Method for early detection and prediction of cybersecurity incidents in information and communication systems based on machine learning

Abstract

In modern conditions of the rapid growth of both the number and complexity of cyber threats, the task of early detection and prediction of incidents becomes crucial for ensuring the cyber resilience of information and communication systems (ICS). An analysis of scientific approaches, open datasets, and current machine learning methods has revealed several systemic limitations, including the absence of a temporal component, imbalance of real-world data, limited generalization capability of models, and low effectiveness in real-time operation. The article presents an integrated method for early detection and prediction of cybersecurity incidents, which combines graph-based modeling of ICS structure, construction of a set of behavioral events, anomaly detection using machine learning algorithms, and attack development forecasting employing temporal neural models such as LSTM. The method enables the identification of critical nodes, assessment of incident propagation probability, and formation of a set of high-risk events for proactive response. The proposed approach provides a foundation for enhancing the cyber resilience of ICS and can be applied within monitoring and information security support systems. Future research will focus on experimental validation of the method using realistic streaming data, as well as evaluating its scalability and effectiveness in dynamic environments.