By modeling attackers as switching between behavioral regimes and constraining predictions to feasible actions, defenders can predict the next attack step 3x faster than recurrent baselines after detecting a strategy change.
This paper develops a hidden Markov model to predict an attacker's next action in cybersecurity scenarios. The model tracks the attacker's behavioral regime (which can switch during an attack) and handles actions with state-dependent arguments that may not always be available.