There have been extensive efforts in government, academia, and industry to anticipate, forecast, and mitigate cyber attacks. A common approach is time-series forecasting of cyber attacks based on data from network telescopes, honeypots, and automated intrusion detection/prevention systems. This research has uncovered key insights such as systematicity in cyber attacks. Here, we propose an alternate perspective of this problem by performing forecasting of attacks that are analyst-detected and -verified occurrences of malware. We call these instances of malware cyber event data. Specifically, our dataset was analyst-detected incidents from a large operational Computer Security Service Provider (CSSP) for the U.S. Department of Defense, which rarely relies only on automated systems. Our data set consists of weekly counts of cyber events over approximately seven years. Since all cyber events were validated by analysts, our dataset is unlikely to have false positives which are often endemic in other sources of data. Further, the higher-quality data could be used for a number for resource allocation, estimation of security resources, and the development of effective risk-management strategies. We used a Bayesian State Space Model for forecasting and found that events one week ahead could be predicted. To quantify bursts, we used a Markov model. Our findings of systematicity in analyst-detected cyber attacks are consistent with previous work using other sources. The advanced information provided by a forecast may help with threat awareness by providing a probable value and range for future cyber events one week ahead. Other potential applications for cyber event forecasting include proactive allocation of resources and capabilities for cyber defense (e.g., analyst staffing and sensor configuration) in CSSPs. Enhanced threat awareness may improve cybersecurity.

中文翻译：

---

将来有恶意软件吗？预测分析师对网络事件的检测

政府，学术界和工业界已经进行了广泛的工作，以预测，预测和缓解网络攻击。一种常见的方法是根据网络望远镜，蜜罐和自动入侵检测/防御系统中的数据对网络攻击进行时间序列预测。这项研究发现了关键见解，例如网络攻击的系统性。在这里，我们通过对攻击者的攻击进行预测，提出了该问题的另一种观点，这些攻击是分析人员检测到并验证的恶意软件的出现。我们称这些实例为恶意软件网络事件数据。具体来说，我们的数据集是来自美国国防部大型运营计算机安全服务提供商（CSSP）的分析人员检测到的事件，该事件很少仅依赖于自动化系统。我们的数据集包括大约七年来每周的网络事件计数。由于所有网络事件均已由分析师验证，因此我们的数据集不太可能出现误报，而误报通常在其他数据源中很常见。此外，更高质量的数据可用于大量资源分配，安全资源估计和有效风险管理策略的开发。我们使用贝叶斯状态空间模型进行预测，发现可以预测一周前发生的事件。为了量化突发，我们使用了马尔可夫模型。我们在分析人员检测到的网络攻击中系统性的发现与以前使用其他来源的工作是一致的。预测提供的高级信息可以通过提前一周提供未来网络事件的可能值和范围来帮助提高威胁意识。网络事件预测的其他潜在应用包括在CSSP中为网络防御主动分配资源和功能（例如，分析人员和传感器配置）。增强的威胁意识可以提高网络安全性。