Leveraging Intra-Day Temporal Variations to Predict Daily Cyberattack Activity

摘要: Cyber attacks against organizations are occurring with increasing regularity. Defensive systems in place that can detect malicious traffic within a network. However, these only provide analysis after activity has occurred. What if one forecast the number of cyberattacks expected for future day reasonable accuracies? This paper investigates use Auto-Regressive Integrated Moving Average (ARIMA) models to daily counts different cyberattack types multiple targets. Smaller measurement periods used better capture temporal trends attack data and increase forecasting accuracy, reducing error by over 14% compared naive predictions based on average historical occurrence rates. Aggregation techniques employed construct using smaller predictions, providing 11% more accuracy than standard ARIMA counts. Temporal intensity variations leveraged as regressors further improve model aggregated forecasts. The intensity-based were put into testing perform up 7 days advance, achieved 15% improvement baseline. is able reduce approaches, showing cyber incidents do not occur completely randomly could be captured modeled statistical time series techniques.