Adaptive Cyber Attack Projection through Context-Driven Model Selection: Combining Graph Attention Networks and Reinforcement Learning
Mouhamadou Lamine Diakhame, Chérif Diallo, Mohamed Mejri · 2025
Predicting the next phases of an ongoing cyberattack is critical for proactive cybersecurity, enabling defenders to anticipate and mitigate threats effectively. This paper presents a context-aware meta-model framework designed to dynamically select the most suitable prediction model for projecting the next phase of an attack. Depending on real-time situational parameters, the meta-model determines whether to employ a Graph Attention Network (GAT) or a Deep Q-Network (DQN). The GAT model captures complex, graph-based relationships in attack patterns, while the DQN model excels in sequential decision-making for evolving attack scenarios. Experimental evaluations using the CTU-13 dataset demonstrate the effectiveness of this approach: GAT achieves 99.20% accuracy, and DQN achieves 100% in predicting the second phase of an attack based on an alert set representing the first phase. These results highlight the potential of the meta-model framework to enhance adaptive cybersecurity defenses by optimizing model selection for accurate attack projections.