Systems and methods for making security-related predictions

A system for making security-related predictions, the system comprising:

• a gathering module, stored in memory, that gathers information that comprises both a plurality of signatures of a plurality of events that occurred on a plurality of computing systems during a plurality of consecutive time slots and a plurality of incident labels about a plurality of incidents on the plurality of computing systems during the plurality of consecutive time slots, wherein each incident within the plurality of incidents comprises at least one event within the plurality of events;
• a training module, stored in memory, that uses the gathered information to train a machine learning model to:
• create a latent feature that represents security postures of the plurality of computing systems that correlate with signatures within the plurality of signatures and incident labels within the plurality of incident labels;
• and
• for each time slot in the plurality of consecutive time slots, model a progression from a security posture at the time slot to a security posture at a subsequent time slot within the plurality of consecutive time slots;
• a prediction module, stored in memory, that predicts, by the machine learning model, at least one of an incident label about an incident and a signature of an event on a computing system during a time slot, wherein the computing system does not comprise at least one of an application capable of generating the signature and information about events occurring during the time slot due to the time slot having not yet occurred;
• a performing module, stored in memory, that performs an action in response to predicting at least one of the incident label about the incident and the signature of the event on the computing system during the time slot, wherein the machine learning model comprises a coupled Gaussian dynamic system comprising:
• a first Gaussian process that creates the latent feature that represents the security postures;
• and
• a second Gaussian process that models, for each time slot in the plurality of consecutive time slots, the progression from the security posture at the time slot to the security posture at the subsequent time slot;
• and
• at least one physical processor configured to execute the gathering module, the training module, the prediction module, and the performing module.

A non-transitory computer-readable medium comprising one or more computer-readable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

• gather information that comprises both a plurality of signatures of a plurality of events that occurred on a plurality of computing systems during a plurality of consecutive time slots and a plurality of incident labels about a plurality of incidents on the plurality of computing systems during the plurality of consecutive time slots, wherein each incident within the plurality of incidents comprises at least one event within the plurality of events;
• use the gathered information to train a machine learning model to:
• create a latent feature that represents security postures of the plurality of computing systems that correlate with signatures within the plurality of signatures and incident labels within the plurality of incident labels;
• and
• for each time slot in the plurality of consecutive time slots, model a progression from a security posture at the time slot to a security posture at a subsequent time slot within the plurality of consecutive time slots;
• predict, by the machine learning model, at least one of an incident label about an incident and a signature of an event on a computing system during a time slot, wherein the computing system does not comprise at least one of an application capable of generating the signature and information about events occurring during the time slot due to the time slot having not yet occurred;
• and
• perform an action in response to predicting at least one of the incident label about the incident and the signature of the event on the computing system during the time slot, wherein the machine learning model comprises a coupled Gaussian dynamic system comprising:
• a first Gaussian process that creates the latent feature that represents the security postures;
• and
• a second Gaussian process that models, for each time slot in the plurality of consecutive time slots, the progression from the security posture at the time slot to the security posture at the subsequent time slot.