Automatic generation of cause and effect attack predictions models via threat intelligence data

Abstract

A method for predicting a future stage of an attack on a computer system. The method comprises performing, by the computer system, linguistic analysis on threat intelligence reports, where the threat intelligence reports comprise known stages of the attack. The method also comprises processing, by the computer system, the linguistic analysis with a transition matrix to determine probabilities of cause-and-effect relationships between the known stages of the attack, updating, by the computer system, a probability model based on the probabilities determined by the transition matrix, and predicting, by the computer system, the future stage of the attack based on the probability model and attack classifications.