# AI-Based RPA's Work Automation Operation to Respond to
## 3 Methodology
### System Implementation
#### 3.3.3 Cybersecurity Threat Status and Prediction Model Development  
In this study, considering the time-series characteristics of cyber threat logs and the advantages outlined in Table 2, we utilized the widely known and highly effective LSTM (Long Short-Term Memory) model [18] to predict cyberattack patterns. A process was developed to leverage time-series analysis on the data extracted from the database. Through this, the security response system was improved by predicting potential future attack patterns based on historical data. Figure 6: Manager who supervises and verifies the system. Figure 7: Manager who supervises and verifies the system. First, as shown in Figure 8, the cyberattack log data were extracted from the database and utilized for analysis. SQLite3 and pandas were used to load the attack log data from the SQLite database. The data retrieved from the database were refined based on the date field and analyzed by grouping it according to attack patterns. Next, as shown in Figure 9, each attack pattern was grouped in 6-month intervals and visualized. Through this process, the temporal trends of each pattern were identified, and based on these trends, future attack patterns were predicted. The visualized results are automatically saved, and when sent to relevant organizations via email, the visualized data are included as an attachment. As shown in Figure 10, for research purposes, the data for each attack pattern were grouped into 6-month intervals, and the average number of attacks was predicted. MinorScaler was used to normalize the data, and then the LSTM model was trained to predict attack patterns for the next five years. The prediction model was constructed using a Sequential model, with a dropout layer added to prevent overfitting. The predicted results were also automatically saved to a local directory. Considering the different systems and data environments of each institution, functionality was included to allow for performance evaluation of the model for tuning purposes. To provide metrics for assessing the reliability of the data, as shown in Figure 11, the performance evaluation results were also saved and disseminated to relevant organizations. \begin{table}
\begin{tabular}{l l} \hline \hline
**Feature** & **Description** \\ \hline Handling Long-term Dependency & Remembers past information in time-series data, reflecting the characteristic that past attacks can influence future attacks. \\ \hline Controlling Information Flow & Controls what information to remember or forget through input, forget, and output gates, capturing significant patterns. \\ \hline Non-linear Relationship Modeling & Effectively models complex patterns and relationships by handling non-linearity. \\ \hline Robustness to Data Scarcity & Capability of learning even with small or noisy datasets, making it advantageous in diverse situations. \\ \hline Processing Versatile Input & Able to integrate various inputs such as log data, network traffic, and user behavior data for learning. \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Advantages of LSTM. Figure 8: Extracting cyber attack log data from the database. Figure 9: Visualizing cyber attack patterns. Afterward, using UiPath's automation functionality, the results are disseminated, allowing each institution to respond promptly based on the provided information. The results predicted using the database employed in this study are as follows. We conducted performance evaluations optimized for the system and database used in the research, improving the model architecture by adjusting data preprocessing, layer unit numbers, and other parameters. Additionally, we tuned the model by adjusting the learning rate and epochs [19]. As shown in Figure 12, the four most frequent attack patterns from 2014 to 2 October 2024 (APT, Phishing, DDoS, Ransomware) were graphed, illustrating their trends (the sharp drop-off at both ends of the graph is due to the research scope limiting the time frame used for training).