Security network devices by forecasting future security incidents for a network based on past security incidents
Securing network devices by forecasting future security incidents for a network based on past security incidents. In one embodiment, a method may include constructing past inside-in security features for a network, constructing past outside-in security features for the network, and employing dynamic time warping to generate a similarity score for each security feature pair in the past inside-in security features, in the past outside-in security features, and between the past inside-in security features and the past outside-in security features. The method may further include generating a Coupled Gaussian Latent Variable (CGLV) model based on the similarity scores, forecasting future inside-in security features for the network using the CGLV model, and performing a security action on one or more network devices of the network based on the forecasted future inside-in security features for the network.
1. A computer-implemented method for securing network devices by forecasting future security incidents for a network based on past security incidents, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:
constructing past inside-in security features for a network;
constructing past outside-in security features for the network;
employing dynamic time warping to generate a similarity score for each security feature pair in the past inside-in security features, in the past outside-in security features, and between the past inside-in security features and the past outside-in security features;
generating a Coupled Gaussian Latent Variable (CGLV) model based on the similarity scores;
forecasting future inside-in security features for the network using the CGLV model; and
performing a security action on one or more network devices of the network based on the forecasted future inside-in security features for the network.
2. The method of claim 1 , wherein:
the constructing of the past inside-in security features for the network is accomplished by monitoring network activity from inside the network; and
the constructing of the past outside-in security features for the network is accomplished by monitoring network activity from outside the network.
3. The method of claim 1 , wherein:
the forecasted future inside-in security features for the network comprise a network device being attacked; and
the performing of the security action comprises preventing the network device from being attacked.
4. The method of claim 1 , wherein:
the forecasted future inside-in security features for the network comprise a network device being infected with malicious software; and
the performing of the security action comprises preventing the network device from being infected with malicious software.
5. The method of claim 1 , wherein:
the forecasted future inside-in security features for the network comprise a network device having vulnerable software being installed thereon; and
the performing of the security action comprises preventing the network device from having vulnerable software being installed thereon.
6. The method of claim 1 , wherein the forecasting of the future inside-in security features for the network using the CGLV model comprises forecasting temporal variation profiles of the forecasted future inside-in security features for the network.
7. A computer-implemented method for securing network devices by forecasting future security incidents for a network based on past security incidents, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:
constructing past inside-in security features for a network;
constructing past outside-in security features for the network;
employing dynamic time warping to generate a similarity score for each security feature pair in the past inside-in security features, in the past outside-in security features, and between the past inside-in security features and the past outside-in security features;
generating a Coupled Gaussian Latent Variable (CGLV) model based on the similarity scores;
forecasting future inside-in security features for the network and future outside-in security features for the network using the CGLV model; and
performing a security action on one or more network devices of the network based on the forecasted future inside-in security features for the network and the forecasted future outside-in security features for the network.
8. The method of claim 7 , wherein:
the constructing of the past inside-in security features for the network is accomplished by monitoring network activity from inside the network; and
the constructing of the past outside-in security features for the network is accomplished by monitoring network activity from outside the network.
9. The method of claim 7 , wherein:
the forecasted future inside-in security features for the network and the forecasted future outside-in security features for the network comprise a network device being attacked; and
the performing of the security action comprises preventing the network device from being attacked.
10. The method of claim 7 , wherein:
the forecasted future inside-in security features for the network and the forecasted future outside-in security features for the network comprise a network device being infected with malicious software; and
the performing of the security action comprises preventing the network device from being infected with malicious software.
11. The method of claim 7 , wherein:
the forecasted future inside-in security features for the network and the forecasted future outside-in security features for the network comprise a network device having vulnerable software being installed thereon; and
the performing of the security action comprises preventing the network device from having vulnerable software being installed thereon.
12. The method of claim 7 , wherein the forecasting of the future inside-in security features for the network and the future outside-in security features for the network using the CGLV model comprises forecasting temporal variation profiles of the forecasted future inside-in security features for the network and the forecasted future outside-in security features for the network.
13. The method of claim 7 , wherein the forecasting of the future inside-in security features for the network and the future outside-in security features for the network using the CGLV model comprises forecasting relationships between the forecasted future inside-in security features for the network and the forecasted future outside-in security features for the network.
14. One or more non-transitory computer-readable media comprising one or more computer-readable instructions that, when executed by one or more processors of one or more computing devices, cause the one or more computing devices to perform a method for securing network devices by forecasting future security incidents for a network based on past security incidents, the method comprising:
constructing past inside-in security features for a network;
constructing past outside-in security features for the network;
employing dynamic time warping to generate a similarity score for each security feature pair in the past inside-in security features, in the past outside-in security features, and between the past inside-in security features and the past outside-in security features;
generating a Coupled Gaussian Latent Variable (CGLV) model based on the similarity scores;
forecasting future inside-in security features for the network using the CGLV model; and
performing a security action on one or more network devices of the network based on the forecasted future inside-in security features for the network.
15. The one or more non-transitory computer-readable media of claim 14 , wherein:
the constructing of the past inside-in security features for the network is accomplished by monitoring network activity from inside the network; and
the constructing of the past outside-in security features for the network is accomplished by monitoring network activity from outside the network.
16. The one or more non-transitory computer-readable media of claim 14 , wherein:
the forecasted future inside-in security features for the network comprise a network device being attacked; and
the performing of the security action comprises preventing the network device from being attacked.
17. The one or more non-transitory computer-readable media of claim 14 , wherein:
the forecasted future inside-in security features for the network comprise a network device being infected with malicious software; and
the performing of the security action comprises preventing the network device from being infected with malicious software.
18. The one or more non-transitory computer-readable media of claim 14 , wherein:
the forecasted future inside-in security features for the network comprise a network device having vulnerable software being installed thereon; and
the performing of the security action comprises preventing the network device from having vulnerable software being installed thereon.
19. The one or more non-transitory computer-readable media of claim 14 , wherein the forecasting of the future inside-in security features for the network using the CGLV model further comprises forecasting future outside-in security features for the network using the CGLV model.
20. The one or more non-transitory computer-readable media of claim 19 , wherein the forecasting of the future inside-in security features for the network and the future outside-in security features for the network using the CGLV model comprises:
forecasting temporal variation profiles of the forecasted future inside-in security features for the network and the forecasted future outside-in security features for the network; and
forecasting relationships between the forecasted future inside-in security features for the network and the forecasted future outside-in security features for the network.