Advanced Persistent Threats (APTs) represent hidden, multi\-stage cyberattacks whose long term persistence and adaptive behavior challenge conventional intrusion detection systems (IDS). Although recent advances in machine learning and probabilistic modeling have improved APT detection performance, most existing approaches remain reactive and alert\-centric, providing limited capability for stage-aware prediction and principled inference under uncertainty, particularly when observations are sparse or incomplete. This paper proposes E\-HiDNet, a unified hybrid deep probabilistic learning framework that integrates convolutional and recurrent neural networks with a Hidden Markov Model (HMM) to allow accurate prediction of the progression of the APT campaign. The deep learning component extracts hierarchical spatio\-temporal representations from correlated alert sequences, while the HMM models latent attack stages and their stochastic transitions, allowing principled inference under uncertainty and partial observability. A modified Viterbi algorithm is introduced to handle incomplete observations, ensuring robust decoding under uncertainty. The framework is evaluated using a synthetically generated yet structurally realistic APT dataset (S\-DAPT\-2026). Simulation results show that E\-HiDNet achieves up to 98.8\-100\% accuracy in stage prediction and significantly outperforms standalone HMMs when four or more observations are available, even under reduced training data scenarios. These findings highlight that combining deep semantic feature learning with probabilistic state\-space modeling enhances predictive APT stage performance and situational awareness for proactive APT defense.

翻译：高级持续性威胁（APTs）是一种隐蔽的多阶段网络攻击，其长期持续性和自适应行为对传统入侵检测系统（IDS）构成了挑战。尽管机器学习和概率建模的最新进展提升了APT检测性能，但现有方法大多仍是被动且以告警为中心的，在阶段感知预测和不确定性下的原则性推理方面能力有限，尤其在观测数据稀疏或不完整时。本文提出E-HiDNet，一个统一的混合深度概率学习框架，它将卷积神经网络、循环神经网络与隐马尔可夫模型（HMM）相结合，以实现对APT攻击活动进展的准确预测。深度学习组件从相关的告警序列中提取层次化的时空表征，而HMM则对潜在的攻击阶段及其随机转移进行建模，从而支持在不确定性和部分可观测性下的原则性推理。本文引入了一种改进的维特比算法来处理不完整的观测数据，确保在不确定性下的鲁棒解码。该框架使用一个合成生成但结构真实的APT数据集（S-DAPT-2026）进行评估。仿真结果表明，在获得四个或更多观测数据时，E-HiDNet在阶段预测中达到了高达98.8-100%的准确率，并且显著优于独立的HMM模型，即使在训练数据减少的场景下也是如此。这些发现表明，将深度语义特征学习与概率状态空间建模相结合，能够增强APT阶段预测性能和态势感知能力，从而支持主动的APT防御。