On Aggregation and Prediction of Cybersecurity Incident Reports

Abstract

The study of cybersecurity incidents is an active research field. The purpose of this work is to determine accurate measures of cybersecurity incidents. An effective method to aggregate cybersecurity incident reports is defined to set these measures. As a result we are able to make predictions and, therefore, to deploy security policies. Forecasting time-series of those cybersecurity aggregates is performed based on Koopman’s method and Dynamic Mode Decomposition algorithm. Both techniques have shown to be accurate for a wide variety of dynamical systems ranging from fluid dynamics to social sciences. We have performed some experiments on public databases. We show that the measure of the risk trend can be effectively forecasted.

Keywords

• Cybersecurity
• extended dynamic mode decomposition
• Koopman operator
• time series forecasting
• threat prediction MSC[2010]: 00A72 (General methods of simulation)
• 93A30 (Mathematical modeling)