# Forecasting Cyber Attacks with Imbalanced Data Sets and Different Time Granularities

## TL;DR

This paper proposes using unconventional signals from various data sources and a Bayesian network to predict cyber attacks at different time granularities, addressing data imbalance with a novel oversampling technique.

## Contribution

It introduces a new method combining diverse data signals and a Bayesian network for cyber attack prediction, along with a novel oversampling technique for imbalanced data.

## Key findings

- Unconventional signals can predict attacks across different time granularities.
- The proposed oversampling method outperforms existing techniques.
- Predictions are effective even with signals not directly related to the target organization.

## Abstract

If cyber incidents are predicted a reasonable amount of time before they occur, defensive actions to prevent their destructive effects could be planned. Unfortunately, most of the time we do not have enough observables of the malicious activities before they are already under way. Therefore, this work suggests to use unconventional signals extracted from various data sources with different time granularities to predict cyber incidents for target entities. A Bayesian network is used to predict cyber attacks where the unconventional signals are used as indicative random variables. This work also develops a novel minority class over sampling technique to improve cyber attack prediction on imbalanced data sets. The results show that depending on the selected time granularity, the unconventional signals are able to predict cyber attacks for the anonimyzed target organization even though the signals are not explicitly related to that organization. Furthermore, the minority over sampling approach developed achieves better performance compared to the existing filtering techniques in the literature.