Latent States: Model-Based Machine Learning Perspectives on Cyber Resilience
Résumé
This paper presents a novel approach for modeling networks cyber resilience when undergoing cyberattack. We offer to use Model-Based Machine Learning (MBML) to address the limitations of scenario specific disruption modeling, the latter being inadequate for the evolving and highly uncertain nature of cyber threats. As a proof of concept, we collected and analyzed 300.272 signals for 9 security incidents over 30 days. We used a multinomial Hidden Markov Model for disruption response function parameters inference and latent state filtering. Along with selected signals, these are used as features to train a Random Forest in a multistep prediction task, where we predict occurrence of cyberattacks on next time-step, reaching an F1-Score of. 98 on next-hour horizon. Our hybrid model uses large-scale cyberattack telemetry as ground-truth, with the ability to produce both resilience metrics and cyberattack early warning. All algorithmic design choices were motivated by explainability and robustness trade-off.