Temporal Prediction

Overview#

A counter-terrorism analyst reviewing a series of incidents across three jurisdictions notices that the attacks follow a non-random rhythm: clustered bursts separated by recovery periods of roughly constant length. Without a model that captures the timing structure of those events, the analyst can only count incidents after the fact. Temporal prediction turns that observation into an operational asset by learning the statistical process governing when events occur and projecting forward in time, giving command teams a calibrated estimate of when the next incident is most likely to happen and how confident the model is in that estimate.

The Temporal Prediction module applies autoregressive time-series models and point-process techniques to sequences of timestamped operational events, entity activity records, and incident histories. It produces interval forecasts with upper and lower confidence bounds, probability scores for activity within configurable look-ahead windows, and ranked lists of entities or locations ordered by predicted near-term activity level. Forecasts are computed on demand and refreshed automatically on a configurable schedule, feeding dashboards, watchlist rankings, and alert rules directly.

Key Features#

• ARIMA and SARIMAX Forecasting: The module fits AutoRegressive Integrated Moving Average models to event count series, selecting order parameters automatically via the Akaike Information Criterion. Where seasonal periodicity is detected, the Seasonal ARIMA extension is applied. Forecasts include a point estimate and a configurable confidence interval, typically 80 per cent and 95 per cent, so operators can see not just the predicted value but the range of plausible outcomes.

• Hawkes Process Burst Detection: For event sequences dominated by self-exciting clusters, where one event raises the likelihood of further events in the same thread, the Hawkes conditional intensity function supplements the ARIMA forecast with a burst probability score. This is especially valuable for series representing coordinated activity, where the gap-to-next-event distribution is heavily right-skewed.

• Configurable Look-Ahead Windows: Probability scores are computed for analyst-defined windows: 7, 14, and 30 days by default, with any horizon up to 90 days configurable per query. This allows strategic analysts and operational planners to use the same underlying model for different time-horizon decisions without retraining.

• Confidence-Scored Outputs: Every forecast is accompanied by a model fit quality indicator derived from residual diagnostics and out-of-sample accuracy on the most recent 20 per cent of the entity's event history. Analysts see whether a forecast rests on a well-fitting model or on a series too short or irregular to produce reliable estimates.

• Automated Scheduled Refresh: Forecasts for all active monitored entities are recomputed on a configurable schedule, with hourly refresh for high-tempo watchlist entries and six-hourly refresh as the default. Distributed locking prevents duplicate computation during overlapping refresh cycles.

• On-Demand Recomputation: Analysts can trigger an immediate recompute for any entity or location series, optionally overriding the default model order, seasonal period, and confidence level. Results are persisted and immediately visible in the entity profile and associated dashboards.

• Outcome Feedback Loop: When a predicted event window closes, the actual count of events in that window is logged against the forecast. These outcome records feed a rolling calibration report, allowing analysts and platform administrators to track model accuracy over time and adjust refresh schedules or model parameters accordingly.

• Organisation-Scoped Isolation: All event history queries, trained model parameters, forecast records, and outcome logs are strictly scoped to the requesting organisation. It is structurally impossible for one organisation's forecast data to be visible to or influenced by another organisation's event series.

Use Cases#

• Incident Timing Prediction: Forecast when a geographic area or threat network is next likely to generate an incident, enabling pre-emptive resource deployment and surveillance scheduling rather than reactive response.
• Watchlist Temporal Ranking: Sort watchlist entries by predicted near-term activity probability so that analysts with limited time review the entities most likely to generate actionable intelligence in the coming week first.
• Patrol and Surveillance Scheduling: Use 30-day intensity profiles to identify predicted activity peaks for high-value locations and schedule observation windows around those peaks, reducing wasted coverage during predicted quiet periods.
• Strategic Threat Planning: Apply 90-day SARIMAX forecasts with seasonal components to support quarterly resource allocation decisions, staffing plans, and budget submissions backed by quantitative trend evidence.
• Early Warning Trigger: Configure alert rules that fire when a predicted probability score for a monitored entity or location crosses a defined threshold, giving operations staff advance notice before a predicted activity window opens.
• Model Accuracy Auditing: Review rolling calibration reports to verify that forecasts are well-calibrated across entity categories and to identify series where additional collection would improve prediction quality.

Integration#

Temporal Prediction is integrated across the entity intelligence, alert management, and command dashboard layers of the platform. Forecast scores appear as forward-looking indicators on entity profiles, complementing the backward-looking recency scores provided by the temporal decay scoring component. Predicted activity windows can be referenced in alert rule conditions and displayed as timeline overlays on geospatial command views. The GraphQL API exposes forecast queries and on-demand recomputation mutations with full organisation-scoped access control, allowing external command systems and partner agency portals to retrieve predictions programmatically without duplicating analytical infrastructure.

Open Standards#

• ARIMA / SARIMAX (Box-Jenkins methodology): The AutoRegressive Integrated Moving Average family of time-series models, standardised through the Box-Jenkins methodology, provides the core forecasting engine for event count series with trend and seasonal components.
• ISO 8601 / RFC 3339: All forecast valid-from and valid-to timestamps, look-ahead window boundaries, and outcome log entries are stored and transmitted in ISO 8601 UTC format to ensure unambiguous time-zone handling across multi-jurisdiction deployments.
• GraphQL (June 2018 specification): Forecast queries, on-demand recomputation mutations, and outcome feedback mutations are all exposed through a typed GraphQL API, enabling interoperable access from any compliant client.
• GeoJSON (RFC 7946): When temporal predictions are associated with geographic zones or patrol beats, the associated area geometry is represented as GeoJSON Feature objects for interoperability with GIS and mapping systems.
• OASIS STIX 2.1: Predicted threat activity windows for known threat actors can be serialised as STIX 2.1 Course of Action and Indicator objects for exchange with partner agencies and threat intelligence platforms.
• NIST SP 800-53 Rev 5 (AU family): All forecast computations, parameter overrides, and outcome log writes are recorded with actor identity, timestamp, and full request context to satisfy the Audit and Accountability control family requirements.
• IEEE 754 floating-point standard: Confidence bounds, probability scores, and model fit quality indicators are computed and stored as IEEE 754 double-precision values, ensuring reproducible numerical results across deployments and platforms.

Availability#

• Enterprise Plan: Included
• Professional Plan: Available with the Advanced Analytics add-on; scheduled refresh limited to six-hourly cadence

Last Reviewed: 2026-05-26