PARD-SSM: Variational Switching State-Space Model Detects Cyber-Attack Phases in Real-Time Network Traffic

arXiv·medium signal

PARD-SSM models adversarial campaigns as sequences of behavioral phases (Reconnaissance, Lateral Movement, Intrusion, Exfiltration) using a variational switching state-space architecture. Unlike signature-based IDS or opaque deep learning anomaly scores, it provides stage attribution for detected attacks and handles non-stationary multi-modal dynamics that standard Kalman Filters cannot. Directly relevant for security teams building detection pipelines.