Predictive Response Engine for Dynamic Intelligence and Cyber Threat Mitigation (PRE-DICT): Architecture, Mathematical Formulation, and Empirical Evaluation

Abstract

Modern enterprise infrastructures face threats from complex multi-stage cyber attacks carried out by smart and evolving adversaries. Traditional tools like Security Information and Event Management (SIEM) and Security Orchestration, Automation and Response (SOAR) operate in a way. They depend on Indicators of Compromise (IoCs) and fixed response plans. This approach leads to delays in action and a lot of alarms especially during zero-day attacks. This paper presents a system called the Predictive Response Engine for Dynamic Intelligence and Cyber Threat Mitigation (PRE-DICT). It is an automated framework that predicts enemy moves and takes actions in real time. PRE-DICT combines a -source Dynamic Cyber Threat Intelligence (CTI) data pipeline, a Temporal Graph Neural Network (TGNN) for forecasting attack paths with probabilities and a Reinforcement Learning (RL) engine that makes safe riskcontrolled decisions. The whole system models threat prediction, as a Constrained Partially Markov Decision Process (CPOMDP) which helps reduce threats while keeping service disruptions to a minimum. In tests using a cyber-range with 1,200 systems PREDICT cuts the average time to respond by 78.4% and stops 94.2% of advanced attack chains. It also keeps business operations running.