Forecasting Malware Incident Rates in Higher Education Institutions

Malware is often behind cybersecurity events like data theft and service disruption. Therefore, forecasting the number of malware incidents in an organization helps security analysts, who can anticipate trends and quickly detect outbreaks. This paper delves into forecasting malware incident rates in Higher Education Institutions (HEI) using the Long Short-Term Memory (LSTM) network, recognized as the leading technique for time series forecasting based on machine learning. Education and research are among the most attacked industries, deserving special attention. In our work, weekly counts of incidents for each institution are represented as a time series. Then, a neural network is trained to take the incident rate from previous weeks as input and forecast the incident rate for the next week. The experiments used real incident data from Brazilian HEIs and investigated the performance of LSTM for multiple institution sizes, amounts of weeks used as input, and amounts of weeks for training. LSTM results were compared to the Autoregressive Integrated Moving Average’s (ARIMA), a traditional statistical method. The results showed that LSTM outperformed ARIMA by a small margin. Additionally, forecasting the number of incidents in smaller institutions was harder than in larger ones.