Forecasting Vulnerability Sightings Under Data Scarcity: Modeling Sparse and Bursty Cyber Threat ...
summary
Built an open source pipeline called Vulnerability-Lookup ingesting ~70 sources and over 2 million vulnerability records, and a severity estimator called VLI severity model. Experiments show SARIMAX fails on very short, sparse, bursty sighting series, while Poisson regression and simple logistic/decay (DKI) fits give more stable, interpretable forecasts. An adaptive selector chooses between DKI and logistic for a configurable 10‑day horizon, and the trend output is already integrated into the lookup UI; about 10 days of sightings materially improves reliability.
AI-written summary · about
chapters (9)
- 0:00Vulnerability forecasting intro
- 2:56Sparse and bursty threat data challenges
- 9:00Testing SARIMAX for forecasting
- 15:25Adaptive model selection with DKI
- 21:41Combining TARDIS with EPSS
- 23:26Future improvements in vulnerability lookup
- 27:46Q&A: Teacher-student models
- 29:57Q&A: Predicting exploitation patterns
- 31:41Q&A: Correlating strings with exploits
related talks
54mTowards Real World Cyber Risk (Panel)
40mForecasting Threats is Way Easier Than You Think
58mWhy Can't We All Just Get Along? Bridging the Gap in Vulnerability Prioritization Standards
58mNothing to Risk but Risk Itself: Expanding Vulnerability Risk with Internet-Scale Data
01h 23mEPSS: Challenges and Opportunities Going Forward + EPSS AMA
57mSeeing the Vulnerable Forest Through the Exploited Trees
58mState of EPSS and What to Expect from Version 4
23mSecurity Outgunned: Measuring Software Defined Attack Surface