FORECASTING INFORMATION TRENDS CYBERATTACKS AS A TOOL FOR COUNTERING VULNERABILITIES IN THE ECONOMY

Abstract

This article is devoted to the issue of forecasting information trends of cyberattacks using the construction of autoregression models. The study's results will contribute to forming a strategy for countering cybercrimes at the macro level, reducing the impact of their negative consequences on development and the emergence of vulnerabilities in economic processes. Calculations were made based on Google Trends data for three types of cyber attacks related to social engineering, DoS attacks and attacks on user passwords. The data set was created from January 28, 2018, to January 22, 2023. Calculations were performed using the Python programming language. The process of forecasting consisted of the implementation of several preliminary tests, the construction of forecast models and their verification. Conducted Jarque–Bera test and analysis of distribution histograms for each data series established the necessity of logarithmizing the series of social engineering and attacks on user passwords. The extended Dickey–Fuller test confirmed the stationarity of the social engineering and DoS attacks. The time series of attacks on user passwords is non-stationary, so it will be integrated with the simulation process. The decomposition of trends revealed the presence of a seasonal component for social engineering and attacks on user passwords with lag 52. As a result, an ARMA model with autoregression and moving average components was built for DoS attacks, and SARIMA with seasonal and autoregressive elements for other series. The models were constructed iteratively based on analysing AIC, BIC and HQIC information criteria. As a result, those with the best values were selected. The residuals and forecast verification tests revealed a satisfactory model for DoS-attacks, social engineering – high level, although with the presence of autocorrelation of the residuals due to the seasonal component, for attacks on user passwords – high level, but with the presence of heteroscedasticity of the residuals, which requires further modification of the model. Although the prediction results turned out to be ambiguous, the constructed models can be used to predict cybercrimes related to DoS attacks and social engineering.