Abstract:A relatively unexplored issue in cybersecurity science and engineering is whether there exist intrinsic patterns of cyberattacks. Conventional wisdom favors absence of such patterns due to the overwhelming complexity of the modern cyberspace. Surprisingly, through a detailed analysis of an extensive data set that records the time-dependent frequencies of attacks over a relatively wide range of consecutive IP addresses, we successfully uncover intrinsic spatiotemporal patterns underlying cyberattacks, where the term "spatio" refers to the IP address space. In particular, we focus on analyzing {\em macroscopic} properties of the attack traffic flows and identify two main patterns with distinct spatiotemporal characteristics: deterministic and stochastic. Strikingly, there are very few sets of major attackers committing almost all the attacks, since their attack "fingerprints" and target selection scheme can be unequivocally identified according to the very limited number of unique spatiotemporal characteristics, each of which only exists on a consecutive IP region and differs significantly from the others. We utilize a number of quantitative measures, including the flux-fluctuation law, the Markov state transition probability matrix, and predictability measures, to characterize the attack patterns in a comprehensive manner. A general finding is that the attack patterns possess high degrees of predictability, potentially paving the way to anticipating and, consequently, mitigating or even preventing large-scale cyberattacks using macroscopic approaches.

Cyber Attacks Against Enterprise Networks: Characterization, Modeling and Forecasting.

Towards a Framework for Cyber Attack Impact Analysis of Electric Cyber Physical Systems.

Time series forecasting of cyber attack intensity

Cascading Failures of Power System with the Consideration of Cyber Attacks.

Statistical Techniques for Detecting Cyberattacks on Computer Networks Based on an Analysis of Abnormal Traffic Behavior

Spatiotemporal patterns and predictability of cyberattacks

Ventilatory effects of propofol infusion.

Interval forecasting of cyber-attacks on industrial control systems

Formal Description of Cyber Attacks

Characterizing Cyber Attacks against Space Systems with Missing Data: Framework and Case Study

A Survey on Enterprise Network Security: Asset Behavioral Monitoring and Distributed Attack Detection

Modeling impact of attacks, recovery, and attackability conditions for situational awareness

A Collaborative Characteristic Event Sequence Based Identification Method for Cyberattacks in Cyber-Physical System

Characterizing the Landscape of COVID-19 Themed Cyberattacks and Defenses

Predicting Cyber Events by Leveraging Hacker Sentiment

Enterprise Cyber Resiliency Against Lateral Movement: A Graph Theoretic Approach

Advanced security testing using a cyber‐attack forecasting model: A case study of financial institutions

On the anatomy of cyberattacks

Exploration of Enterprise Server Data to Assess Ease of Modeling System Behavior

[Water intoxication and syndrome of urinary tract obstruction relief during prolonged neuroleptic treatment].

Building Computer Network Attacks