Developing Composite Metrics for Cybersecurity Incident Impact and Response using Feature Engineering and Predictive Modeling

The increasing complexity and frequency of cyberattacks have driven the need for intelligent systems capable of assessing the impact of incidents and optimizing response strategies. This study presents a data-driven framework that employs machine learning to predict the severity of cybersecurity incidents using composite metrics derived through domain-specific feature engineering. Five new quantitative indicators are introduced: Impact Severity Index (ISI), Resolution Efficiency Score (RES), Attack Sophistication Score (ASS), Defense Match Score (DMS), and Incident Cost per User (ICU). These metrics are computed from raw incident attributes, including financial loss, user exposure, attack source, and resolution time. The publicly available Kaggle Global Cybersecurity Threats dataset (2015–2024) serves as the experimental base. Incidents are classified into "high" or "low" severity categories using a median-based threshold on ICU. Supervised machine learning models Random Forest, Logistic Regression, and Naïve Bayes are trained on the enriched dataset. While Random Forest and Logistic Regression achieved near-perfect scores (accuracy >99%), performance evaluation reveals that Naïve Bayes offers more realistic results with 86% accuracy and a 0.997 AUC. The integration of engineered metrics significantly improves interpretability and enables generalizable incident triage. This research contributes a replicable and extensible pipeline for automated cyber incident prioritization in operational environments.