SIH26153Strong pickacceptance 4/5

AI based Network Attack Forecasting from Network Traffic Data

National Technical Research Organisation (NTRO) · Blockchain & Cybersecurity · Software

The forecasting-over-classification framing is genuinely fresh and the data is handed to you — commit to predicting the next stage rather than relabelling flows, and define clearly what a correct forecast means, because that is where the concept proves itself.

Data: CIC-IDS2017/2018, UNSW-NB15 and similar public datasets; nciipc.gov.in

What it actually is

Ordinary intrusion detection labels each network flow as good or bad in isolation, which throws away the story of an attack — the sequence of a probe, then a scan, then an exploit. The ask is a system that learns how a network evolves over time and forecasts the next stage of an attack before compromise completes, mapping the predicted progression to recognised attack stages and explaining its reasoning.

What to build

A predictive defence prototype representing network state as feature vectors or a graph over time, learning state-transition dynamics with sequence models such as LSTMs or transformers or with graph neural networks, forecasting the probability that an attacker progresses to a next stage before compromise is complete, mapping the predicted behaviour onto MITRE ATT&CK stages so a defender sees which tactic is likely next, and providing interpretability through attention or feature attribution so the forecast is actionable rather than a black-box alarm.

Smallest thing that wins the room

Replay a multi-stage attack sequence from a public dataset and show the model, partway through reconnaissance, forecasting a high probability of progression to the exploitation stage — naming the predicted MITRE ATT&CK tactic and highlighting the flows that drove the prediction — before the compromise actually happens.

How crowded this one gets

A guess, projected from the 2025 statements — the last year where both the submission counts and the winners were published.

Quiet70–160 teams expectedroughly 1 in 60–139 wins it

Quieter than 82% of the 226 · #42 of 226 by expected field

Few teams are likely to go here. The best odds on the board come from statements like this.

Why: defence, intelligence and space bodies drew small fields.

This is a guess, not a fact

Nobody has published 2026’s numbers yet. This is an analysed estimate from last year’s pattern, so please do not take it as the truth — check the live counter on the SIH portal before you decide anything. The range covers the middle half of likely outcomes, so one statement in two lands outside it. Entry closes at 500 ideas per statement, so no range goes past that — a statement that reaches the cap fills and shuts rather than drawing an unlimited crowd. The model reads only three things a team can see before choosing — software or hardware, the theme, and what kind of body posted it — and those explain about a quarter of the variation in last year’s field sizes (R² 0.25 on held-out statements). Trust the band more than the number, and the ordering more than either. It cannot see how good your idea is, which is the part that actually decides it.

The scores

The number is the shorthand. The line under it is the reason.

Acceptance potential

4/5

A strong pick — the data is named and public, the forecasting-over-classification framing is genuinely fresh in a field crowded with binary IDS projects, and the MITRE ATT&CK mapping plus explainability make it exactly the kind of predictive-defence work NTRO is signalling it wants.

Feasibility

4/5

The datasets are named and public — CIC-IDS and UNSW-NB15 contain labelled multi-stage attack sequences — and sequence and graph models over network telemetry are well-supported, so the whole thing is buildable, with the framing as forecasting rather than classification the genuinely novel and interesting twist.

Innovation scope

4/5

The world-model framing — learning state transitions to predict progression rather than classifying flows — is genuinely open and current, and how you represent state and forecast the next stage is the real intellectual contribution.

Clarity

4/5

The description is specific about the approach — state representation, sequence or graph models, next-stage probability, MITRE ATT&CK mapping, explainability — so the deliverable is well defined even though it points at an ambitious concept.

Effort

Heavy

State representation, the temporal or graph model, the forecasting head, the ATT&CK mapping and the explainability layer are focused, well-bounded work on data that already exists.

Demo-ability

Medium

Forecasting the next attack stage before it happens is a genuinely compelling story, but it needs the multi-stage attack context explained before a judge appreciates that a prediction, not a detection, is being shown.

In its favour

Green flag: The datasets are named and public, and CIC-IDS and UNSW-NB15 genuinely contain the multi-stage attack sequences the forecasting depends on
Green flag: Framing this as forecasting rather than classification is a real conceptual differentiator in a field saturated with binary intrusion detectors
Green flag: MITRE ATT&CK mapping gives your predictions a standard, defender-legible vocabulary that makes the output immediately actionable
Green flag: The explainability requirement pushes you toward genuinely useful forecasts rather than an opaque next-stage probability

Against it

Red flag: Public IDS datasets have discrete labelled attacks but limited genuine multi-stage campaign structure, so the temporal progression you learn may be thinner than the framing implies
Red flag: Forecasting future attack states is much harder to validate than classifying past ones, and you must define honestly what a correct forecast even means
Red flag: Lab-dataset attack sequences are cleaner than real ones, so forecast accuracy will look better than it would deploy
Red flag: The world-model framing is ambitious, and a submission that quietly reduces to a sequence classifier has not delivered the forecasting the description asks for

What you will be writing

LSTM / Transformer sequence models over flow telemetry
Graph neural network network-state modelling
CIC-IDS2017/2018 + UNSW-NB15 multi-stage attacks
MITRE ATT&CK stage mapping
Attention / SHAP explainability
Next-stage progression probability estimation
Predictive cyber defence
Network security
Temporal modelling

Prior art to read before you start

attack progression forecasting · network state world models · MITRE ATT&CK stage prediction

Analysed by Claude Opus. Every score above is a judgment call with its reasoning attached — kindly cross-check this against the official statement on the SIH portal before your team commits to it.