Predictive Dynamic Attack-Path Intelligence for Proactive Cloud Threat Detection

Abstract

Cloud-scale threat detection can reconstruct malicious activity after evidence becomes visible, but proactive defence requires reliable forecasts of where a partially observed intrusion is likely to progress. Predictive Dynamic Attack-Path Intelligence (PDAPI) is a proposed temporal graph framework in this paper, which localises changes of interest in security concerns, identifies partial attack-paths, and predicts future nodes, actions, targets of interest, and continuations of a multi-hop attack. PDAPI integrates temporal-structural encoding, feasibility-based beam search, calibrated on lead-time risk scoring, and evidence-based agentic validation. An empirical evaluation was constructed over temporally ordered attack-path sequences derived from provenance-oriented cloud-security traces and ATT&CK-aligned behaviours. Across the consolidated test split, PDAPI achieved Hit@1 of 0.873, Hit@3 of 0.957, mean reciprocal rank of 0.912, next-action macro-F1 of 0.901, and critical-target Top-3 accuracy of 0.934. It provided a median warning lead time of 18.7 min while maintaining 42 ms median prediction latency. Ablation results showed that removing temporal encoding, feasibility constraints, or changed-subgraph localisation reduced Hit@1 by 4.1, 5.8, and 3.4 percentage points, respectively. The findings confirm the use of predictive attack-path intelligence as a viable expansion to dynamic attack-graph detection to effectively enable proactive cloud defence.