Systems and methods for forecasting cybersecurity ratings based on event-rate scenarios
Disclosed herein are computer-implemented methods and systems for forecasting security ratings for an entity. The methods and systems can include generating a plurality of simulated instantiations of a security scenario for the entity, in which the security scenario characterized by a plurality of security events associated with at least one event type. The methods and systems can further include determining a security rating for each instantiation of the plurality of instantiations; and generating a forecast cone based on the determined security ratings for the plurality of instantiations. In some examples, for each event type of the at least one event type, the methods and systems can include determining a rate, duration, and/or temporal placement of the security events associated with the event type over a forecasting period.
1. A computer-implemented method for forecasting security ratings for an entity, the method comprising:
generating a plurality of simulated instantiations of a security scenario for the entity, the security scenario characterized by a plurality of security events associated with at least one event type;
determining a security rating for each instantiation of the plurality of instantiations, wherein determining the security rating comprises assigning weights to security events of each event type based on (i) historical observations related to the entity and (ii) an industry associated with the entity;
generating a security forecast for each instantiation based at least in part on the determined security rating for the respective instantiation; and
generating a forecast cone based at least in part on the determined security ratings for the plurality of instantiations, wherein the generated forecast cone comprises an inner band based on a first, inner subset of the generated security forecasts and an outer band based on a second, outer subset of the generated security forecasts.
2. The method of claim 1 , wherein generating the plurality of simulated instantiations of the security scenario for the entity comprises:
for each event type of the at least one event type:
determining a rate of the security events associated with the event type over a forecasting period;
determining a duration of the security events associated with the event type in the forecasting period; and
determining a temporal placement of the security events associated with the event type in the forecasting period.
3. The method of claim 2 , wherein determining the rate of the security events associated with the event type over the forecasting period comprises:
sampling from a distribution to determine the rate of the security events associated with the event type.
4. The method of claim 3 , wherein the distribution is selected from the group consisting of: a normal distribution, a log-normal distribution, a geometric distribution, a Poisson distribution, and a uniform distribution.
5. The method of claim 2 , wherein determining the duration of the security events associated with the event type in the forecasting period comprises:
sampling from a distribution to determine the duration of the security events associated with the event type.
6. The method of claim 5 , wherein the distribution is selected from the group consisting of: a normal distribution, a log-normal distribution, a geometric distribution, a Poisson distribution, and a uniform distribution.
7. The method of claim 2 , wherein determining the temporal placement of the security events associated with the event type in the forecasting period comprises:
sampling from a distribution to determine the temporal placement of the security events associated with the event type.
8. The method of claim 7 , wherein the distribution is selected from the group consisting of: a normal distribution, a log-normal distribution, a geometric distribution, a Poisson distribution, and a uniform distribution.
9. The method of claim 1 , wherein determining the security rating for each instantiation of the plurality of instantiations comprises:
generating a ratings time series for the instantiation, the ratings time series forming the security forecast for the instantiation.
10. The method of claim 1 , wherein the inner band of the forecast cone is based on a 25th percentile and a 75th percentile of the subset of the security forecasts and the outer band of the forecast cone is based on a 5th percentile and 95th percentile of the subset of security forecasts.
11. The method of claim 1 , further comprising:
providing, to a user interface, the generated subset of the generated security forecasts for display.
12. The method of claim 1 , wherein determining the security rating further comprises assigning weights to security events of each event type based on a user input.
13. A system for forecasting security ratings for an entity, the system comprising:
at least one memory storing computer-executable instructions; and
at least one processor for executing the instructions storing on the memory, wherein execution of the instructions programs the at least one processor to perform operations comprising:
generating a plurality of simulated instantiations of a security scenario for the entity, the security scenario characterized by a plurality of security events associated with at least one event type;
determining a security rating for each instantiation of the plurality of instantiations, wherein determining the security rating comprises assigning weights to security events of each event type based on: (i) historical observations related to the entity and (ii) an industry associated with the entity;
generating a security forecast for each instantiation based at least in part on the security rating for the respective instantiation; and
generating a forecast cone based at least in part on the determined security ratings for the plurality of instantiations, wherein the generated forecast cone comprises an inner band based on a first, inner subset of the generated security forecasts and an outer band based on a second, outer subset of the generated security forecasts.
14. The system of claim 13 , wherein generating the plurality of simulated instantiations of the security scenario for the entity comprises:
for each event type of the at least one event type:
determining a rate of the security events associated with the event type over a forecasting period;
determining a duration of the security events associated with the event type in the forecasting period; and
determining a temporal placement of the security events associated with the event type in the forecasting period.
15. The system of claim 14 , wherein determining the rate of the security events associated with the event type over the forecasting period comprises:
sampling from a distribution to determine the rate of the security events associated with the event type.
16. The system of claim 15 , wherein the distribution is selected from the group consisting of: a normal distribution, a log-normal distribution, a geometric distribution, a Poisson distribution, and a uniform distribution.
17. The system of claim 14 , wherein determining the duration of the security events associated with the event type in the forecasting period comprises:
sampling from a distribution to determine the duration of the security events associated with the event type.
18. The system of claim 17 , wherein the distribution is selected from the group consisting of: a normal distribution, a log-normal distribution, a geometric distribution, a Poisson distribution, and a uniform distribution.
19. The system of claim 14 , wherein determining the temporal placement of the security events associated with the event type in the forecasting period comprises:
sampling from a distribution to determine the temporal placement of the security events associated with the event type.
20. The system of claim 19 , wherein the distribution is selected from the group consisting of: a normal distribution, a log-normal distribution, a geometric distribution, a Poisson distribution, and a uniform distribution.
21. The system of claim 13 , wherein determining the security rating for each instantiation of the plurality of instantiations comprises:
generating a ratings time series for the instantiation, the ratings time series forming the security forecast for the instantiation.
22. The system of claim 13 , wherein the inner band of the forecast cone is based on a 25th percentile and a 75th percentile of the subset of the security forecasts and the outer band of the forecast cone is based on a 5th percentile and a 95th percentile of the subset of security forecasts.
23. The system of claim 13 , wherein the operations further comprise:
providing, to a user interface coupled to the processor, the generated subset of the generated security forecasts for display.
24. The system of claim 13 , wherein determining the security rating further comprises assigning weights to security events of each event type based on a user input.