GeoGuard-PTI: a geo-temporal predictive threat intelligence framework with spatiotemporal attack forecasting and closed-loop adaptive defense.

Due to being reactive in nature, most network security frameworks focus on identifying attacks as they take place or reconstructing intrusion sequences once they have already occurred. This paper presents GeoGuard-PTI, an innovative Geo-Temporal Predictive Threat Intelligence framework designed to shift that paradigm by predicting pending cyber attacks before they arrive at monitored infrastructure. GeoGuard-PTI utilizes geo-tagged telemetry from a Real-Time Intrusion Detection Module, an Active Geo-Fencing Prevention Module, and a Forensic Analysis Module, processing it through a Spatiotemporal Graph Attention Network (ST-GAT) combined with a Temporal Diffusion Predictor (TDP). Attack propagation is modeled as epidemiological diffusion over a Dynamic Geographic Graph to produce probabilistic Threat Propagation Maps (TPMs) across five prediction horizons (15 min to 24 h). A Closed-Loop Adaptive Defense Cycle (CLADC) operationalizes these TPMs into IPS pre-arming signals while driving continuous online learning without offline retraining. Evaluated across five publicly available datasets-NSL-KDD, UNSW-NB15, CICIDS2017, TON-IoT, and BOT-IoT-augmented with synthetic geo-propagation traces, GeoGuard-PTI attains a mean 15-min prediction accuracy of 96.4%, a 2-h accuracy of 91.2%, and a false alarm rate below 1.9%. Operational trials show a ~34.1% reduction in successful intrusions and a ~67.9% drop in mean time-to-block compared with purely reactive baselines, with IPS pre-arming latency held under 3 ms throughout.