Collaborative Research: Excellence in Research: Designing an adaptive attack risk estimation framework for proactive cyber threats

Cyberattacks are becoming more sophisticated, threatening critical infrastructure, businesses, and personal data across the nation. Modern computer networks generate vast amounts of diverse information at high speeds, making it difficult for security teams to identify which threats require immediate attention. Current cybersecurity systems often analyze network data in isolation, missing important connections between different types of security events and how attack methods evolve over time. This project addresses a critical gap: developing a systematic approach to identify warning signs of network vulnerability by examining patterns across multiple data sources and tracking how these patterns change as attacks unfold. The work serves the national interest by strengthening cyber defenses that protect essential services, economic activities, and sensitive information. Project outcomes will include new methods for learning and representing changing indicators of network vulnerability and for translating these insights into effective defense strategies. This will advance the field of cybersecurity by enabling security systems to recognize evolving threats and helping analysts make better decisions about which incidents require immediate response. Additionally, the project will build research capacity at two institutions by engaging students in advanced cybersecurity research, preparing the next generation of cybersecurity professionals. This project involves designing a framework that enables early warning and reliable, risk-informed cyber defense through machine learning and data analysis techniques. It will examine context-aware temporal and spatial features of network activity to predict network event frequencies and estimate attack severity. The framework will generate data-driven rules that link extracted features to specific attack behaviors, encoding these as interpretable indicators of network vulnerability. These indicators will be combined with severity estimates and temporal frequency predictions to construct state representations for reinforcement learning. The learning agent will develop policies that map evolving threat conditions to response actions, including alert prioritization and incident review recommendations. The project will also design multi-scale temporal visualizations to help security analysts understand how attacker behaviors change over time and interpret the changing risk levels with quantified confidence. This project is funded by the U.S. National Science Foundation (NSF) Historically Black Colleges and Universities-Excellence in Research (HBCU-EIR) Program. HBCU-EIR supports research at public and private HBCUs to strengthen their research capacity and promote engagement with NSF. This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.