Hidden Markov Model predicts adversary actions in cyber defense
Original title: A Hidden Markov Preference Model for Online Prediction of Adversary Actions
Hidden Markov model predicts next adversary actions with 0.8 nats per step gain on CAGE 2 benchmark.
Defenders need probability distributions over attacker actions before they occur. The model uses a latent regime state and feasibility-masked action trees to capture switching behaviors and state-dependent constraints. Estimation uses convex logistic fits and Baum-Welch reuses on unlabeled regimes, with derived bounds on information and loss.
- 0.8 nats per step worth of filtered latent state on CAGE 2
- Loss falls in three steps after controller switch
- Regime information via reach-weighted KL divergence
- Sequence-wise log-loss bound for switching paths
- Uniform fallback guarantee for predictions
From the original article
1 min read at arxiv.orgA defender anticipating an attacker needs a probability distribution over the attacker's next action from information available before that action occurs. Two structures complicate this: the attacker's behavioral regime persists and can switch within an episode, and each action combines an operation with state-dependent arguments whose feasible values change over time.
By Angel Daruna · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.