Forecasting Cyber-Attacks to Destination Ports Using Machine Learning

To anticipate and counter cyber-attacks that may threaten the stability of the economy, society, and governments around the world, significant efforts have made particularly towards the detection of cyber-attacks, while fewer studies have focused on their forecasting. This paper proposes a framework that provides forecasts of upcoming (within the next minute) cyber-attacks, as well as their type, to a specific destination port. To this end, several machine learning-based methods are applied on measurements (observations) obtained from the network traffic flow. The proposed method is supported by two major pillars: first, the selection of appropriate features generated by the network traffic and, second, in addition to the selected features, the detection of the type of cyber-attacks that occurred in the past. The proposed framework is evaluated on the CIC- IDS2017 synthetic dataset and provides a robust performance in forecasting the type of upcoming cyber-attack in terms of Accuracy, Precision, Recall, F1-score and confusion matrix