Source-linked AI summary
Modeling Sparse and Bursty Vulnerability Sightings: Forecasting Under Data Constraints
Cedric Bonhomme, Alexandre Dulaunoy
TL;DR
The paper examines whether sparse, bursty vulnerability sightings can be forecast and whether VLAI severity improves such forecasts. It evaluates SARIMAX and Poisson regression, finding limited SARIMAX improvements and more plausible Poisson-based results, while emphasizing severe data constraints.
Problem
Forecasting observable vulnerability activity remains relatively unexplored, especially for sparse sightings such as PoCs, scanner detections, and discussions.
Method
The study compares SARIMAX models using transformed counts and VLAI severity with Poisson regression for forecasting sighting counts.
Results
Poisson regression showed improved general trends over ARIMA-based methods, whereas SARIMAX adjustments produced only marginal improvements and retained unstable forecasts.
Takeaways & Limitations
Count-based models provide a more suitable operational direction for discrete sightings, but forecasts should be interpreted as general trends rather than precise predictions.
Takeaways & Limitations
Very short sighting histories constrain forecasting: ARIMA-based methods may need roughly 50 observations, while many CVEs provide only 10–30 days.
Abstract
from arXiv · showhide
Understanding and anticipating vulnerability-related activity is a major challenge in cyber threat intelligence. This work investigates whether vulnerability sightings, such as proof-of-concept releases, detection templates, or online discussions, can be forecast over time. Building on our earlier work on VLAI, a transformer-based model that predicts vulnerability severity from textual descriptions, we examine whether severity scores can improve time-series forecasting as exogenous variables. We evaluate several approaches for short-term forecasting of sightings per vulnerability. First, we test SARIMAX models with and without log(x+1) transformations and VLAI-derived severity inputs. Although these adjustments provide limited improvements, SARIMAX remains poorly suited to sparse, short, and bursty vulnerability data. In practice, forecasts often produce overly wide confidence intervals and sometimes unrealistic negative values. To better capture the discrete and event-driven nature of sightings, we then explore count-based methods such as Poisson regression. Early results show that these models produce more stable and interpretable forecasts, especially when sightings are aggregated weekly. We also discuss simpler operational alternatives, including exponential decay functions for short forecasting horizons, to estimate future activity without requiring long historical series. Overall, this study highlights both the potential and the limitations of forecasting rare and bursty cyber events, and provides practical guidance for integrating predictive analytics into vulnerability intelligence workflows.
1 Introduction
The paper asks whether observable vulnerability sightings can be forecast for individual vulnerabilities, using statistical models and VLAI severity as a possible exogenous indicator.
- Vulnerability sightings include exploit proofs-of-concept, scanner detections, and blog references that provide evidence of real-world activity.Forecasting these observations may help defenders prioritize patches and assess risk.
- The study compares SARIMAX time-series models with Poisson regression for forecasting future sighting counts.
- VLAI severity scores are evaluated as exogenous variables that may indicate a vulnerability’s potential impact.
2 Related Work
Prior work has emphasized vulnerability assessment rather than forecasting, while this study focuses on predicting observable activity for individual CVEs from sparse event data.
- Vulnerability forecasting remains relatively unexplored compared with vulnerability assessment and risk scoring.
- VLAI predicts vulnerability severity from textual descriptions and is extended here as an explanatory variable for future sighting forecasts.VLAI was trained on over 600,000 real-world entries.
- Vuln4Cast forecasts vulnerability publication across large datasets, whereas this work models individual CVEs and their observable evolution.
- EPSS estimates future exploitation probability, while this study forecasts observable activity such as PoCs, scanner templates, and discussions over time.
- The paper adapts statistical and probabilistic models to sparse vulnerability sightings at the intersection of vulnerability intelligence and cyber situational awareness.
3 SARIMAX Time-Series Forecasting
SARIMAX struggles with sparse, short, bursty sighting series; log(x+1) transformation and VLAI severity yield only marginal improvements while instability remains.
- 3.1 Seasonal SARIMAX: Daily vulnerability sighting counts are mostly zeros with occasional small counts, complicating ARIMA-family modeling.
- 3.1 Seasonal SARIMAX: Seasonal SARIMAX produces unstable forecasts, including negative or near-zero values and extremely wide confidence intervals.The model over-smooths sparse spikes and is unreliable for series shorter than 30 days.
- 3.2 SARIMAX without seasonal components: The simplified model uses log(x+1)-transformed counts and daily VLAI severity as an exogenous covariate.Future predictions use average recent severity because the score changes little day to day.
- 3.2 SARIMAX without seasonal components: Log(x+1) transformation and VLAI severity produced marginally more sensible forecasts and slightly better peak-event capture.
- 3.2 SARIMAX without seasonal components: With only 10–15 training days, SARIMAX may overfit, extrapolate spikes into negative territory, and generate confidence intervals spanning many orders of magnitude.Reliable ARIMA estimation typically requires roughly 50–100 observations, which is impractical here.
4 Poisson Regression for Count Forecasting
Poisson regression better matches the discrete, non-negative nature of sightings and showed improved general trends over ARIMA-based methods, but sparse and variable data remain limiting.
- 4 Poisson Regression for Count Forecasting: Poisson regression models daily or weekly sightings as non-negative integer outcomes and can incorporate covariates such as severity or disclosure age.A negative binomial variant can address overdispersion when needed.
- 4 Poisson Regression for Count Forecasting: Initial Poisson forecasts were more plausibly non-negative, although under-dispersion and over-dispersion sometimes violated the basic Poisson assumption.
- 4 Poisson Regression for Count Forecasting: Poisson models handle discrete sightings but still struggle with data scarcity and variability.
- 4 Poisson Regression for Count Forecasting: Poisson regression improved general trends compared with ARIMA-based methods for highly sighted vulnerabilities, but the results are not precise predictions.
- 4.1 Issues and Limitations: Very short series of 10–30 days limit statistical models, while ARIMA or SARIMAX generally needs about 50 observations to constrain parameters.
- 4.1 Issues and Limitations: Sudden sighting spikes can dominate model fitting, causing ARIMA to treat them as trends and produce unrealistic subsequent behavior.
- 4.1 Issues and Limitations: Linear extrapolation can produce negative or implausible count forecasts, whereas Poisson and other non-negative models address this issue.
- 4.1 Issues and Limitations: Severity as an exogenous regressor provides limited variation immediately after disclosure, making its coefficient difficult to estimate reliably until many observations accumulate.
5 Exponential Decay Model for short-term forecasting
The exponential decay model estimates short-term future sightings by fitting a decaying curve, and is intended for vulnerabilities that have already passed their peak.
- The exponential decay function is introduced as a model for short-term forecasting of sightings.The supplied passage identifies the function and its fitting procedure but does not state a forecast horizon here.
- The model is appropriate for vulnerabilities already past their peak.For vulnerabilities that are still rising, the fit might look flat or strange.
- Curve fitting estimates the exponential-decay parameters from the observed series.The implementation fits exp_decay to t and y using initial parameter guesses.
6 Logistic Growth
The logistic growth model represents vulnerability sightings that rise rapidly after disclosure, then approach a plateau as attention fades.
- L is the maximum expected number of sightings, while t0 is the day of inflection.These parameters describe the plateau and midpoint of growth.
- The logistic model is relevant for burst-and-fade dynamics and newly published or trending vulnerabilities.It is described as fitting rapid increases in reports after disclosure, followed by a plateau and slow decay.
- The logistic function returns L divided by 1 plus an exponential term involving k and t0.The implementation evaluates the fitted logistic curve over time.
- Future values are evaluated for days after the last observation and constrained to be non-negative.The forecast uses a future time range beginning at the end of the daily series.
- Curve-fit bounds ensure sensible and non-negative parameters L, k, and t0.
7 Adaptive Logistic or Exponential Decay Forecast
The adaptive forecast selects between logistic growth and exponential decay according to the recent sightings trend, then fits and extends the selected model.
- The approach detects which forecasting strategy is best from the sightings repartition.
- Trend detection checks whether recent sightings are increasing or decreasing using a linear slope.
- The strategy uses logistic growth when the slope is positive and exponential decay otherwise.
- After model selection, curve fitting estimates the selected model’s parameters.
- The selected model is extended 10 days into the future to produce the forecast.
8 Experiences
Experiments across vulnerabilities show that SARIMAX remains poorly suited to sparse, bursty sightings, while Poisson, exponential-decay, and logistic models behave differently across data regimes.
- SARIMAX: Without logarithmic transformation, SARIMAX forecasted sighting counts could occasionally become negative.
- Poisson and exponential decay: With sufficient sightings, Poisson regression typically produced results comparable to exponential decay.
- SARIMAX: SARIMAX forecasts remained largely unsuitable, with very wide confidence intervals even after log transformation.The same issue appeared regardless of the distribution of sightings.
- Poisson regression: Poisson regression could overestimate final activity when forecasting after observations were truncated at 2025-11-01.The evaluation removed later observations to assess forecast accuracy.
- Model selection: A sudden drop in collected sightings was often not visible to Poisson regression, making exponential decay more appropriate in that case.The adaptive solution would have selected exponential decay based on recent trends.
- Logistic model: The logistic model appeared largely unaffected by recent sighting bursts for vulnerabilities monitored regularly over several months or years.This behavior was observed primarily with sightings sourced from Shadowserver.
9 Practical suggestions
The authors recommend matching forecasting methods to data quality, series length, and burst patterns rather than relying broadly on SARIMAX. They favor additional data and simpler or count-based approaches when short, sparse series create implausible forecasts.
- Gather more data per vulnerability by combining multiple sources or extending the observation window.
- Use rolling averages or exponential decay for very short forecasting windows, where they are expected to outperform SARIMAX.
- Check for missing days, duplicate reports, and extreme spikes before modeling, using measures such as clamping or logarithmic transformation.
- Switch to a count-based approach such as Poisson when forecasts become negative.
- Use bursts immediately after publication to help select a model and set the logistic approach’s initial growth rate and upper bound.
- Reserve seasonal SARIMAX for much longer series, such as activity remaining visible for months.
10 Future work
Future work proposes production-oriented, continuously updated forecasts that respond to new sightings and data anomalies. It also plans to distinguish sighting types and incorporate VLAI severity scores to investigate links with actual exploitation.
- A production module could update forecasts daily as new sightings arrive, adjusting predictions on the fly.
- Detecting unusual spikes and missing days could help select the most appropriate forecasting model.
- Future models will distinguish sighting types and incorporate VLAI severity scores to help establish a link with actual exploitation.