Cyber Incident Forecasting Models
Pre-computed analytical forecasting parameters for SOC incident volume prediction.
Models Included
Statistical (statsmodels-compatible analytical)
| Model | Description |
|---|---|
| Moving Average | 24-hour simple MA |
| Exponential Smoothing | Holt linear (α=0.35) |
| ARIMA | ARIMA(2,0,1) |
| SARIMA | Seasonal ARIMA with 24h period |
| VAR | Bivariate VAR(1) on incidents + alerts |
| State Space | Local level + seasonal Kalman-style |
Machine Learning (analytical weights)
| Model | Framework |
|---|---|
| Random Forest | scikit-learn compatible weights |
| XGBoost | gradient boosting weights |
| LightGBM | leaf-wise boosting weights |
| HistGradientBoosting | histogram-based GBM weights |
Validation
Walk-forward chronological validation — no random split.
Metrics: MAE, RMSE, MAPE, Pinball Loss, Prediction Interval Coverage.
Intended Use
- SOC capacity planning demos
- Analyst staffing estimation
- Release/holiday/campaign scenario forecasting
- Research and education
Limitations
- Trained on synthetic data only
- Not for production SOC deployment without retraining on real metrics
- Scenario multipliers are illustrative
Published by Aria AI Security Analytics Team.