Threat Hunting Using Markov Chains in Heterogeneous Computer Networks

Cyber-attacks are becoming increasingly complex, requiring efficient and lightweight early detection mechanisms that can be deployed on memory-restricted devices. While Markov chains have been previously used for threat modeling, their standalone applicability for real-time intrusion detection remains a challenge. This paper proposes a lightweight intrusion detection framework that uses five parallel Markov chains, without additional machine learning or hybrid techniques, to model normal network behavior and detect anomalies across heterogeneous systems. Evaluated on the CICIDS2017 dataset, the approach achieves strong performance for structured, high-volume attacks like DDoS and PortS can (F1-scores up to 0.96), while reducing memory usage by 71.5% and minimal computational overhead. Although less effective for stealthy or low-frequency threats, the method shows promise as a resource-efficient, first-line defense for edge or embedded cybersecurity environments.