Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
PARD-SSM is introduced as a probabilistic framework for cyber-attack detection, modeling network telemetry as a Regime-Dependent Switching Linear Dynamical System with four hidden regimes corresponding to attack phases. A structured variational approximation reduces inference complexity, enabling real-time detection, while an online EM algorithm adapts model parameters and KL-divergence gating suppresses false positives. Experiments on CICIDS2017 and UNSW-NB15 datasets demonstrate that PARD-SSM achieves high F1 scores (98.2% and 97.1%) with low latency (1.2 ms per flow) and provides predictive alerts before attack onset.
Achieve near-perfect cyberattack detection with millisecond latency and 8-minute early warnings by modeling attack campaigns as regime-dependent switching dynamics.
Modern adversarial campaigns unfold as sequences of behavioural phases - Reconnaissance, Lateral Movement, Intrusion, and Exfiltration - each often indistinguishable from legitimate traffic when viewed in isolation. Existing intrusion detection systems (IDS) fail to capture this structure: signature-based methods cannot detect zero-day attacks, deep-learning models provide opaque anomaly scores without stage attribution, and standard Kalman Filters cannot model non-stationary multi-modal dynamics. We present PARD-SSM, a probabilistic framework that models network telemetry as a Regime-Dependent Switching Linear Dynamical System with K = 4 hidden regimes. A structured variational approximation reduces inference complexity from exponential to O(TK^2), enabling real-time detection on standard CPU hardware. An online EM algorithm adapts model parameters, while KL-divergence gating suppresses false positives. Evaluated on CICIDS2017 and UNSW-NB15, PARD-SSM achieves F1 scores of 98.2% and 97.1%, with latency less than 1.2 ms per flow. The model also produces predictive alerts approximately 8 minutes before attack onset, a capability absent in prior systems.