Geopolitical data improves forecasts of cybersecurity incidents
Forecasting Cybersecurity Incidents Using Geopolitical Data and Large Language Models
Cryptography and Security
Summary
Predicting cybersecurity breaches helps organizations defend themselves better. Past attempts mostly looked at network problems but missed clues about attackers' motives. This paper shows that using news and podcasts analyzed by large language models can capture geopolitical context tied to attacks. Combining this with network data improves prediction accuracy. The authors also identify when and which data sources help the most.
What this means in practice
- •For cyber defense teams: Enhance incident forecasting by integrating geopolitical context with network data to anticipate cyber attacks better.
- •For cyber insurance analysts: Improve risk assessment models for cyber insurance using geopolitical signals combined with network features to predict incidents more accurately.
Authors
Mark Fesenko, Abdullah Garra, Yaniv Harel, Mahmood Sharif
Abstract
Predicting security incidents is a profound task critical for informing proactive defensive measures and cyber-insurance policies. Prior work tackling this problem mainly utilized structured, manually defined features based on network measurements (e.g., protocol misconfigurations). Still, despite leading to promising performance, the network-based features may fail to capture aspects related to adversaries' motives. To fill this gap, our work leverages geopolitical data mined from public sources--which may help capture attacker motives--to forecast security incidents. Specifically, our approach relies on news articles and transcribed podcasts that are fed to large language models to automatically produce rich representations. The representations are then fed to a classifier trained to forecast future incidents based on historical ones. Our evaluation with a large incidents dataset (>15,700 records) demonstrates substantial accuracy (71.4% ROC AUC) with geopolitical data alone. Notably, combining geopolitical data and network measurements outperforms the state-of-the-art technique based on network features alone (81.3% vs.77.5% ROC AUC). Our analysis also helps shed light on when geopolitical data is most helpful and the data sources that are most useful for accurate forecasting.