AI based Network Attack Forecasting from Network Traffic Data

The receipts 🧾

Every red flag on this statement, in full. These are the four places it bites.

1. Exhibit A

   Public IDS datasets have discrete labelled attacks but limited genuine multi-stage campaign structure, so the temporal progression you learn may be thinner than the framing implies

2. It gets worse

   Forecasting future attack states is much harder to validate than classifying past ones, and you must define honestly what a correct forecast even means

3. Still reading?

   Lab-dataset attack sequences are cleaner than real ones, so forecast accuracy will look better than it would deploy

4. And the finisher

   The world-model framing is ambitious, and a submission that quietly reduces to a sequence classifier has not delivered the forecasting the description asks for

The damage report 📉

Every score this statement earned, and what each one actually costs you.

• Feasibility

  4/5

  Actually buildable, which on this slate is rarer than it sounds. Do not squander it on scope.

  The datasets are named and public — CIC-IDS and UNSW-NB15 contain labelled multi-stage attack sequences — and sequence and graph models over network telemetry are well-supported, so the whole thing is buildable, with the framing as forecasting rather than classification the genuinely novel and interesting twist.

• Innovation scope

  4/5

  There is something genuinely new here. Do not bury it under another dashboard.

  The world-model framing — learning state transitions to predict progression rather than classifying flows — is genuinely open and current, and how you represent state and forecast the next stage is the real intellectual contribution.

• Clarity

  4/5

  The ask is unambiguous, which quietly removes your favourite excuse.

  The description is specific about the approach — state representation, sequence or graph models, next-stage probability, MITRE ATT&CK mapping, explainability — so the deliverable is well defined even though it points at an ambitious concept.

• Acceptance potential

  4/5

  Strong footing before you have written a line. Try not to waste it.

  A strong pick — the data is named and public, the forecasting-over-classification framing is genuinely fresh in a field crowded with binary IDS projects, and the MITRE ATT&CK mapping plus explainability make it exactly the kind of predictive-defence work NTRO is signalling it wants.

• Effort

  Heavy

  Heavy. Somebody on this team is not sleeping in week three. Pick who, on purpose.

  State representation, the temporal or graph model, the forecasting head, the ATT&CK mapping and the explainability layer are focused, well-bounded work on data that already exists.

• Demo-ability

  Medium

  Demoable, if you rehearse it. Nobody rehearses it.

  Forecasting the next attack stage before it happens is a genuinely compelling story, but it needs the multi-stage attack context explained before a judge appreciates that a prediction, not a detection, is being shown.

The demo they will have already seen 🪞

Somewhere around 70–160 teams are heading here, and the description is doing the choosing for most of them. They will read the same brief, reach the same architecture, and build a version of the same demo you are planning. Being correct is the floor. If your five minutes could be swapped with the team before you and nobody in the room would notice, you have not picked badly — you have built predictably, which costs exactly the same and hurts more.

What survives 🛡️

The ground worth standing on when the questions start.

• The datasets are named and public, and CIC-IDS and UNSW-NB15 genuinely contain the multi-stage attack sequences the forecasting depends on
• Framing this as forecasting rather than classification is a real conceptual differentiator in a field saturated with binary intrusion detectors
• MITRE ATT&CK mapping gives your predictions a standard, defender-legible vocabulary that makes the output immediately actionable