Predicting Adversarial Cyber-Intrusion Stages Using Autoregressive Neural Networks

Abstract

Current cybersecurity approaches are response-driven and ineffective, as they do not account for dynamic adversarial movement. Using empirical evidence from observations of two Red Team-Blue Team cybersecurity training exercises held at Idaho National Laboratory and the Michigan Cyber Range, we used four different models to make temporal predictions of how adversaries progress through cyberattacks: nonlinear autoregressive (NAR) neural network, NAR neural network with exogenous input (NARX), NAR neural network for multi-steps-ahead prediction, and autoregressive integrated moving average (ARIMA). The obtained results demonstrate that the trained models can capture different variations in adversarial movement across the two datasets with reliable accuracy.