Optimizing cyberattack frequency forecasting by advanced machine learning adaptation with tumbling windows

Abstract

Significant research has been directed towards cyberattack detection through reactive assistive techniques, utilizing pattern-matching algorithms for scanning system logs and network traffic to identify known signatures. While effective machine learning (ML) models have been developed to automate detection processes–including identifying, tracking, and blocking malware and intruders–comparatively less attention has been given to cyberattack prediction, particularly for time scales extending beyond daily observations. Long-term attack prediction approaches are highly valued, offering defenders extended periods for the development and dissemination of defensive strategies and tools. Long short-term memory (LSTM) networks are frequently chosen among ML models for their strong performance in time series data analysis. This paper presents a novel methodology combining LSTM models with flexible sliding window techniques to improve prediction outcomes and enhance training efficiency. Experiments also incorporate convolutional filters and combined bivariate performance measures, similar to methodologies used in enhancing stock forecasting systems. These substantial contributions are anticipated to offer valuable insights for researchers in this field.

Introduction

Damage inflicted by numerous waves of cyberattacks on governments, organizations, and enterprises over the past decade¹ underscores the unprecedented security challenges facing global technology infrastructure in an increasingly de-globalized world. Cyber defenses, however, have predominantly remained reactive, incurring substantial execution time overhead. This latency is a direct consequence of the complex pattern-matching operations required to identify the unique signatures of polymorphic malware^2,3, which exhibits different behavior with every execution. More recently, machine learning-based models employing anomaly detection algorithms have been developed. While these models demonstrate effectiveness in detecting unknown attacks, the incorrect classification of benign behavior as abnormal⁴ leading to false alarms can occur. Data availability is argued to enable a proactive defense, permitting actions prior to a potential threat escalating into an actual incident. Proactive approaches can mitigate, delay, and even prevent incidents in the first place regarding non-cyber threats like terrorism and military attacks, with numerous software programs existing for evaluating terrorist intentions and methods⁵. Current machine learning (ML) capabilities support proactive, low-latency cyber defenses⁶, suggesting that cyberattacks should not be considered an exception. Cyber incidents are highly sensitive events, generally kept confidential due to the impact on organizational reputation, which makes tracking challenging as they can even go unnoticed by victims. Preprocessing cybersecurity data presents difficulties due to factors such as lack of structure, format variability, and high rates of missing values, potentially distorting findings. Nevertheless, ML models are indeed capable of delivering accurate and reliable forecasts⁷. When developing an ML-based method, either manual feature identification and engineering can be employed, or features can be learned directly from raw data. The likelihood of a cyber incident can be influenced by numerous factors, considered as potential features.

Cyber warfare is frequently a result of wars and political conflicts between nations^8,9. Correlation might exist between the frequency of an attack’s mention in scientific literature and its actual incident rate. Moreover, politically significant dates, such as holidays and anniversaries, often see cyberattacks occur⁵. Identifying suitable features from unstructured big data constitutes a crucial component within the proposed framework. Due to the rapid advancement of Internet technology and the acceleration of digital transformation, cyberspace has become a crucial element of modern society. However, this digitization process simultaneously introduces escalating security threats; various types of cyberattacks, including malware, ransomware, distributed denial of service (DDoS) attacks, phishing, and zero-day vulnerability exploitation, pose significant risks to personal privacy, business operations, and even national infrastructure, appearing with unprecedented frequency and complexity¹⁰. Achieving better results when understanding cyberattack time series relationships, a common finding in existing research, requires specialized preprocessing or the extraction of useful features from input data sources. Furthermore, studies on Cyber Threat Intelligence mining¹¹ have covered cybersecurity-related entities and events, cyberattack tactics, techniques and procedures, hacker profiles, indicators of compromise, vulnerability exploits, malware implementation, and threat hunting, alongside a thorough review of the state of the art. Detection of cyberattacks injecting malicious signals into physical components or communication networks, through which information is transmitted among these components, is primarily based on the intersection of two ellipsoid sets, focusing on two types: replay attacks and bias injection attacks¹². Presented in other research is an efficient hybrid machine learning model (EHML) for cybercrime detection and classification, which utilizes supervised learning for crime detection and an unsupervised learning-based data reduction technique to create an optimal cybercrime analysis model¹³.

This paper aims to refine and enhance the performance of existing machine learning models in predicting the frequency of various types of cyberattacks, providing more precise guidance for cybersecurity management and defense, and contributing to a more secure and resilient cyberspace. Through rigorous methodology and comprehensive analysis, this paper endeavors to offer actionable insights that can be integrated into practical cybersecurity frameworks, thereby mitigating risks and improving overall security measures against evolving cyberattacks. In addition to causing data loss or service disruption, cyberattacks can lead to significant financial losses, the disclosure of private information, social unrest, and even threats to national security. Attacks on critical infrastructure, such as financial services, healthcare systems, and power networks, can jeopardize public safety and disrupt societal order. Therefore, accurately predicting the occurrence of network attacks has become increasingly important, as it enables the proactive deployment of defense measures, optimizes resource allocation, and reduces potential losses. The rest of the paper is organized as follows: Section “Theoretical background” presents the theoretical background for machine learning models, along with additional technologies that can assist with prediction and performance measurement. The setup for related experiments and a description of the experimental procedures are provided in Section "Advanced cyberattack prediction systems". Prediction results are discussed in Section “Experiment results”. Finally, Section “Conclusion” concludes the paper.

Theoretical background

Hopfield introduced the Hopfield network, a single-layer feedback neural network designed to solve combinatorial optimization problems, which served as the prototype for the earliest recurrent neural networks (RNNs) in 1982¹⁴. Elman later simplified this concept into a more basic RNN model¹⁵. A key feature of the RNN model is that the output from the hidden layer is connected to both the output layer and the subsequent hidden layer. However, this approach often leads to issues of vanishing or exploding gradients when processing sequential data, particularly with long sequences, which can ultimately prevent the model from converging. Following their successful applications in various fields, deep learning models have increasingly been employed to address time series prediction problems. By utilizing a deep learning model with diverse sequences, the model can acquire knowledge from multiple sequences, enhancing its efficiency in solving large-scale time series data.

Various long and short-term memory models

The attention mechanism is a valuable addition, as it helps the model more effectively identify the important information in a sequence for the current prediction, thereby improving accuracy¹⁶. It also allows the model to adaptively adjust its focus based on different input and task scenarios, enhancing its flexibility and generalization capabilities^17,18. Figure 1 illustrates a scenario using LSTM for temporal prediction, comparing the performance with and without attention mechanisms. From the raw time series chart in the upper left corner, significant fluctuations and trend changes in the data are evident. Without the attention mechanism (indicated by the blue arrow pipeline), the LSTM model assigns equal weight to features across all time steps, which prevents it from distinguishing the more important time points when processing the data. As a result, there is a noticeable gap between the model based predictions and the actual data. When the attention mechanism is utilized (indicated by the yellow arrow pipeline in Fig. 1), the model can dynamically adjust its focus according to different segments of the time series. This mechanism enables the model to learn the significance of specific time points and modify its prediction strategy accordingly. The following charts illustrate the distribution of feature weights after applying the attention mechanism. It is evident that the weights at different time points have changed significantly, indicating that the model can more effectively capture the key features of the time-series data. From the prediction result graph, it is clear that the model tracks the actual data trend more closely after implementing the attention mechanism, resulting in a significant reduction in the error between the predicted values and the actual values.

Fig. 1.

Comparison of pipelines in Original LSTM and Attn-LSTM^16,19.

Long Short Term Memory (LSTM) networks were first proposed in 1997 as a solution to the gradient vanishing and exploding problems in recurrent neural networks (RNNs)²⁰. The original LSTM architecture included only an input gate and an output gate. Subsequently, the incorporation of additional structures such as the forget gate and Peekhole Connection²¹ led to the development of the widely used version of the LSTM model. The distinction between LSTM and RNN resides in the intermediate repeating module, as illustrated in Fig. 2. This repeated module, referred to as the cell state, comprises three gating structures–input, output, and forget gates–formed by four activation functions with associated effects. To facilitate model convergence, these gate structures control the input and output of information, enabling training errors to propagate both forward and backward. The LSTM model has demonstrated significant success in predicting time-series data²².

Fig. 2.

The structure of RNN and LSTM models¹⁹.

LSTM utilizes two gates to manage the content of the cell state c. The first is the forget gate, which determines the extent to which the previous cell state is retained at the current time . The second is the input gate, which controls the amount of the network’s input that is stored in the cell state at the current time. Additionally, LSTM employs output gates to regulate how much of the cell state is transmitted to the current output value . The forget gate by adapting a Sigmoid function could defined as follows:

1

where is the weight matrix of the forget gate and means to connect two vectors into a longer vector and is the bias term of the forget gate. If the input dimension is , hidden dimension is , dimension for cell state is , then dimension for weight matrix of forget gate is . The weight matrix is actually composed of two matrices, first one is , it corresponds to input term ; second one is , it corresponds to input term which could be written as follows:

2

The output gate controls the impact of long-term memory on the current output which is defined as follows:

3

and the final output of the LSTM model is determined by the output gate and the cell state is:

4

It is important to note that LSTM is sensitive to the selection of hyper-parameters, such as the learning rate, hidden layer size, and gating parameters, due to the presence of multiple trainable gating units and memory cells. Optimizing these hyper-parameters is critical; however, identifying the optimal values can be achieved through carefully designed experiments and adjustments²³. The attention mechanism enables the model to consider the global context while generating output, as well as to concentrate on processing key information, which can be defined as follows:

5

Finally, the context vector is combined with the hidden state at the current time to serve as the final input to the next stage of the network. This can be accomplished through simple concatenation or other combination methods. A straightforward structure that integrates the attention mechanism with LSTM is illustrated in Fig. 3. Specifically, a single-head additive attention mechanism is employed to compute a context vector c as a weighted sum of the hidden states, where the weights are learned based on the similarity between each hidden state and a trainable context vector. The context vector is then passed through a fully-connected layer to produce the single-step forecast.

Fig. 3.

Structure of Attention-LSTM model²⁴.

Time-window sliding and convolutional filter techniques

To enhance prediction performance, a combination of the Attention LSTM model with the time sliding window technique is proposed. The Attention LSTM model is the base ML model for our experiments. Based on the length of the test data and the distance of each slide, the data will be divided into different time intervals t. In the time iteration, a fixed window size n is applied, where the input training data consists of to . After the model has completed training, it predicts the next data point before sliding to the next time iteration . Based on the window size n, the new input training data is selected by discarding the initial training data from the time iteration and incorporating the most recently predicted data. This results in the input data ranging from to . Following this, the model is retrained to predict , and the process continues to slide. At this stage, two sliding window operations have been completed, and the subsequent step involves continuing the sliding process until the predetermined length of the test data is reached. Another type of time-window sliding technique is known as the Tumbling Window (TW), which shares similarities with the Sliding Window (SW) method²³. In the TW technique, the previous step is repeated by using data from to as training data, while predicting data from to . The specific mathematical definition of the TW technology advocated in this paper is given a univariate time series and a fixed window size , the Tumbling Window operation partitions the sequence into a set of strictly non-overlapping consecutive data blocks could be defined as follows:

where

On each block , the model is trained independently and then used to predict the first time point of the subsequent block . Unlike the Sliding Window technique, which advances with a stride of 1 and retrains at every step, TW reduces the number of training cycles by a factor of approximately 1/w, substantially lowering the computational overhead while maintaining competitive forecasting accuracy (Fig. 4).

Fig. 4.

Various sliding windows techniques; (up) sliding windows (SW); (down) tumbling windows (TW).

A convolution filter is a discrete convolution applied to the original signal using a small window to enhance the signals²⁵. Also known as a kernel, it was initially designed for image processing tasks such as blurring, sharpening, embossing, and edge detection. This enhancement is achieved by performing a convolution between the kernel and the original signal. These filters could effectively process data by employing a data-driven design method to remove Gaussian noise from images²⁶. In the context of time-series predictions, convolutional filters can assist in extracting specific features from input data, particularly because not all training data should carry the same weight. Recent fluctuations in cyberattack data should be given greater significance for model training, while long-term data should have only a minimal impact. Consequently, different filters can be designed according to these requirements, allowing for varying degrees of data optimization. Results related to the adaptation of the convolutional filter has been provided in the experiment results in Section "Convolutional filter optimization and performance".

Performance measures

Symmetric Mean Absolute Percentage Error (SMAPE) serves as an error metric for assessing the performance of prediction models, especially in the realms of time series forecasting and regression analysis. In contrast to the traditional Mean Absolute Percentage Error (MAPE), SMAPE offers a more balanced measure of error by treating both predicted and observed values equally. Hence, the method of calculation for SMAPE remains unchanged, regardless of whether the predicted value is higher or lower than the actual value. The formula for calculating SMAPE is as follows:

6

where is the actual value at the i-th time point, is the predicted value at the i-th time point, and n is the number of values. The CBPM has been introduced to evaluate two conflicting performance metrics: error rate and training speed. This novel performance metric is intended for assessing systems or processes that involve these opposing measures²⁷. Concepts from quality tolerance models can similarly be applied to performance metrics instead of quality metrics²⁸. The behavior of these performance measures can be described in terms of bigger-is-better (BIB) and smaller-is-better (SIB) trends²⁸. The performance measures to be combined as the CBPM in this research are the SMAPE and the ML training time, both of which exhibit the SIB trend. The independent variable set influences both performance functions²⁸. Since the trends of both performance measures in this research are SIB, the optimum shall be determined as follows²⁷:

7

Given that both performance measures follow a smaller-is-better trend, the ideal value of the combined single performance measure will be at its minimum. This novel combined performance measure has been utilized to assess machine learning (ML) algorithms in order to identify the best ML system²⁹ or to determine the optimal hyper-parameter values²³.

Advanced cyberattack prediction systems

In this section, we will outline the dataset used in the experiment, detail each step of the process, and offer results from different viewpoints. Our specific aim is to identify the optimal configurations for the convolutional filters and the size of the Tumbling Window technique.

Dataset

The experiment was conducted using a dataset of significant cyber events collected over an 11-year period from 2012 to 2023, occurring monthly across 36 countries and regions¹⁰. A total of 10 representative attack types were selected for the experimental dataset: Adware, Cryptojacking, DDoS, Defacement, Malvertising, Password, Ransomware, SQL Injection, Vulnerability, and XSS. In line with standard practices in machine learning, the data was divided into training and testing sets, with the distribution of the accumulated counts for the 10 attack types illustrated in Fig. 5. Notably, the latter half of this period (i.e., recent years) has seen a significant increase in the number of cyberattacks, which indirectly evaluates the learning capability and robustness of the prediction model.

Fig. 5.

Distribution of training and testing sets for all 10 attacks.

Experiment setups

The traditional Min-Max normalization method is employed for data normalization, scaling the data to the interval as outlined in 8. In this context, X refers to the original data, and represent the minimum and maximum values within the dataset, respectively, and indicates the normalized data.

8

The next step involves defining the LSTM model using the hyper-parameters listed in Table 1. In selecting the optimizer, various optimization techniques were considered^30,31 and AdamW has been selected as the optimizer because it has been demonstrated superior generalization performance (see Table 1). All experiments has been conducted to ensure reproducibility, with the specific hardware and software configurations detailed: Experiments were performed on a cloud-based instance equipped with dual NVIDIA T4 GPUs (16GB VRAM each), an Intel Xeon(R) E5-2680 v4 2.40GHz, and 32 GB of system RAM. Codes were implemented in Python 3.9, utilizing PyTorch 1.12.0 as the primary deep learning framework, with CUDA 11.3 to enable GPU acceleration. A dropout rate of 0.2 was applied to the outputs of both LSTM layers to mitigate overfitting. An early stopping strategy was adopted, where training was terminated if the validation loss did not decrease for 10 consecutive epochs, and the model with the best validation performance was restored. The entire dataset, spanning monthly records from 2012 to 2023, was split chronologically: the first 70% of the timeline for training, the following 15% for validation, and the final 15% for testing. No random shuffling was applied, preserving the temporal order. To ensure the robustness of our findings, each experimental configuration was repeated independently five times with different random initializations (seeds: 42, 39, 101, 16, 728). The reported SMAPE and training times are the means ±standard deviations across these five runs. Pairwise t-tests were conducted to evaluate the statistical significance of the differences between the optimal window size and its alternatives, with a significance level of 0.05. It is noted that the training length and batch size are influenced by the window size set due to the use of the TW technique.

Table 1.

Parameters setting of Attn-LSTM model.

Parameter	Value
Loss function	Mean squared error
Network architecture	2 LSTM layers with 50 hidden dimension each
Optimizer	AdamW
Batch Size	Align with Window Size
Epoch	1000
Learning Rate	0.01

The ML model iteratively selects the best hyperparameters before transitioning to the test dataset for prediction. In the final step, the predictive results are assessed and compared with the actual data to confirm its performance. The complete experimental process of our prediction system is depicted in Fig. 6.

Fig. 6.

Experiment steps flow diagram.

In summary, the model was loaded with the processed data for training, primarily using the time sliding window technique to segment the data and produce training and testing datasets based on the batch size. Specific features were extracted from the data using convolutional filter techniques. Afterward, the model was initialized to facilitate its reuse for data loading, training, and prediction in each subsequent iteration.

Window size optimization for tumbling window

The variations between the sliding window (SW) and tumbling window (TW) techniques were tested to compare their performance and determine the optimal window size. While both techniques use the same parameter settings, SW typically achieves a significantly better SMAPE, as the model is retrained after sliding only one block of data at a time in this experiment. However, SW requires longer training times than TW, as it slides each time the model needs to be retrained²³. According to our experiments comparing the two sliding window techniques (SW and TW), the training time for the TW technique can be up to 17 times faster than that of the SW technique, even though the SMAPE performance of SW is only marginally better than that of TW. This intriguing phenomenon has prompted the choice of the TW approach for implementing our prediction system. The performance dataset for SMAPE and the training time of the tumbling window-adapted ML system is presented in Table 2. The t-tests employing a 99% confidence interval at the significance level α = 0.01 have been conducted to compare the baseline window size (i.e., size=2), representing the case without tumbling window techniques, against several different window sizes. The results of this evaluation indicate that tumbling windows applied at specific sizes produce statistically significant improvements in the overall performance of the system.

Table 2.

Two performance measures (mean ±std, n=5) of the Tumbling Window technique based on the window size (average for all 10 attack samples).

Window size	2	2
SMAPE	0.331 ±0.012	0.317 ±0.009	0.291 ±0.008	0.333 ±0.011	0.379 ±0.015
? (p-value)	−	No (0.0734)	Yes (0.0005)	No (0.7907)	Yes (0.0006)
Training time [sec]	99.74 ±4.2	53.29 ±2.8	30.09 ±1.9	19.45 ±1.2	15.10 ±0.8

Evaluation of several alternative performance measures that are widely utilized in time-series forecasting and regression tasks has been carried out, with the corresponding outcomes documented in Appendix A, resulting in the selection of SMAPE as the criterion employed for optimizing the machine learning system. It is noted that mean absolute error (MAE) and root mean square error (RMSE), as other commonly used performance measures, fail to account for relative error magnitudes, thereby rendering them less informative when dealing with low- and high-frequency attacks. These performance measures disproportionately penalize larger deviations through error squaring, potentially skewing optimization toward outlier sensitivity rather than overall accuracy.

Consequently, SMAPE integrates seamlessly with the Combined Bivariate Performance Measure (CBPM) which provides a more robust framework for model selection in proactive cyber defense applications²⁷. The CBPM was calculated for each window size, revealing that the optimal window size for the tumbling window technique is 8 , which provides the best performance by balancing two conflicting performance measures (see Fig. 7).

Figure 7.

CBPM optimization of the window size in the TW technique.

Convolutional filter optimization

Convolutional filters were applied to process the data using different weights, resulting in the design of three distinct filters based on the tumbling window (TW) approach to enhance our system, Table 3 lists the explicit weight vectors for the three convolutional filters when the window size is fixed to w=8. All weight vectors are normalized so that .

Table 3.

Explicit weight vectors of STCF, SMCF, and LCF for window size w=8.

Position i	STCF	SMCF	LCF
1	0.0121	0.4008	0.0603
2	0.0199	0.2432	0.1134
3	0.0329	0.1476	0.1528
4	0.0543	0.0895	0.1735
5	0.0895	0.0543	0.1735
6	0.1476	0.0329	0.1528
7	0.2432	0.0199	0.1134
8	0.4008	0.0121	0.0603
Sum	1.0000	1.0000	1.0000

The weight design of the Short-term Convolutional Filter (STCF) prioritizes recent data, featuring the largest proportion of new data and the smallest proportion of past data among the three filters. In contrast, the Short-to-Mid-term Convolutional Filter (SMCF) follows the opposite design²³. Our experiments indicate that using the STCF yields better accuracy compared to the other filters, despite requiring more training time for their application (see Table 4).

Table 4.

Convolutional filter comparison (mean ±std, n=5) (TW size = 8, Average of all attacks).

Filter type	SMAPE	Training time [sec]
No filter	0.291 ±0.008	30.09 ±1.9
STCF	0.276 ±0.007	28.25 ±1.5
SMCF	0.285 ±0.008	25.56 ±1.4
LCF	0.297 ±0.010	25.68 ±1.4

Experiment results

Following the previous section, the tumbling window approach has been chosen for integration into our forecasting system. To illustrate the effectiveness of TW on machine learning algorithms, we compared the performance of the Attn-LSTM model with and without the TW technique. A variety of cyberattack samples–such as Adware, Cryptojacking, DDoS, Defacement, Malvertising, Password attacks, Ransomware, SQL Injection, Vulnerability exploits, and XSS–were selected for these performance comparisons. These samples were sourced from 36 different countries and regions¹⁰. Furthermore, the performance results from using the SCTF filters are also included in this analysis.

Tumbling window performance

To evaluate the performance difference between the LSTM models with and without the tumbling window (TW) technique, the optimal tumbling window size was determined to be 8, as discussed in Section "Window size optimization for tumbling window". This window size is applied to the original LSTM model, while all other parameters remain consistent with those of the LSTM model that does not utilize the TW technique.

As illustrated in Fig. 8, the Attn-LSTM with the tumbling window (TW) technique was compared to the base LSTM model (i.e., Attn-LSTM without TW) and the Bayesian encoder-decoder LSTM (B-LSTM) from recent research¹⁰. In the best-case scenario, the proposed TW technique yields a 53% reduction in SMAPE compared to the B-LSTM baseline¹⁰. The average SMAPE reduction across all attack types is observed to be the percent. This suggests that the TW method requires significantly less input training data and only about one-eighth of the training iterations of the original LSTM (i.e., ), while still delivering superior performance across all metrics.

Fig. 8.

SMAPE comparison between B-LSTM¹⁰, Original Attn-LSTM, Attn-LSTM plus Tumbling Window and Attn-LSTM plus Tumbling Window plus STCF for 3 attack samples and average for all 10 attacks.

Convolutional filter optimization and performance

The performance result of the original LSTM is considered as 1.00, allowing for separate comparison results for the tumbling window (TW) and TW-STCF (see Fig. 9). Clearly, TW with STCF demonstrates a higher performance index, indicating that the convolutional filter technique effectively enhances stock forecasting results. In terms of training time, the SMCF and LCF exhibit the best performance.

Fig. 9.

Performance improvement after adapting Convolutional Filter and Tumbling Window based Attn-LSTM for the overall 10 attacks.

Conclusion

Effective communication concerning potential attacks and relevant security measures at an early stage is enabled by this study, thereby facilitating future planning. Incident prevention is enhanced by affording increased time to develop optimal defensive actions and tools within a contested cyberspace. Versatile sliding window techniques, such as the tumbling window, are applied to the Attention Long Short-Term Memory (LSTM) model and the Bayesian encoder-decoder LSTM model, drawing from recent research. Furthermore, the convolutional filter technique offers simplification in modifying weights for customized training data across various periods, aiding in achieving desired prediction outcomes. Future work shall be focused on extending this methodology to predict the aggregated frequency of cyberattacks at finer time frequency, moving beyond monthly counts towards weekly or daily predictions.

Appendix A Comparisons with other performance measures

Supplementary analyses augmenting the principal forecasting evaluation are furnished by incorporating additional error metrics consisting of MAE and RMSE, with the detailed outcomes presented in Table 5.

Table 5.

Convolutional filter comparison with MAE and RMSE (TW size = 8, Average of all attacks).

Filter type	MAE	RMSE
No filter	1.0015 ± 0.042	2.3851 ± 0.067
STCF	0.9652 ± 0.037	2.2978 ± 0.065
SMCF	0.9878 ± 0.043	2.3248 ± 0.072
LCF	0.9982 ± 0.043	2.3895 ± 0.069

Author contributions

Author contributions: writing-draft, Z. Zhan; conceptualisation, S.-K. Kim; software, Z. Zhan; Visualization, Z. Zhan; writing-revision, S.-K. Kim; experiments, Z. Zhan; review, S.-K. Kim.

Funding

This work was supported in part by the Macao Polytechnic University (MPU) under Grant RP/FCA-05/2024.

Data availability

The datasets for this paper are available on the GitHub repository [10] which are available at the following URL: https://github.com/zaidalmahmoud/Cyber-threat-forecast.

Declarations

Competing interests

The authors declare no competing interests.