<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: building-incident-prediction-models
description: >-
  Build and deploy machine learning models that predict incident
  likelihood, severity, and blast radius using historical incident data,
  environmental signals, and threat intelligence indicators.
domain: cybersecurity
subdomain: incident-management
tags:
  - prediction
  - machine-learning
  - forecasting
  - risk-scoring
  - anomaly-detection
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["TA0043", "TA0009"]
  nist-csf: ["ID.RA-1", "ID.RA-3", "DE.AE-1"]
  frameworks: ["NIST AI RMF", "FAIR", "VERIS"]
---

# Building Incident Prediction Models

## Overview

Incident prediction models use historical incident data, environmental
telemetry, and threat intelligence to forecast incident likelihood and
severity. Models support proactive risk management by identifying
high-risk periods, vulnerable assets, and emerging threat patterns
before incidents occur.

## Prerequisites

| Requirement | Purpose |
|---|---|
| Historical incident dataset | Minimum 12 months of classified incidents |
| Feature engineering pipeline | Environmental and threat indicators |
| ML framework | scikit-learn, XGBoost, or similar |
| Model evaluation framework | Metrics, validation, drift detection |

## Key Concepts

### Feature Categories

| Category | Features | Source |
|----------|---------|--------|
| Historical | Incident frequency, severity, MTTR | ITSM/SIEM |
| Vulnerability | Patch age, CVSS scores, exploit availability | Vulnerability scanner |
| Threat Intel | Active campaigns, industry targeting | ISAC/STIX feeds |
| Environmental | Change volume, deployment frequency | CI/CD, change mgmt |
| Temporal | Day of week, month, holiday proximity | Calendar |
| Asset | Criticality, exposure, age, complexity | CMDB |

### Model Architecture

```
FEATURE PIPELINE
│
├── Historical Features ──┐
├── Vulnerability Data ───┤
├── Threat Intelligence ──┼──▶ Feature Store ──▶ Model
├── Environmental Data ───┤                      │
├── Temporal Features ────┤                      ▼
└── Asset Attributes ─────┘               ┌─────────────┐
                                          │ Predictions  │
                                          ├─────────────┤
                                          │ • Likelihood │
                                          │ • Severity   │
                                          │ • Blast radius│
                                          │ • Time window│
                                          └─────────────┘
```

### Model Types

| Model | Purpose | Algorithm |
|-------|---------|-----------|
| Incident likelihood | Probability of incident in next 7 days | Gradient Boosting |
| Severity prediction | Expected severity of predicted incident | Random Forest |
| Blast radius | Number of affected systems | Regression |
| Anomaly detection | Unusual pattern identification | Isolation Forest |

## Workflow

1. Collect and clean historical incident data
2. Engineer features from multiple data sources
3. Split data for training and validation
4. Train and evaluate multiple model candidates
5. Select best model based on precision/recall tradeoffs
6. Deploy model with monitoring and drift detection
7. Generate periodic risk forecasts for stakeholders

```bash
# Train prediction model on historical data
node agent.js train --dataset incidents.csv --model-type likelihood

# Generate risk forecast
node agent.js forecast --horizon-days 7

# Evaluate model performance
node agent.js evaluate --model-id model-2026-01
```

## Verification

- [ ] Model precision > 0.7 and recall > 0.6 on validation set
- [ ] Feature importance analysis completed and documented
- [ ] Drift detection monitoring active
- [ ] Forecasts generated and distributed weekly
- [ ] Model retrained quarterly with fresh data

## References

- NIST SP 800-61 Rev. 2 — Computer Security Incident Handling Guide
- MITRE ATT&CK Framework — https://attack.mitre.org/
- NIST AI RMF
