Forecasting Cybersecurity Incidents Using Geopolitical Data and Large Language Models

2026-10-03

AI Summary

This study addresses the limitation of traditional cybersecurity forecasting, which relies predominantly on network features and struggles to capture attackers' underlying motivations. For the first time, this work incorporates unstructured geopolitical data into a predictive framework by leveraging large language models to extract semantic representations from news articles and podcasts. These representations are integrated with text mining techniques, machine learning classifiers, and historical network data to construct a fused predictive model. By effectively incorporating attacker intent information, the proposed approach overcomes the constraints of existing methods that depend solely on network-level features. Experimental results demonstrate that the multi-source data fusion achieves an ROC AUC of 81.3%, significantly outperforming current state-of-the-art methods.

Abstract

Predicting security incidents is a profound task critical for informing proactive defensive measures and cyber-insurance policies. Prior work tackling this problem mainly utilized structured, manually defined features based on network measurements (e.g., protocol misconfigurations). Still, despite leading to promising performance, the network-based features may fail to capture aspects related to adversaries'motives. To fill this gap, our work leverages geopolitical data mined from public sources--which may help capture attacker motives--to forecast security incidents. Specifically, our approach relies on news articles and transcribed podcasts that are fed to large language models to automatically produce rich representations. The representations are then fed to a classifier trained to forecast future incidents based on historical ones. Our evaluation with a large incidents dataset (>15,700 records) demonstrates substantial accuracy (71.4% ROC AUC) with geopolitical data alone. Notably, combining geopolitical data and network measurements outperforms the state-of-the-art technique based on network features alone (81.3% vs.77.5% ROC AUC). Our analysis also helps shed light on when geopolitical data is most helpful and the data sources that are most useful for accurate forecasting.

Problem

• Cybersecurity Incident Forecasting
• Geopolitical Data
• Attacker Motives
• Large Language Models

Innovation

• Cybersecurity Forecasting
• Geopolitical Data
• Large Language Models
• Feature Representation
• Incident Prediction