Real-Time Risk Scoring of Ongoing Cyber Attacks

As cyber threats grow more advanced, real-time classification and prediction of attacker behavior is critical for effective defense. This paper presents a novel approach to classifying and predicting ongoing cyber attacks. Our methodology employs agglomerative clustering based on normalized Levenshtein distance to group similar attack sequences, followed by Markov Chain modeling and Bayesian classification to predict attacker intentions early in the attack. Additionally, we introduce a quantitative risk scoring framework using VirusTotal's IP reputation to assess the severity of identified attack clusters. Among 10,126 test sequences, 99.79% of attacks are correctly clustered after observing the first command. We define a data-driven entropy threshold-“min wrong guess line”-to signal real-time prediction confidence. Our approach enables early-stage threat classification and risk assessment for faster and more informed response to evolving cyberattacks.