A Machine Learning Framework for Predicting Cyber Incidents and Assessing Their Severity
The increase in both the number of cyberattacks and the ways they are carried out has created a need for more advanced methods to manage threats before they happen. This paper will describe an ML-based cyber risk predicting system that utilizes Random Forest classifiers to predict type of attack, financial loss category, and time to resolution. The model leverages multi-attribute data (e.g., country from which the adversary attacks, industry targeted by the attack, impact to users, attack source) that have been encoded into categorical, ordinal, and numeric formats, and normalized. To address the data imbalance resulting from small and/or limited data sets in order to achieve balanced learning, Random Oversampling was used. The methodologies used to train the models were built into an interactive web API using Flask, as well as a desktop-based predictor that provide real-time inference about incident severity level. The proposed framework has demonstrated good multi-class classification performance through fair experimental evaluation allowing for the early estimation of the impact of a cyber incident. The proposed framework provides a step towards more intelligent, interpretable, and scalable approaches to assess cyber risk or support decision making for managing cyber security.