Data breaches have begun to take on new dimensions and their prediction is becoming of great importance to organizations. Prior work has addressed this issue mainly from a technical perspective and neglected other interfering aspects such as the social media dimension. To fill this gap, we propose STRisk which is a predictive system where we expand the scope of the prediction task by bringing into play the social media dimension. We study over 3800 US organizations including both victim and non-victim organizations. For each organization, we design a profile composed of a variety of externally measured technical indicators and social factors. In addition, to account for unreported incidents, we consider the non-victim sample to be noisy and propose a noise correction approach to correct mislabeled organizations. We then build several machine learning models to predict whether an organization is exposed to experience a hacking breach. By exploiting both technical and social features, we achieve a Area Under Curve (AUC) score exceeding 98%, which is 12% higher than the AUC achieved using only technical features. Furthermore, our feature importance analysis reveals that open ports and expired certificates are the best technical predictors, while spreadability and agreeability are the best social predictors.

Understanding the properties exhibited by Spatial-temporal evolution of cyber attacks improve cyber threat intelligence. In addition, better understanding on threats patterns is a key feature for cyber threats prevention, detection, and management and for enhancing defenses. In this work, we study different aspects of emerging threats in the wild shared by 160,000 global participants form all industries. First, we perform an exploratory data analysis of the collected cyber threats. We investigate the most targeted countries, most common malwares and the distribution of attacks frequency by localisation. Second, we extract attacks’ spreading patterns at country level. We model these behaviors using transition graphs decorated with probabilities of switching from a country to another. Finally, we analyse the extent to which cyber threats have been affected by the COVID-19 outbreak and sanitary measures imposed by governments to prevent the virus from spreading.

Probing is the first step to gain access to a network. Predicting the rate levels of probing against a network sufficiently ahead of time could be insightful to security analysts and practitioners. Indeed, an accurate prediction would help to understand the potential threats and attacks menacing an organization's network. However, this prediction problem is a challenging task; prior works make predictions over time horizons not exceeding a few hours. In this work, we propose a machine learning approach to predict the next day probing rate levels for a network telescope by leveraging Twitter users' sentiments toward the country hosting the network telescope. First, we investigate the relationship between probing rates and Twitter sentiments. Second, we cluster the probing rates to determine the probing severity levels. Finally, we predict future rate levels using several classifiers. We show that incorporating negative sentiments improves significantly the prediction performance. This demonstrates the importance of incorporating social signals as predictors when predicting future probing rates.