Spatiotemporal patterns and predictability of cyberattacks

Abstract

A relatively unexplored issue in cybersecurity science and engineering is whether there exist intrinsic patterns of cyberattacks. Conventional wisdom favors absence of such patterns due to the overwhelming complexity of the modern cyberspace. Surprisingly, through a detailed analysis of an extensive data set that records the time-dependent frequencies of attacks over a relatively wide range of consecutive IP addresses, we successfully uncover intrinsic spatiotemporal patterns underlying cyberattacks, where the term "spatio" refers to the IP address space. In particular, we focus on analyzing {\em macroscopic} properties of the attack traffic flows and identify two main patterns with distinct spatiotemporal characteristics: deterministic and stochastic. Strikingly, there are very few sets of major attackers committing almost all the attacks, since their attack "fingerprints" and target selection scheme can be unequivocally identified according to the very limited number of unique spatiotemporal characteristics, each of which only exists on a consecutive IP region and differs significantly from the others. We utilize a number of quantitative measures, including the flux-fluctuation law, the Markov state transition probability matrix, and predictability measures, to characterize the attack patterns in a comprehensive manner. A general finding is that the attack patterns possess high degrees of predictability, potentially paving the way to anticipating and, consequently, mitigating or even preventing large-scale cyberattacks using macroscopic approaches.

References in corpus (11)

• Resilience of the Internet to random breakdowns
• Cascade-based attacks on complex networks
• Dynamical and correlation properties of the Internet
• Breakdown of the Internet under intentional attack
• Topology of the conceptual network of language
• Fluctuations in network dynamics
• On the universality of the scaling of fluctuations in traffic on complex networks
• Scaling breakdown in flow fluctuations on complex networks
• Extreme events on complex networks
• Random walks on complex networks with inhomogeneous impact
• Preferential Behaviour and Scaling in Diffusive Dynamics on Networks

Cited by in corpus (8)

• A Classification Model for Sensing Human Trust in Machines Using EEG and GSR
• On Predictability of Time Series
• Metrics Towards Measuring Cyber Agility
• Malware in the Future? Forecasting of Analyst Detection of Cyber Events
• Characterizing the Landscape of COVID-19 Themed Cyberattacks and Defenses
• A Case Study on Using Deep Learning for Network Intrusion Detection
• Data-Driven Characterization and Detection of COVID-19 Themed Malicious Websites
• STEP: Spatial-Temporal Network Security Event Prediction