Modern adversarial campaigns unfold as sequences of behavioural phases - Reconnaissance, Lateral Movement, Intrusion, and Exfiltration - each often indistinguishable from legitimate traffic when viewed in isolation. Existing intrusion detection systems (IDS) fail to capture this structure: signature-based methods cannot detect zero-day attacks, deep-learning models provide opaque anomaly scores without stage attribution, and standard Kalman Filters cannot model non-stationary multi-modal dynamics. We present PARD-SSM, a probabilistic framework that models network telemetry as a Regime-Dependent Switching Linear Dynamical System with K = 4 hidden regimes. A structured variational approximation reduces inference complexity from exponential to O(TK^2), enabling real-time detection on standard CPU hardware. An online EM algorithm adapts model parameters, while KL-divergence gating suppresses false positives. Evaluated on CICIDS2017 and UNSW-NB15, PARD-SSM achieves F1 scores of 98.2% and 97.1%, with latency less than 1.2 ms per flow. The model also produces predictive alerts approximately 8 minutes before attack onset, a capability absent in prior systems.

翻译：现代对抗性攻击活动表现为一系列行为阶段的序列——侦查、横向移动、入侵和数据窃取——每个阶段在孤立观察时往往难以与合法流量区分。现有入侵检测系统（IDS）未能捕捉这一结构：基于签名的方法无法检测零日攻击，深度学习模型仅提供不透明的异常评分而缺乏阶段归属，标准卡尔曼滤波器则无法建模非平稳多模态动态过程。我们提出PARD-SSM，一种将网络遥测数据建模为K=4个隐状态的状态依赖型切换线性动态系统的概率框架。结构化变分近似将推理复杂度从指数级降至O(TK²)，从而在标准CPU硬件上实现实时检测。在线EM算法自适应调整模型参数，基于KL散度的门控机制抑制误报。在CICIDS2017和UNSW-NB15数据集上的评估表明，PARD-SSM的F1分数分别达到98.2%和97.1%，每个数据流延迟小于1.2毫秒。该模型还能在攻击发生前约8分钟产生预测性警报，这一能力为此前系统所不具备。