Benchmark evaluation demonstrates proactive attack forecasting in network traffic telemetry, highlighting significant recall gains over point classifiers.
Most network intrusion detection systems (NIDS) are point classifiers: they score one flow at a time and decide whether it looks malicious, which works poorly against slow reconnaissance and patient lateral movement spread across many ordinary-looking flows. Sentinel reframes network defense as a forecasting problem instead. It reads an eight-window history of 21 behavioral network-state features, models the transition dynamics with a dual-head LSTM "world model," and runs that model forward step by step to produce a forecast — up to twenty seconds before a host is compromised. On the CSE-CIC-IDS2018 infiltration benchmark, Sentinel catches 60.6% of attacks at a fixed 5% false-positive budget versus 13.5% for a logistic-regression baseline — a 4.5× gain in recall — and every forecast carries a gradient-based explanation and a MITRE ATT&CK tactic label.
No takes yet. Share an insight, caveat, or question.
Shahane et al. (2026) studied this question.
Synapse has enriched 5 closely related papers on similar clinical questions. Consider them for comparative context: