Time Series Approach for Analysis and Prediction of Malware Trends Based on Open Source Intelligence

Abstrak

The growing threat of malware requires monitoring approaches that provide a continuous, measurable overview of threat trends. This study proposes an open-source intelligence-based malware trend monitoring system using time series forecasting and anomaly signaling. Data are obtained from the MalwareBazaar repository and processed into a daily malware activity time series, with contextual aggregation to identify dominant malware families. The AutoRegressive Integrated Moving Average (ARIMA) model is applied for short-horizon prediction, and statistical anomaly detection is implemented using Z-scores to flag activity deviations. The system is delivered as an interactive dashboard that visualizes daily malware trends, dominant malware families, forecasting outputs, and anomaly indicators. Experimental results show that ARIMA(2,0,0) provides measurable improvement over a naive persistence baseline, reducing MAE from 102.75 to 92.67 and RMSE from 125.13 to 109.73, while improving sMAPE from 26.74% to 24.48% on the evaluation window. The novelty of this work lies in integrating an OSINT malware repository signal, benchmarked statistical forecasting, quantitative evaluation, and anomaly signaling into a single monitoring dashboard. Practically, the system can support SOC analysts by providing early-warning cues for monitoring prioritization and support digital forensic practitioners by strengthening digital forensic readiness through earlier visibility emerging malware activity dynamics and dominant artifact categories.