Modeling Multi-Stage Advanced Persistent Threats via Real-Time Spatiotemporal Vector Stitching

Abstract

Modern enterprise network architectures demand highly resilient, ultra-low latency intrusion detection
frameworks capable of parsing massive volumes of heterogeneous packet telemetrics while uncovering sophisticated,
distributed cyber threats. Traditional static signature-matching and isolated anomaly detection models fail to capture the
evolving, multi-stage spatiotemporal signatures characteristic of advanced persistent threats (APTs) and coordinated
lateral movements. This paper presents an end-to-end, event-driven machine learning architecture engineered for flexible,
real-time Cyber Attack Detection Using Spatiotemporal Patterns. The proposed platform decouples compute workloads
across a synchronized four-layer pipeline consisting of an edge-enabled Ingestion Layer, a concurrent Streaming and
Storage Layer, a Spatiotemporal Feature Graph Assembly Pipeline, and a hardware-accelerated Predictive Inference
Engine. The transactional lifecycle transitions continuously from high-frequency raw network traffic packets and firewall
transaction logs (capturing source/destination ports, packet sizes, protocol metadata, and cryptographic handshakes)
ingested via non-blocking proxies into distributed Apache Kafka partitions. A stateful stream processor aggregates these
streaming inputs, executing microsecond-scale parallel MGET queries against an in-memory Redis cluster to stitch rolling
localized window statistics (e.g., historical login failures, connection velocities), host topology matrices, and cross-layer
environmental contexts into an aligned, multidimensional spatiotemporal feature tensor. This dense array is passed over
high-performance binary gRPC transport channels to a flexible, optimized machine learning classification ensemble hosted
on a Triton Inference Server. Utilizing native missing data mask routing to elegantly navigate intermittent telemetry loss
and sensor dropouts without slow interpolation penalties, the inference engine evaluates complex graph-like structural
dependencies to flag malicious activity within a strict P95 latency ceiling of 11.6 milliseconds under a sustained load of
25,000 requests per second. When a transaction breaches designated risk thresholds for coordinated cyber anomalies
(P(Attack) ≥ 0.78), an automated classification interrupt activates an intelligent containment routing override, modifying
dynamic software-defined network (SDN) access control lists and quarantining compromised nodes in real time before
lateral infection spreads. Empirical validation demonstrates that the proposed architecture achieves a robust Precision-
Recall AUC of 0.892 and a target attack classification recall of 92.4%, effectively balancing rapid sub-15ms runtime
processing with adaptable, multi-stage threat mitigation.