  In this paper we describe an algorithm for predicting the websites at risk in
a long range hacking activity, while jointly inferring the provenance and
evolution of vulnerabilities on websites over continuous time. Specifically, we
use hazard regression with a time-varying additive hazard function
parameterized in a generalized linear form. The activation coefficients on each
feature are continuous-time functions constrained with total variation penalty
inspired by hacking campaigns. We show that the optimal solution is a 0th order
spline with a finite number of adaptively chosen knots, and can be solved
efficiently. Experiments on real data show that our method significantly
outperforms classic methods while providing meaningful interpretability.
