Cloudy with a chance of breach: forecasting cyber security incidents

摘要: In this study we characterize the extent to which cyber security incidents, such as those referenced by Verizon in its annual Data Breach Investigations Reports (DBIR), can be predicted based on externally observable properties of an organization's network. We seek proactively forecast breaches and do so without cooperation organization itself. To accomplish goal, collect 258 measurable features about network from two main categories: mismanagement symptoms, misconfigured DNS or BGP within a network, malicious activity time series, include spam, phishing, scanning sourced these organizations. Using train test Random Forest (RF) classifier against more than 1,000 incident reports taken VERIS community database, Hackmageddon, Web Hacking Incidents Database that cover events mid-2013 end 2014. The resulting is able achieve 90% True Positive (TP) rate, 10% False (FP) overall accuracy.