Survey of Attack Projection, Prediction, and Forecasting in Cyber Security

Abstract

This paper provides a survey of prediction, and forecasting methods used in cyber security. Four main tasks are discussed first, attack projection and intention recognition, in which there is a need to predict the next move or the intentions of the attacker, intrusion prediction, in which there is a need to predict upcoming cyber attacks, and network security situation forecasting, in which we project cybersecurity situation in the whole network. Methods and approaches for addressing these tasks often share the theoretical background and are often complementary. In this survey, both methods based on discrete models, such as attack graphs, Bayesian networks, and Markov models, and continuous models, such as time series and grey models, are surveyed, compared, and contrasted. We further discuss machine learning and data mining approaches, that have gained a lot of attention recently and appears promising for such a constantly changing environment, which is cyber security. The survey also focuses on the practical usability of the methods and problems related to their evaluation.

A simplified approach for dynamic security risk management in connected and autonomous vehicles

“…The precision of the attack predictions can be improved through more sophisticated methods (e.g. see [25]), but will also require more detail regarding the environments with more computational tradeoff. Besides this, the critical threats that we specify may be more useful for short-term rather than long-term analysis, where some non-critical threats can be the first step to launch more severe attacks.…”

A deep learning framework for predicting cyber attacks rates

“…Statistical methods have been widely used in the context of data-driven cyber security research, such as intrusion detection [15][16][17][18]. However, deep learning has not received the due amount of attention in the context of cyber security [13,14]. This is true despite the fact that deep learning has been tremendous successful in other application domains [19][20][21] and has started to be employed in the cyber security domains, including adversarial malware detection [22,23] and vulnerability detection [24,25].…”

“…Moreover, researchers have studied how to use a Bayesian method to predict the increase or decrease of cyber attacks [6], how to use a hidden Markov model to predict the increase or decrease of Bot agents [7], how to use a seasonal ARIMA *Correspondence: xfang13@ilstu.edu 1 School of Information Technology, Illinois State University, Normal 61761, IL, USA Full list of author information is available at the end of the article model to predict cyber attacks [8], how to use a FARIMA model to predict cyber attack rates when the time series data exhibits long-range dependence [1], how to use a FARIMA+GARCH model to achieve even more accurate predictions by further accommodating the extreme values exhibited by the time series data [9], how to use a marked point process to model extreme cyber attack rates while considering both magnitudes and inter-arrival times of time series [10], how to use a vine copula model to quantify the effectiveness of cyber defense early-warning mechanisms [11], and how to use a vine copula model to predict multivariate time series of cybersecurity attacks while accommodating the high-dimensional dependence between the time series [12]. We refer to two recent surveys on the use of statistical methods in cyber incident and attack detection and prediction [13,14].…”

Decision Support for Mission-Centric Cyber Defence

“…These are usually weighted, e.g., by the probability that the attacker will choose the action. If an attacker takes all the actions to transition from an initial state to any of the success states, the attack is successful, as the success states represent a system compromise [5]. A recent comprehensive taxonomy of attack graph generation and usage was proposed by Kaynar [8].…”