Deep Recurrent Hidden Markov Learning Framework for Multi-Stage Advanced Persistent Threat Prediction

TL;DR

APTs pose multi-stage, long-lived threats that require stage-aware forecasting under uncertainty. The authors introduce E-HiDNet, a hybrid CNN-RNN-HMM architecture that combines deep semantic feature learning with probabilistic state modeling, augmented by a Chapman–Kolmogorov–based Viterbi decoder to handle missing observations. On a synthetic yet structurally realistic dataset (S-DAPT-2026), E-HiDNet achieves near-perfect APT stage prediction and outperforms a standalone HMM, even when training data are limited. This work provides a principled framework for proactive APT defense, enabling timely anticipation of future attack stages and improved situational awareness for responders.

Abstract

Advanced Persistent Threats (APTs) represent hidden, multi\-stage cyberattacks whose long term persistence and adaptive behavior challenge conventional intrusion detection systems (IDS). Although recent advances in machine learning and probabilistic modeling have improved APT detection performance, most existing approaches remain reactive and alert\-centric, providing limited capability for stage-aware prediction and principled inference under uncertainty, particularly when observations are sparse or incomplete. This paper proposes E\-HiDNet, a unified hybrid deep probabilistic learning framework that integrates convolutional and recurrent neural networks with a Hidden Markov Model (HMM) to allow accurate prediction of the progression of the APT campaign. The deep learning component extracts hierarchical spatio\-temporal representations from correlated alert sequences, while the HMM models latent attack stages and their stochastic transitions, allowing principled inference under uncertainty and partial observability. A modified Viterbi algorithm is introduced to handle incomplete observations, ensuring robust decoding under uncertainty. The framework is evaluated using a synthetically generated yet structurally realistic APT dataset (S\-DAPT\-2026). Simulation results show that E\-HiDNet achieves up to 98.8\-100\% accuracy in stage prediction and significantly outperforms standalone HMMs when four or more observations are available, even under reduced training data scenarios. These findings highlight that combining deep semantic feature learning with probabilistic state\-space modeling enhances predictive APT stage performance and situational awareness for proactive APT defense.

Figures (14)

• Figure 1: APT Life-cycle sharma2023advanced
• Figure 2: APT System Model Architecture
• Figure 3: Graphical representation of an HMM with hidden states ($s_i$) and observable emissions ($o_k$), where $i=k=3$rabiner2002tutorial.
• Figure 4: Pictorial view of an HMM with typical APT stage campaign cycles ($S=\{s_{1},\cdots,s_{6}\}$) and observable emissions ($O =\{o_{1},\cdots,o_{14}\}$).
• Figure 5: E-HiDNet Architecture: Integrating CNN-RNN and HMM for APT stages prediction