Leveraging Intra-Day Temporal Variations to Predict Daily Cyberattack Activity
Gordon Werner, Shanchieh Jay Yang, Katie T. McConky · 2018
Cyber attacks against organizations are occurring with increasing regularity. Defensive systems are in place that can detect malicious traffic within a network. However, these systems can only provide analysis after malicious activity has occurred. What if one can forecast the number of cyberattacks expected for a future day with reasonable accuracies? This paper investigates the use of Auto-Regressive Integrated Moving Average (ARIMA) models to forecast daily counts of different cyberattack types against multiple targets. Smaller measurement periods are used to better capture temporal trends in attack data and increase forecasting accuracy, reducing error by over 14% compared to naive predictions based on average historical occurrence rates. Aggregation techniques are employed to construct a daily forecast using a number of smaller predictions, providing over 11% more accuracy than standard ARIMA models based on daily counts. Temporal intensity variations are leveraged as regressors to further improve model accuracy by over 11% compared to aggregated forecasts. The ARIMA with intensity-based regressors were put into testing to perform predictions up to 7 days in advance, and achieved over 15% improvement over the baseline. ARIMA is able to reduce forecasting error compared to naive approaches, showing that cyber incidents do not occur completely randomly and could be captured and modeled with statistical time series forecasting techniques.