Early Prediction of Tactical Transitions in Cyber Attack Processes Through Network Flows

Abstract

 Cyber attacks are becoming increasingly complex, comprehensive, and dynamic. This makes it crucial not only to detect malicious activity but also to predict how an attack may progress in its early stages. This study predicts MITRE ATT&CK tactical transitions using Zeek-derived network flows from the UWF-ZeekData24 dataset (Elam et al., 2025). The core objective is to examine whether the next tactic can be inferred from time-ordered network behavior by treating attack activity as a temporal process. The analysis uses 1,916,757 raw flow records, removes duplicate records from the main analytical pipeline, aggregates flows into fixed-duration windows, and constructs a leakage-controlled next_tactic target. Static machine learning models, temporal deep learning architectures, and a first-order Markov baseline are evaluated under chronological train-validation-test partitioning. The best static models, Random Forest and XGBoost, reached test Macro-F1 = 0.4996, Balanced Accuracy = 0.6667, and Top-2 Accuracy = 0.9973 in the 10-minute window configuration. The best temporal model, LSTM with sequence length 3, matched but did not exceed this performance, while the Markov baseline achieved the same Top-1 and Top-2 accuracy. A reviewer-motivated ablation further compared raw-flow-only, tactical-context-only, and full feature settings to clarify what signal drives the prediction. Early prediction analysis showed that useful next-tactic ranking remained possible when only 10% of the attack process was observed. The findings indicate that ATT&CK-based tactical forecasting from Zeek flow summaries, optionally assisted by current tactical context, can support proactive early warning for cyber attack progression modeling, although minority tactic recovery remains constrained by severe class imbalance.