Development of a cyberattack forecasting model

Abstract

The article discusses the problem of increasing the proactivity of information system protection by predicting cyber attacks. The main purpose of the research is to develop and validate an information security incident forecasting model based on the analysis of heterogeneous data collected by the Information Security Management Center (SOC). The authors propose a multi-level model architecture that integrates methods for preprocessing large amounts of operational data (SIEM logs, NetFlow, IDS/IPS alerts, EDR data), identifying significant features, and using ensemble machine learning algorithms, including gradient boosting and recurrent neural networks, to identify attack precursors. The effectiveness of the model based on real historical SOC data has been experimentally confirmed, demonstrating a 35% reduction in threat detection time (MTTD) and an increase in forecast accuracy to 0.87. The results of the study have significant practical potential for improving the monitoring and response processes in SOC.