Forecasting Cyberattacks as Time Series with Different Aggregation Granularity

摘要: Cyber defense can no longer be limited to intrusion detection methods. These systems require malicious activity enter an internal network before attack detected. Having advanced, predictive knowledge of future attacks allow a potential victim heighten security and possibly prevent any traffic from breaching the network. This paper investigates use Auto-Regressive Integrated Moving Average (ARIMA) models Bayesian Networks (BN) predict cyber occurrences intensities against two target entities. In addition incident count forecasting, categorical binary occurrence metrics are proposed better represent volume forecasts victim. Different measurement periods used in time series construction model temporal patterns unique each type configuration, seeing over 86% improvement baseline forecasts. Using ground truth aggregated different as signals, BN is trained tested for obtained results provided further evidence support findings ARIMA. work highlights complexity occurrences; subset has characteristics influenced by number external factors.