PARD-SSM: Probabilistic Cyber-Attack Regime Detection via Variational Switching State-Space Models
2026-04-02 • Cryptography and Security
Cryptography and Security
AI summaryⓘ
The authors created a new system called PARD-SSM to detect cyberattacks by recognizing different attack stages in network data, which are hard to spot individually. Their method models the network as switching between four hidden states related to attack phases, making detection faster and more understandable than previous tools. Tested on common datasets, their system achieved high accuracy and could even give early warnings about attacks several minutes beforehand. This approach improves real-time detection while reducing false alarms.
Intrusion Detection System (IDS)Adversarial Campaign PhasesRegime-Dependent Switching Linear Dynamical SystemVariational ApproximationOnline Expectation-MaximizationKL-divergenceCICIDS2017 DatasetUNSW-NB15 DatasetZero-day AttacksNetwork Telemetry
Authors
Prakul Sunil Hiremath, PeerAhammad M Bagawan, Sahil Bhekane
Abstract
Modern adversarial campaigns unfold as sequences of behavioural phases - Reconnaissance, Lateral Movement, Intrusion, and Exfiltration - each often indistinguishable from legitimate traffic when viewed in isolation. Existing intrusion detection systems (IDS) fail to capture this structure: signature-based methods cannot detect zero-day attacks, deep-learning models provide opaque anomaly scores without stage attribution, and standard Kalman Filters cannot model non-stationary multi-modal dynamics. We present PARD-SSM, a probabilistic framework that models network telemetry as a Regime-Dependent Switching Linear Dynamical System with K = 4 hidden regimes. A structured variational approximation reduces inference complexity from exponential to O(TK^2), enabling real-time detection on standard CPU hardware. An online EM algorithm adapts model parameters, while KL-divergence gating suppresses false positives. Evaluated on CICIDS2017 and UNSW-NB15, PARD-SSM achieves F1 scores of 98.2% and 97.1%, with latency less than 1.2 ms per flow. The model also produces predictive alerts approximately 8 minutes before attack onset, a capability absent in prior systems.