Hidden markov model improves prediction of attacker behavior online
A Hidden Markov Preference Model for Online Prediction of Adversary Actions
Machine Learning
Summary
Predicting what a cyber attacker will do next is tricky because attackers can change their behavior and choose actions based on what’s possible at that moment. The authors created a model that guesses the attacker’s current behavior type and predicts the next action by considering feasible options. Their method updates its guesses quickly when the attacker switches tactics and outperforms a standard model in tests. This helps defenders better prepare for likely attacks in real time.
What this means in practice
- •For cybersecurity teams: Predict attacker moves online to improve defense strategy adjustments after attack pattern changes.
- •For network security operators: Improve anomaly detection systems by modeling attacker behavior regimes that shift dynamically during attacks.
Authors
Angel Daruna, Michael Cogswell, Tixiao Shan, Yi Yao, Han-Pang Chiu, Ajay Divakaran
Abstract
A defender anticipating an attacker needs a probability distribution over the attacker's next action from information available before that action occurs. Two structures complicate this: the attacker's behavioral regime persists and can switch within an episode, and each action combines an operation with state-dependent arguments whose feasible values change over time. We capture both with a hidden Markov model whose latent state is the active regime and whose regime-conditioned action law is defined on a feasibility-masked tree of executable actions. The same likelihood forms the next-action distribution and updates the regime belief once the action is seen, and a partially observed prefix contributes its resolved local factors. Estimation separates into convex logistic fits that Baum-Welch reuses when regimes are unlabeled. We derive a reach-weighted nodewise KL expression for regime information, a sequence-wise log-loss bound for switching regime paths, and a uniform fallback guarantee. On the CAGE 2 cyber defense benchmark the filtered latent state is worth 0.8 nats per step, and after a controller switch the loss begins to fall in three steps against ten for a recurrent baseline.