Abstract:A relatively unexplored issue in cybersecurity science and engineering is whether there exist intrinsic patterns of cyberattacks. Conventional wisdom favors absence of such patterns due to the overwhelming complexity of the modern cyberspace. Surprisingly, through a detailed analysis of an extensive data set that records the time-dependent frequencies of attacks over a relatively wide range of consecutive IP addresses, we successfully uncover intrinsic spatiotemporal patterns underlying cyberattacks, where the term "spatio" refers to the IP address space. In particular, we focus on analyzing {\em macroscopic} properties of the attack traffic flows and identify two main patterns with distinct spatiotemporal characteristics: deterministic and stochastic. Strikingly, there are very few sets of major attackers committing almost all the attacks, since their attack "fingerprints" and target selection scheme can be unequivocally identified according to the very limited number of unique spatiotemporal characteristics, each of which only exists on a consecutive IP region and differs significantly from the others. We utilize a number of quantitative measures, including the flux-fluctuation law, the Markov state transition probability matrix, and predictability measures, to characterize the attack patterns in a comprehensive manner. A general finding is that the attack patterns possess high degrees of predictability, potentially paving the way to anticipating and, consequently, mitigating or even preventing large-scale cyberattacks using macroscopic approaches.

Modeling and predicting extreme cyber attack rates via marked point processes

Predicting Cyber Attack Rates with Extreme Values

Modeling multivariate cyber risks: deep learning dating extreme value theory

Cyber Protection for Malware Attack Resistance in Cyber-Physical Power Systems

Spatiotemporal patterns and predictability of cyberattacks

Modeling and Predicting Cyber Hacking Breaches.

A comprehensive model for cyber risk based on marked point processes and its application to insurance

Cyber risk modeling: a discrete multivariate count process approach

Cyber Attacks Against Enterprise Networks: Characterization, Modeling and Forecasting.

Statistical Modeling of Computer Malware Propagation Dynamics in Cyberspace

Robust Dynamic Latent Variable Model for Dynamic Process Monitoring with Missing Data in Cyber-Physical Systems

A Stochastic Model of Active Cyber Defense Dynamics

Modeling Multivariate Cybersecurity Risks

Characterizing Honeypot-Captured Cyber Attacks: Statistical Framework and Case Study.

Cybersecurity: A Stochastic Predictive Model to Determine Overall Network Security Risk Using Markovian Process

A novel probabilistic modeling for multilateral random attacks in cyber‐physical system reliability analysis

Statistical Techniques for Detecting Cyberattacks on Computer Networks Based on an Analysis of Abnormal Traffic Behavior

Extreme Risk Assessment in Power System Considering Cyber Attacks

Prediction of Cyberspace Security Data Based on the Markov Chain Model

Modeling Attack Process of Advanced Persistent Threat Using Network Evolution

Modeling Network Systems under Simultaneous Cyber-Attacks