection Against Third Party Web Tracking[END_REF]. The subresource integrity standard offers a further option. As was discussed and empirically demonstrated, widespread adoption of the standard faces many practical obstacles, however. One obstacle affecting the standard-as well as this paper-is the lack of context behind the temporal integrity changes. In other words, a different hash will result upon fixing a vulnerability in a third-party JavaScript library or making a cosmetic change to such a library. Deducing about the nature of temporal changes would be a good topic for further research, although the commonplace obfuscation of JavaScript code makes the topic challenging to say the least.

To put technical details aside, it might be also possible to refine the underlying ideas presented in the standard. The standard leaves the enforcement of integrity checks to the server-side, but there are no theoretical reasons why clients could not enforce the checks themselves based on a trusted collection of scripts. After all, code signing has a long history elsewhere in the software industry [START_REF] Catuogno | Ensuring Application Integrity: A Survey on Techniques and Tools[END_REF]. Given that both web developers and the JavaScript library ecosystem are still taking their first steps toward systematic dependency management and rigorous vulnerability tracking [START_REF] Lauinger | Thou Shalt Not Depend on Me: Analysing the Use of Outdated JavaScript Libraries on the Web[END_REF], code signing seems like a good long-term goal rather than an immediately applicable solution, however. But for large CDNs and companies such as Google and Facebook, signing the JavaScript code included by hundreds of millions of websites might be possible even today. Another question is whether temporal integrity is in the interests of these companies-if clients would no longer blindly execute arbitrary code, user tracking would be more difficult. In this sense, there exists a classical trade-off between security and privacy, but the current balance that violates privacy undermines also security.

Fig. 2 .

 2 Fig. 2. Top-15 Second-Level Domains (ranks based on (a) the aggregation from the host fields of the URLs polled and (b) the number of times the aggregated host fields were included by the cross-origin <script> tags of the second-level domains sampled)

Fig. 3 .Fig. 4 .

 34 Fig. 3. Temporal Integrity According to a Few Dichotomous Metrics (see main text)

Table 1 .

 1 Metrics (D for dichotomous and C for continuous scale, f (x) = log(x + 1) applied for all metrics with C scale, no additional scaling or centering for classification) Character count of the buffer during the first download. BLCK D True if a U would be blocked by a common ad-blocking list [28]. QURL D True if a query field is present in a U. QDOM D True if any of the domains including a script's U appears in query. NOJS D True if a path field of a U does not end to a .js character string. ULEN C Character count of a whole U used for the polling. UNUM C Number of numbers (0, . . . , 9) appearing in a whole U. DNUM C Number of domains in a host field (excl. the top-level domain and IPv4s). DTOP D A dummy variable for each of the domains in the plot (a) in Fig. 2.

	Metric Scale Description and operationalization
	INCL	C Number of sampled domains that included a script with a U.
	SLEN	C

In this paper, the term standard includes also recommendations, guidelines, and working drafts that are well-recognized but not necessarily yet officially standardized.


Dominique Aurélia Citer

Middle Passage Narratives: Flight, Loss and Resistance

Keywords: Limbo, poétique du chancellement, écrivains soucouyan, récits subalternes, Middle Passage

Il s'agit ici d'explorer les stratégies textuelles que les écrivaines antillaises diasporiques Fabienne Kanor et Edwidge Danticat, mettent en oeuvre dans leurs romans a n d'inscrire la mémoire de l'oubli et de la perte engendrée par la traversée du Middle Passage. Pour ce faire, elles s'emploient à recréer les voix de la résistance et de la survie, à élaborer de nouveaux récits pour énoncer la parole des subalternes et transformer les espaces traumatiques en de nouvelles poétiques du chancellement.

 2014), Je ne suis pas un homme qui pleure (2016). She is also a lm maker and a performer. They transform spaces of trauma into spaces of self-expression and selfrenewal.

To illustrate this point, I will focus on Kanor's novel Humus (2006) and Danticat's short story 1937(Krik Krak,1995), and The Farming of Bones (1998), which relates the story of the island of Hispaniola, and the bloody slaughter of twenty thousands of Haitians in 1937 from the point of view of a female character Anabelle. In these narratives, the gure of the soucouyan de ned in The Dictionary of Caribbean English Usage as "a legendary evil, wrinkled old woman who hides by day, but by night sheds her skin she carefully hides in a jar, then becomes a ball of re roving in the air," [START_REF] Allsopp | The dictionary of Caribbean English Usage[END_REF] is manifest. To my mind, this gure should be considered, in a de-centering approach, as a ying maroon who changes his body into that of a bird. The ghost (or witch), represents the negation reborn by reactivating memory and subversion. It returns as an irruption of signs that fragments the text, creating a complex space that questions the center which is the Western world. In doing so, these authors promote a cosmogony and an epistemology scorned and obscured by colonialism.

4

Speaking of the experience of the New World, these writers' intention is to recreate myths, to restructure a past for their community. As Helene Christol aptly points it: 5 Such echoes of the cultures and rituals from Africa point to the attempt to tame the strangeness, the deregulation of the universe, thus incurring a subtle interplay between continuities and discontinuities, ruptures and fusions, the ontological objective being the restoration of order preceded by its disruption. (Christol, 1999, 169)

Flight as Memory: Remembering/Dismembering

This reclamation of the ancestor represents not only an aesthetic act but an act of historical recovery. The one who ies has chosen freedom instead of amnesia.

To y is to remember. Islands off the coast of Georgia, the story was said to be of Angolan origin. The folktale reads:

10 "Once all Africans could y like birds; but owing to their many transgressions their wings were taken away. They remained, here and the power of ight, though they looked like other men, there, in the Sea Islands and out-of-the way places in the low

country […]"
Speaking of ight is referring to the passage of the African myth to the Americas.

A process through which the African became a Caribbean or an American while keeping the essence of his heritage and renewing it.

11

Those who had kept the gift of ight, those who remember, must transgress their suffering bodies and through the process of metamorphosis dismember their bodies. During slavery, the slave's body belonged to the master who used it as a tool, an object. But he did not own the slave's soul. To be free is to have power over one's own body to be able to manipulate it, to transform it and create new esh and bones. In Creole chapé kow literally means "to ee with your body and to save it". In English ight (to ee) and ight (to y) are homonyms. In the present study they seem to proceed from the same pattern: resistance and memory.

The soucouyan writers are the new sorcerers who have stolen the salt from the white masters to give their characters the power of ight. They unveiled the mask. They are the new diviners who apply the myth as paradigm for the diagnosis and solutions of the community's problems. The soucouyan writers reconceived the sorcerer or witch as gures of healing and resistance. They are the ones capable of returning to Africa, to make the reverse journey under the waters and through the air mastering the sacred and old language of the homeland. They are also the embodiment of syncretism for they are bridges upon the salted seas. Those who can y know the (secret) Word. These writers having recourse to myth want to transform the void of historical rupture and

fragmentation into an open-ended vision of possibility. To rehabilitate the image of the soucouyan is to destroy, to dismantle the "master's house" via the medium of language, to challenge western codes. Flight is a t metaphor for the secret and hazardous act of writing, an act of faith and communion. These writers tell us that the community must complete an odyssey of discovery and realize this absolute paradox: that one must be rooted in order to y.

13

The process and reclamation of the suffering body could be read as an epitome of the concepts of deterritorialization and reterritorialization as coined by Deleuze and Guatarri. (Deleuze, Guatarri, 1972) :

14

The movement of deterritorialization that goes from the center to the periphery is accompanied by a peripheral reterritorialization, a kind of economic and political self-centering of the periphery, either in the modernistic forms of a State, socialism or capitalism, or in the archaic form of local despots. It may be all but impossible to distinguish deterritorialization from reterritorialization, since they are mutually enmeshed, or like opposite faces of one and the same process. (Deleuze, 1972, 258).

Within this perspective, territorrialization in the USA in the case of Danticat and Kanor's venture and challenge, similar to Toni Morrison's before her, is to reconstruct history through the reinvention of memory, using the angle of the broken narrative that projects through the text's space in a discontinued and disconnected aesthetic. The troubled waters of the Atlantic then become the ambivalent gure of memory and oblivion.

16

As emphasized by Anny Dominique Curtius in Symbiose d'une mémoire (Curtius,2006) the Middle Passage waters are not only a burying place for voices and bodies but also transfer routes that cross over from an ontological space toward another. 17

They (the soucouyan/writers) are the ones capable of returning to Africa, to make the reverse journey under the waters and through the air mastering the sacred and old language of the homeland. They are also the embodiment of syncretism for they are bridges upon the salted seas. Those who can y know the (secret) word. These writers having recourse to myth, want to transform the void of historical rupture and fragmentation into an open-ended vision of possibility.

18

In Fabienne Kanor's Humus, the female character who ies is the initiated, the priestess. The one who is named Cécile. The one who becomes invisible; who dismembers and transforms into a bird and ies all the way to France; who nds herself burning the plantations in Ayiti. Walcott's poem The Sea is History (Walcott, 1979, 48) as invisible yet present yet bursting of unpredictability, a performative site of memory:

https://www.archipelies.org/200 7/15

Where are your monuments, your battles, martyrs?

Where is your tribal memory? Sirs

In that gray vault. The sea. The Sea

Has locked them up. The sea is History.

Danticat's depiction of the sea is linked to the construction and reconstruction of the female selves as it is seen as a road to freedom and the beginning and the end of all things. This vision of the sea is close to Kanor's landscape as both seascape and landscape appear as feminized or female-constituted or reconstituted spaces. The imagery of the sea not only embodies the uidity of diasporic identities but also establishes the ancestral female gure as a crossroad character allowing cultural continuity. Danticat's prose is also reminiscent of the African belief that the dead, the living and the unborn coexist in the same spiritual space, thus envisioning time as non-linear and blurring the frontiers between reality and myth.

22

In the collection of short stories Krik Krak, the short story Children of the sea tells of Lasirène and of the spirits and deities that live underwater (anba dlo). Danticat refers to Yemaya, who is, in Africa, the Yoruba deities of rivers, but who having to cross the Ocean with the enslaved and subalterns The passage when Josephine replicates her mother's ritualistic and spiritual visit to the river/memorial, echoes to another water grave:

26

We were all daughters of that river, which had taken our mothers from us. Our mothers were the ashes and we were the light. Our mothers were the embers and we were the sparks. Our mothers were the ames and we were the blaze. We came from the bottom of that river where the blood never stops owing, where my mother's dive toward life her swim among all those bodies slaughtered in ightgave her those wings of ame ( 41).

The river is obviously the gure of Oshun 5 , the orisha of Love and unsalted waters.

This mythical gure is a major one in The Middle Passage Narratives as paradigm of memory as evocated in Toni Morrison's acclaimed novel Beloved (Morrison, 1987).

In her essay, Mythatypes: Signatures and Signs of African/Diaspora and Black Goddesses Brook de Vita explores the multiple metamorphosis and dislocations of the African deities, being violently uprooted in the space Outside (American slave plantations). She shows the unconscious inscription of African rituals and spirituality within the literature of the African diaspora:

27

The empowering legacy of riverain goddesses who dwell at the mouth of the sea seems to have dissipated throughout the Diaspora into folktales of lonely, gift-giving or trapped mermaids and hags, such as in the Haitian tale "Mother of Waters" and the African American tales Sukey and the Mermaid (2000,62).

Another illustration of Oshun appears in the epigraph of The Farming of bones: the red bird (which is reminiscent of the Christian Pentecostal symbol). Hence, the matrilineal transmission echoes to the sparks and wings of ame of the short story 1937.

We were all daughters of that river, which had taken our mothers from us. Our mothers were the ashes and we were the light. Our mothers were the embers and we were the sparks. Our mothers were the ames and we were the blaze. We came from the bottom of that river where the blood never stops owing, where my mother's dive toward life her swim among all those bodies slaughtered in ight-gave her those wings of ame ( 41). (My emphasis)

31

Hence, both Danticat and Kanor propose a rede nition of interstitial identities as they challenge the limits and parameters of "Americaness or Frenchness" and interrogate the very de nitions of identity in terms of a third space.

32

The epigraph to Danticat's rst novel, Breath, Eyes, Memory, certainly illustrates this fact:

33

To the brave women of Haiti, grandmothers, mothers, aunts, sisters, cousins, daughters, and friends, on this shore and other shores. We have stumbled but we will not fall (1994: 5). (My emphasis).

Stumbling depicts losing one's balance, one's stability and in Danticat's prose, it seems to work as a metaphor for the resistance of Haitian people against the odds. Stumbling thus implies staggering but not falling, hence managing to voice one's identity beyond obstacles. Both Fabienne Kanor and Edwidge Danticat's works illustrate this permanent quest of belonging and the staging of what I posit as the poetics of staggering 7 that is the search of a third place of re-creation and reinvention of the self, that tries to determinate itself through the interweaving of accommodation and wandering.

34

I posit this perspective within Homi K. Bhabha's conceptualization of a third space (1996) as being "interruptive, interrogative, and enunciative." This space in between that suggests a certain emptiness, a void between two places, is, in my own de nition, full and vibrant. Being an interstice, it is never safe, never stable, but unpredictable and disrupted; it is therefore a complex place of life and death, (Hirsch 98). The word limbo comes from the Latin limbus which means "on the border", or "in between", a kind of no-man's land between heaven and hell where the blessed who died before the coming of Christ resided.

37

The Barbadian poet Edward Kamau Brathwaite is well-known for his metaphor of the limbo in his texts and his many attempts to print the staggering movement, the unbalance as well as the sounds on the page: (1967,(194)(195).

https://www.archipelies.org/200 11/15

In the above poem, as Myriam Moise puts it 8 , "the limbo experience is re-enacted and the liminal self is depicted as experiencing movement, rhythm and sound.

Brathwaite actually gives a voice to the limbo self who is associated with the ascending and descending movements as well as with the inner and outer sounds of survival. This poem embraces Brathwaite's concept of the word as generating power and as carrying power in itself as he writes in his poem "Negus", "I/must be given words to refashion futures/ like a healer's hand […] ll me with words/ and I will blind your God" (1967,224).

39

Repossession is the driving force of Brathwaite's poetry. It is part of the Caribbean response to the idea that Africans in the New World are doomed to conspire in their own futility and despair (hole) unless they repossess themselves by repossessing their hidden past (whole). This seemingly ambiguous example of repossession portrays the African descent search for cultural wholeness.

40

The multiplicity of languages in their narratives informs a mongrelized speech community, which demysti es the notion of purity and therefore stands in opposition to all forms of fundamentalisms, linguistic or otherwise.

41

Beyond the metaphorical edi cation of a Babelian world, Danticat and Kanor remind us of the power of language to hide, distort or blur reality. The juxtaposition and intertwining of divergent voices have subversive overtones that bear upon the construction of a new place. By presenting language, a crucial identity marker, as inherently multiple, impure and unpredictable, they sketch what Foucault de nes as heterotopia that is "an agency that uses writing in order to construct rival spaces at variance with dominant geographical order" (Foucault, 6, 1967) Language interrogates the place, disrupts and remaps it.

42

In addition to the intra-textual stitching that nourishes the narrative, Humus for instance, is enriched with an intertext that illuminates the work's meaning. Kanor Danticat actually exploits diglossia, as a way of disorganizing and destabilizing the text. In doing so, she goes beyond translation and exploits the power of the word, she fuses languages. This crossing of languages (English, Creole, French)

is an epitome of the poetics of staggering, of the soucouyanness which incribes a belonging to a place where the self should be invented, "le lieu de la littérature impossible" 9 as Roland Barthes puts it.

Kanor and Danticat are soucouyan writers and like soucouyans, are haunted by some sense of loss, some urge to reclaim to look back.

Conclusion

As Mimi Sheller puts Citizenship from Below: Erotic Agency and Caribbean Freedom (2012) "we must look for subaltern histories below the surface of the image, tangled in the roots of trees, close to the ground, submerged in the water" (Sheller,2012,139). Danticat and Kanor both seek to create "herstory" they displace and dislocate below the surface, in the air, hence invisible but haunting and interrogating. These authors not only rewrite/right history, they also reshape the voids of below and transform them into places from which Middle Passage narratives may emerge.

Introduction 1 .

 1 Flight as Memory: Remembering/Dismembering 2. Language as Recon guration and W/holeness Conclusion herstory, Limbo, poetics of staggering, soucouyan writers, Middle Passage PLAN  TEXTE INTÉGRAL  Introduction Fabienne Kanor was born in 1970 in Orléans, France, of Martinican parents. She has published seven novels D'eaux douces (2004), Humus (2006) Le jour où la mer a disparu (2007), Les chiens ne font pas les chats (2008), Anticorps (2010), Faire l'aventure (

1

  Edwidge Danticat was born in Port-au-Prince, Haiti in 1969. Her parents separately moved to the United States. Danticat followed them at the age of twelve. Danticat grew up speaking French and Creole as she spoke no English upon moving to the United States. She published in English: Breath, Eyes, Memory (1994); Krik? Krak ! (1995); The Farming of Bones (1998); The Dew Breaker (2004); Claire of the Sea light (2013) and non-ction After the Dance (2002), Brother, I'm dying (2007), Create dangerously, the immigrant artist at work (2010) 2 All Danticat's and Kanor's texts are genuine embodiments of the female diasporic experience of displacement and dislocation, and concrete illustrations of the various authorial strategies to voice self-recreation beyond normative borders.

19

  In using magic as a tool for feminine resistance, Kanor/the one-who-ies reveals herself to be the heiress of Toni Morrison, Simone Schwarz-Bart, Paule Marshall, Maryse Condé. These female writers display in their novels what Toni Morrison de nes as the concept of black cosmogony 2 . This concept is represented by the enrolling of the ghost character who marks, as absent, all those bodies, those anonymous voices, drowned during the Middle Passage 20The suffering female slave bodies become sites of memory-in Pierre Nora's terms, "crossroads" places crossed by multiple dimensions. They are hybrid, mutable sites, where life and death, time and eternity are interwoven. Kanor proceeds to reconstruct, re-assemble the syncopated and rhizomatic writing fragments of the past into a w/hole through the writing of the novel. At the same time sacred and prosaic, these lost bodies can be conceived in the sense of

28«

  A vous con dentiellement, Metrès Dlo, Mère des Rivières » Being displaced in the New World, Oshun became reterriotalized into Erzulie 6 in Haiti, in red and blue.29In the novel, the colours red and yellow at times clash, then fuse when Sophie's set free herself the shame of testing. She would then, in a transgressive way, choose to wrap her mother's corpse in a red shroud, in the amboyant sound of 21/02/2019 Middle Passage Narratives: Flight, Loss and Resistance -Archipélies https://www.archipelies.org/200 9/15

  summons authors through referencing (Derek Walcott, Marguerite Duras, Zora Neale Hurston), parodying (Victor Hugo), and borrowing ctional gures (Alejo Carpentier's Makandal), as if to open the text, as if she were invoking the divinities, the openers of barriers.

  43

  The vital themes and governing structural patterns of Morrison's novels are modeled on African narrative modes which Morrison calls "the oral origins" (mythology, folktales). As an example of an oral origin model, Morrison discusses her use of the myth of Flying Africans in an interview with Leclair:" The ying African myth in Song of Solomon.. If it means Icarus to some readers. Fine.

	21/02/2019	Middle Passage Narratives: Flight, Loss and Resistance -Archipélies
	8
		My meaning is speci c: it is about Black people who could y. That was always
		part of the folklore of my life: ying was one of our gifts" (Leclair, 1993)
	9	Morrison's argument refocuses my reading of Song of Solomon but also
		redirects my approach toward Caribbean literature as a whole: how can one
		explore this myth? As a way of reshaping the slave's fragmented body through
		memories? As transgression, resistance or healing?
		Let us consider the original myth as reported in The Book of Negro Folklore, a
		ground breaking book of Black folktales collected in the 1950's by Langston
		Hughes and Arna Bontemps. Told to the authors by a Gullah man living in the Sea
	https://www.archipelies.org/200	4/15

6

Toni

Morrison's ction, particularly Song of Solomon (1977)

, claims and is rooted in Black expressive cultures which include traditions of myths and oral history.

  in Africa or in France in the case of Kanor can appear as a means of protection and of preservation and therefore questions the idea of belonging in so far as

America in Danticat's work, is mostly a ghost gure as all her characters are haunted by Haiti. As for Kanor she has created her own space in which she can voice her multiple being.

https://www.archipelies.org/200 6/15

  of permanent re-creation and reinvention of the self that tries to determinate itself through the interweaving of the ambiguities of accommodation, as in a state of limbo governed by uncertainty and dis-membering. This poetics is also an echo to Limbo, a popular dance from Trinidad. Some anthropologists such as Sojah Stanley-Niaah relate it to a former African rite to Legba, the god of crossroads, the gate-opener (the God of the writers according to Haitian writer Danny Laferrière). "Consistent with certain African beliefs, the dance re ects the whole cycle of life. Dancers move under a pole that is gradually lowered from chest level, and they emerge on the other side, as their heads clear the pole, as in the triumph of life over death."(Sojah Stanley-Niaah, This in-betweenity, this state of unbalanced existence recalls the limbo, this "bordering place", neither here nor there, "a state of nonresolution or uncertainty"

	36
	2007).
	2. Language as Recon guration and
	W/holeness
	https://www.archipelies.org/200	10/15