Using Population Characteristics to Build Forecasting Models for Computer Security Incidents

Computer and network security incidents have financial and other consequences to organizations, such as direct business losses from theft of proprietary information or from just reputational damage. There are also costs for restoring operations and protecting against threats. Being able to quantify the impact of different factors within an organization may provide additional context for prevention and remediation efforts. This paper examines a large set of security incident data along with some population characteristic data from an organization's network. We discuss the rationale for examining the different population characteristics and their potential influence on computer security incidents. We then create logistic regression models using the population characteristics to forecast which machines in the population may be involved in a computer security incident. We evaluate the models using the forecasts as a set of unequal probability weights combined with repeated sampling. We also explore different time windows used for the inclusion of data during model creation.