💻 computer science

Modeling Sparse and Bursty Vulnerability Sightings: Forecasting Under Data Constraints

This paper evaluates various time-series forecasting methods for sparse and bursty vulnerability sightings, finding that while transformer-derived severity scores offer limited improvement, count-based models like Poisson regression and simple exponential decay functions provide more stable and practical alternatives to traditional SARIMAX approaches for cyber threat intelligence.

Original authors: Cedric Bonhomme, Alexandre Dulaunoy

Published 2026-04-20

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Cedric Bonhomme, Alexandre Dulaunoy

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are a weather forecaster, but instead of predicting rain or sunshine, you are trying to predict cyberattacks. Specifically, you are trying to guess how much "buzz" a specific computer vulnerability (a digital hole in a wall) will get in the coming days. Will people start talking about it? Will hackers write code to exploit it? Will security scanners start flagging it?

This paper is about the authors' journey to build a crystal ball for these "vulnerability sightings." They tried several different tools to make these predictions, but they ran into a major problem: the data is messy, rare, and unpredictable.

Here is a breakdown of their adventure using simple analogies:

The Problem: The "Firework" vs. The "Drizzle"

Most weather models work well for things that happen regularly, like rain (a steady drizzle). But cyber vulnerabilities are more like fireworks.

Sparse: For weeks, nothing happens (zero sightings).
Bursty: Then, suddenly, a huge explosion of activity happens (someone releases a "Proof of Concept" hack), and then it dies down just as quickly.
Short: We often only have a few days of data to work with before we need to make a prediction.

The authors wanted to use this data to tell security teams: "Hey, this specific hole is about to get a lot of attention. Patch it now!"

The First Attempt: The "Rigid Ruler" (SARIMAX)

The authors first tried using a classic statistical tool called SARIMAX. Think of this like trying to measure the height of a jumping bean using a rigid ruler.

How it worked: They fed the model daily counts of sightings and even added a "severity score" (how dangerous the bug is) to help the model guess.
What went wrong: Because the data is so "bumpy" (lots of zeros and sudden spikes), the rigid ruler broke.
- It tried to draw a straight line through a jagged mountain range.
- It sometimes predicted negative numbers (which is impossible—you can't have -5 people talking about a bug).
- Its "confidence intervals" (the range where it thinks the answer lies) became so wide they were useless (e.g., "The number of sightings will be between -5 and 1,000,000").
The Lesson: You can't use a tool designed for smooth, steady trends on data that is chaotic and rare.

The Second Attempt: The "Counting Jar" (Poisson Regression)

Realizing the rigid ruler didn't work, they switched to Poisson Regression. Imagine this as a jar designed specifically for counting marbles.

Why it's better: It understands that you can't have half a marble (or half a sighting). It forces the prediction to be a whole number and never negative.
The Result: It was much more stable. It gave reasonable guesses for the number of sightings, especially when they grouped the data by week instead of day.
The Catch: It still struggled when there was very little data (like trying to guess the future of a jar that only has 3 marbles in it).

The Third Attempt: The "Life Cycle" Models (Exponential & Logistic)

The authors realized that vulnerability sightings often follow a specific story arc, like a movie or a viral trend. They tried two new models that fit these stories:

Exponential Decay (The "Fading Echo"):
- Analogy: Imagine shouting in a canyon. The echo is loud at first, then gets quieter and quieter until it disappears.
- Use case: This works best for old vulnerabilities that had a big spike of attention and are now slowly dying down.
Logistic Growth (The "S-Curve"):
- Analogy: Think of a viral video. It starts slow, then explodes in popularity (the steep part of the curve), hits a peak, and then levels off as everyone has seen it.
- Use case: This works best for brand-new vulnerabilities that are just starting to get attention.

The "Smart Switch" Strategy

The biggest takeaway from the paper is that one size does not fit all.

If a bug is brand new and rising, use the Logistic (S-Curve) model.
If a bug is old and fading, use the Exponential Decay model.
If you try to use the "Rigid Ruler" (SARIMAX) on these, it will fail.

The authors suggest building a "Smart Switch" that looks at the recent trend (is it going up or down?) and automatically picks the right model to make the prediction.

The Secret Weapon: The "Severity Score"

Throughout the paper, they mention a tool called VLAI. Think of this as a danger rating system that reads the description of the bug and gives it a score (like a movie rating: G, PG, R, or NC-17).

They tried to use this score to help the models predict the future.
Result: It helped a little bit, but since the "danger rating" of a bug usually doesn't change day-to-day, it wasn't a magic bullet. It's a helpful hint, but not the whole story.

The Bottom Line

Predicting cyberattacks is hard because the data is messy.

Don't use complex, smooth-line models for jagged, rare data.
Do use models that understand "counting" (like marbles in a jar).
Do pick the model based on the "story" of the bug (is it rising or fading?).
Do gather more data over time to make the predictions sharper.

The authors conclude that while we can't predict the future perfectly, using the right "life cycle" models helps security teams get a heads-up on which vulnerabilities are about to become the next big headline.

1. Problem Statement

The paper addresses the challenge of forecasting vulnerability sightings—observable events indicating public attention or exploitation potential (e.g., Proof-of-Concept code, scanner detections, Fediverse discussions).

Data Characteristics: The data is inherently sparse (often dominated by zeros), bursty (sudden spikes in activity), and available in short time horizons (often only 10–30 days of data per vulnerability).
The Gap: Traditional cyber threat intelligence focuses on risk assessment (e.g., CVSS scores) rather than predicting the temporal evolution of vulnerability activity. Existing models often fail to handle the discrete, non-negative, and highly volatile nature of sighting counts, leading to unreliable forecasts.
Objective: To evaluate the feasibility of forecasting future sighting counts for individual vulnerabilities using statistical and probabilistic models, incorporating severity scores as explanatory factors.

2. Methodology

The authors evaluated several modeling approaches, integrating their previous work, VLAI (a transformer-based model that predicts vulnerability severity from text descriptions), as an exogenous variable.

A. Data Preparation

Input: Daily counts of sightings for specific CVEs aggregated from multiple sources (exploit databases, social platforms).
Exogenous Variable: The VLAI severity score, used to test if higher-severity vulnerabilities correlate with higher sighting volumes.
Preprocessing: Application of log(x + 1) transformations to handle zero counts and stabilize variance.

B. Modeling Approaches Tested

SARIMAX (Seasonal AutoRegressive Integrated Moving Average with Exogenous variables):
- Tested with and without seasonal components.
- Used VLAI scores as an exogenous regressor.
- Hypothesis: To capture trends and seasonality in sighting activity.
Poisson Regression:
- A count-based model designed for non-negative integer data.
- Hypothesis: Better suited for the discrete, event-driven nature of sightings than continuous time-series models.
Parametric Decay and Growth Models:
- Exponential Decay: $y(t) = a \cdot e^{-bt} + c$ . Used for vulnerabilities past their peak activity.
- Logistic Growth: $y(t) = \frac{L}{1 + e^{-k(t-t_0)}}$ . Used for "burst-and-fade" dynamics (rapid rise post-disclosure, plateau, then decay).
- Adaptive Strategy: A heuristic approach to detect the current trend (increasing vs. decreasing slope) and select the appropriate model (Logistic vs. Exponential) dynamically.

3. Key Contributions

Integration of Semantic Severity: The study pioneers the use of NLP-derived severity scores (VLAI) as an explanatory variable in time-series forecasting for vulnerability intelligence.
Empirical Evaluation of Sparse Data: It provides a rigorous comparison of standard time-series models (SARIMAX) against count-based and parametric models in the specific context of sparse, bursty cybersecurity data.
Operational Framework: Proposes a practical, adaptive workflow for operational settings where data is limited, moving away from complex models toward simpler, more robust heuristics.

4. Results and Findings

SARIMAX Performance

Verdict: Unreliable for short-term, sparse vulnerability data.
Issues:
- Produced nonsensical forecasts, including negative values and near-zero trends that did not reflect reality.
- Generated extremely wide confidence intervals, indicating high uncertainty.
- Required significantly more data points (50–100+) than typically available for individual CVEs to stabilize parameters.
- Over-smoothed spikes and failed to capture the bursty nature of the data.

Poisson Regression Performance

Verdict: More stable and interpretable than SARIMAX for short horizons.
Advantages: Naturally enforces non-negative forecasts ( $\ge 0$ ).
Limitations: Still struggles with extreme over-dispersion or under-dispersion and requires sufficient data to avoid overfitting. Best suited for the first few weeks after disclosure.

Parametric Models (Exponential & Logistic)

Verdict: Highly effective for specific phases of the vulnerability lifecycle.
Exponential Decay: Accurately models the "tail" of a vulnerability's lifecycle once activity peaks.
Logistic Growth: Effectively captures the rapid rise and plateau of new, trending vulnerabilities.
Adaptive Selection: The study demonstrates that a hybrid approach—detecting the trend slope to switch between Logistic (rising) and Exponential (falling) models—yields the most accurate short-term forecasts.

Case Studies

CVE-2025-61932 & CVE-2025-59287: SARIMAX failed with wide confidence intervals. Poisson and Exponential Decay provided plausible results.
CVE-2022-26134 (Long-term): Logistic models remained robust for vulnerabilities with long observation histories, whereas decay models were inadequate.

5. Significance and Practical Implications

Operational Reality: The paper highlights that complex statistical models (like SARIMAX) are often impractical for individual vulnerability forecasting due to data scarcity. Simpler, domain-specific models (Logistic/Exponential) are superior for operational decision-making.
Prioritization Aid: Accurate short-term forecasting allows defenders to prioritize patching based on real-time activity trends rather than just static severity scores.
Methodological Shift: Suggests a shift from "one-size-fits-all" time-series forecasting to adaptive modeling that respects the discrete, bursty nature of cyber events.
Future Directions: The authors propose real-time updating of forecasts, differentiation of sighting types (e.g., "Confirmed" vs. "Exploited"), and further integration of VLAI severity scores to link semantic risk with temporal activity.

Conclusion

The study concludes that while forecasting sparse vulnerability sightings is inherently difficult, count-based models (Poisson) and parametric growth/decay models offer a viable path forward. The key to success lies in acknowledging data constraints, avoiding over-reliance on complex seasonal models for short series, and utilizing adaptive strategies that align the model choice with the current lifecycle stage of the vulnerability.