Modelling Spatio-Temporal Progression of Cyberattacks in Data Networks

University data networks comprise numerous devices connected to the network on an ad-hoc basis. Measuring the risk of cyberattacks and identifying the most recent modus-operandi of cyber criminals on such networks can be difficult due to the wide range of services and applications running within the network, the multiple vulnerabilities associated with each application, the severity associated with each vulnerability, and the ever-changing attack vector of cyber criminals. We propose a spatiotemporal modelling framework to represent these features, enabling real-time network enumeration and traffic analysis, to produce quantified measures of risk at specific points in time. We validate the approach using data from a University network, with a data collection consisting of 460 K instances representing threats measured over a 144 hour period. Our analysis can be generalise to a variety of other contexts.