Advanced TIE (Part 1): Predicting the Adversary’s Next Move

Standardizing adversary tradecraft through MITRE ATT&CK gave the security community a foundational language to categorize behaviors. Building on that foundation, projects like MITRE Engenuity CTID's original Technique Inference Engine (TIE) and ATT&CK Flow expanded our analytical horizon — enabling defenders to model intrusions as connected sequences.

In an active operational environment, defenders navigate a landscape of imperfect information where the adversary holds the initial momentum. Shifting the underlying economics of cyber defense requires extending our capabilities from observing current events to anticipating future chokepoints before the adversary reaches them. You cannot run from the graph; every adversary action is a state transition across a coordinate plane, governed by structural dependencies and resource friction. When you map the geometry of the terrain and the specific assets in play, the adversary's next maneuver becomes a calculable trajectory.

The Advanced Technique Inference Engine (Advanced TIE) operationalizes this trajectory. Powered by a dual-system architecture combining Sparse Distributed Memory (SDM) and a Spiking Neural Network (SNN), Advanced TIE ingests an active ATT&CK Flow formatted as a STIX 2.1 bundle, predicts the next MITRE technique in the sequence while preserving the exact architectural context of the environment, and outputs an updated, connected ATT&CK Flow in STIX 2.1.

I. The Evolution of Behavioral Prediction: From Taxonomy to Context-Aware Flows

Every layer of modern detection engineering answers a distinct question about the operational terrain. Point-in-time event telemetry identifies discrete indicators across individual events. Stateful hunting queries join events across local timelines to expose active sequences. MITRE Engenuity CTID's original Technique Inference Engine (TIE) took the critical leap into predictive modeling, applying machine learning to historical datasets to recommend probable associated techniques based on observed behaviors.

Advanced TIE extends this evolution by uniting sequence-based prediction directly with the topological structure of ATT&CK Flow. In a real-world intrusion, an adversary's options are constrained by two factors: the causal requirements of their tradecraft and the specific architecture of the systems they currently occupy. Predicting an isolated technique ID — such as T1046: Network Service Discovery — provides valuable strategic insight, but binding that predicted technique directly to the specific server, identity, or Active Directory controller in play unlocks immediate operational leverage.

• Event Telemetry: Primary Telemetry Unit is isolated events with 100% known information. Operational Focus is Real-Time Sequence Tracking. Core Capability is joining live events across local timelines.
• Original TIE: Primary Telemetry Unit is Technique Co-Occurrence. Operational Focus is Associative Recommendation. Core Capability is identifying probable techniques based on historical dataset patterns.
• Advanced TIE: Primary Telemetry Unit is ATT&CK Flow (STIX 2.1). Operational Focus is Predictive Graph Projection. Core Capability is ingesting and outputting contextualized STIX 2.1 ATT&CK Flow graphs across boundary projections.

By treating the intrusion as a unified spatial graph where actions and assets are inextricably linked, defenders can move beyond asking what an adversary might do in the abstract and establish where the next state transition will intersect their infrastructure.

II. The World Model Foundation: Learning the Physics of Adversary Tradecraft

An adversary does not move through an environment at random. Just as physical systems are governed by thermodynamics and economic markets are ruled by supply and demand curves, cyber intrusions are governed by structural mechanics. An attacker cannot exfiltrate data from a database before establishing access, elevating privileges, or navigating network boundaries. These causal dependencies form the underlying physics of adversary tradecraft.

To internalize these mechanics, Advanced TIE models every intrusion as a formal directed graph:

G = (V, E, C)

Within this structure:

• V (Vertices) represents the set of observed MITRE ATT&CK technique nodes.
• E (Edges) represents the directed, chronological transitions from one technique to the next (T_a → T_b).
• C (Context) represents the environmental bindings — the specific STIX infrastructure, identity, or vulnerability objects targeted or utilized by those techniques (T_i → A_x).

To ensure zero translation friction between observation and action, the engine operates with strict Schema Symmetry. Both the input and output of Advanced TIE are standard ATT&CK Flows formatted as STIX 2.1 bundles. When an analyst or an automated pipeline feeds an observed flow into the engine, the world model evaluates the topological boundaries of the graph:

• Entry Nodes (V_entry): The earliest observed points of the intrusion where the in-degree equals 0.
• Terminal Nodes (V_exit): The current frontier of the intrusion where the out-degree equals 0.

By enforcing strict chronological ordering and valid schema relationships across its world model, the engine projects backward from V_entry to uncover unseen initial access steps (T_before) and projects forward from V_exit to anticipate the adversary's next maneuver (T_after).

III. Demystifying the Math: Packing a Threat Graph into a Single Coordinate

A primary challenge in graph-based machine learning is scale and structural variance. One ATT&CK Flow might consist of three techniques targeting a single cloud workstation, while another spans forty techniques branching across multiple domain controllers and identity providers. Traditional neural networks struggle when input sizes shift dynamically, and flattening a graph into a simple list strips away the connections between what happened and where it happened.

Advanced TIE solves this using Vector Symbolic Architecture (VSA), also known as hyperdimensional computing. It is best understood as generating a high-capacity cryptographic fingerprint for an entire graph.

The Building Blocks: Bipolar Vectors

Instead of representing a MITRE technique or a server with a simple database ID, the engine assigns every unique concept its own list of 10,000 numbers, where every number is randomly chosen as either +1 or -1:

V ∈ {-1, +1}¹⁰⁰⁰⁰

In a 10,000-dimensional space, two randomly generated vectors are almost guaranteed to be completely distinct (orthogonal). Every MITRE Technique gets a unique 10,000-number signature (T), and every network asset or identity in the STIX bundle is assigned its own 10,000-number signature (A_x, I_y).

Binding and Bundling: The Core Mechanics

To pack an entire multi-step ATT&CK Flow into a single, fixed-size coordinate without losing the relationships between nodes, VSA relies on two basic arithmetic operations:

• Binding (⊗): Multiplication. When you multiply two 10,000-element vectors together element-by-element, you create a brand-new vector that locks those two concepts together. If we multiply the vector for Valid Accounts (T_1078) by the vector for Corporate Domain Controller (A_DC), they are mathematically bound:

V_bound = T_1078 ⊗ A_DC

We do the exact same thing to lock sequence order, shifting a successor technique's vector slightly (Π) before multiplying so the engine knows T_a came before T_b:

V_edge = T_a ⊗ Π(T_b)

Crucially, multiplication in bipolar space is completely reversible: if you multiply the bound pair by Valid Accounts again, Corporate Domain Controller pops right back out:

T_1078 ⊗ (T_1078 ⊗ A_DC) = A_DC

• Bundling (+): Addition. Once we have multiplied our connected pairs together, we simply add all of those 10,000-number lists together column-by-column:

V_F = Σ [ (T_a ⊗ Π(T_b)) + (T_i ⊗ A_x) ]

This produces one master holistic vector (V_F) of the exact same size (10,000 elements) that holds the entire story of the ATT&CK Flow.

Whether the incoming STIX 2.1 bundle contains three nodes or thirty, V_F remains a single 10,000-element coordinate. Because the asset context (A_x) is bound directly into the sum alongside the technique transitions, the environmental signature travels wherever the vector goes.

IV. The Dual-System Architecture: Fast Reflexes vs. Deep Simulation

Once the incoming ATT&CK Flow is encoded into its holistic coordinate V_F, the engine must predict what lies beyond the graph's boundaries. To balance immediate recognition of known tradecraft with deep reasoning over novel adversary behavior, Advanced TIE implements a dual-system architecture inspired by Daniel Kahneman's cognitive model of System 1 (fast, instinctive reflex) and System 2 (deliberate, analytical simulation).

Figure 1: The Advanced TIE Dual-System Architecture. Incoming STIX 2.1 ATT&CK Flows are encoded into 10,000-dimensional bipolar hypervectors (V_F). Known trajectories resolve in under 2ms via System 1 (Sparse Distributed Memory), while novel flows ("Instinct Misses") wake up System 2 (the Spiking World Model) for causal wave simulation and continuous SDM write-back.

System 1: Sparse Distributed Memory (SDM) — The Fast Reflex

Think of Sparse Distributed Memory (SDM) as a veteran defender's muscle memory. In human cognition, you do not have to consciously calculate every variable when you see a familiar sequence of events; you recognize the pattern as an integrated whole.

SDM operates as a massive, high-dimensional address space populated by learned campaign patterns. When an incoming ATT&CK Flow V_F enters the engine, it is formulated as a query address:

Query Address = V_F

Instead of looking for an exact database match — which rarely happens in the fog of war — SDM reads from a "hamming sphere" of nearby memory locations that share structural similarity with the active flow. If the retrieved vector crosses the engine's confidence threshold (E ≥ θ), System 1 triggers an immediate associative recall.

Because VSA binding is reversible, System 1 takes the retrieved memory vector (C_retrieved), unbinds the predicted technique (T_after^pred), and runs a clean-up pass against the item codebook to extract the exact environmental asset context:

A_target = C_retrieved ⊗ T_after^pred

System 2: Spiking Neural Network (SNN) — The Deep Wave Simulator

Adversaries constantly adapt, chaining techniques together in ways that may not match historical playbooks. When an incoming ATT&CK Flow encounters an Instinct Miss (E < θ in Sparse Distributed Memory), the engine seamlessly hands the problem over to System 2: the Spiking Neural Network (SNN).

Unlike standard feed-forward neural networks that process static snapshots, Spiking Neural Networks mimic biological brains by communicating through discrete electrical impulses (spikes) moving across time. In System 2, the world model of MITRE ATT&CK is mapped onto an active neural grid where techniques are neurons and historical causal transitions are synaptic weights.

• Wave Propagation: System 2 injects electrical current directly into the boundary nodes of the input flow while keeping the active assets © clamped as localized excitatory modulators. A forward wave of spikes fires outward from the terminal nodes (V_exit) to discover the most probable successor (T_after), while a reverse wave fires backward from the entry nodes (V_entry) to deduce unseen predecessors (T_before).
• Temporal Integration: As spikes travel across the graph topology, pathways that align with both the sequence trajectory and the active target architecture accumulate voltage first, causing the optimal predicted technique neuron to fire.
• Closing the Loop (Write-Back): Once System 2 resolves a novel path through deep simulation, it does not discard the work. It binds the newly discovered trajectory and context into a holistic VSA vector and writes it directly back into System 1's Sparse Distributed Memory. The engine learns from its own deliberation — turning today's deep simulation into tomorrow's instant reflex.
• System 1 (Instinct): Architecture is Sparse Distributed Memory (SDM). Triggered by High Confidence (E ≥ θ). Operates via associative retrieval of familiar campaign patterns and bound asset context.
• System 2 (Deliberation): Architecture is Spiking Neural Network (SNN). Triggered by Instinct Miss (E < θ). Operates via deep temporal wave propagation across the graph topology with write-back to SDM.

V. Context Inheritance & The STIX 2.1 Mandate: End-to-End ATT&CK Flow Continuity

A predictive engine is only as useful as its integration into live security operations. If an inference model outputs a raw text string or a detached probability score, an analyst still has to manually rebuild the context and map it back to their environment. Advanced TIE eliminates this bottleneck through its Context Inheritance Protocol and its native STIX 2.1 Graph Integration Engine.

When either SDM or the SNN identifies the next technique in the sequence (T_after), the engine executes Clone and Connect logic at the graph boundaries:

• Structural Stitching: The engine instantiates a new STIX attack-pattern object for the predicted technique and mints a standard STIX relationship object (relationship_type: "precedes") linking the terminal node (V_exit) directly to the new prediction.
• Context Inheritance: The engine inspects all non-technique STIX objects attached to V_exit — such as identity, vulnerability, or infrastructure nodes — and automatically projects those exact relationships onto the predicted node.

Consider an active intrusion where the terminal observed node in the incoming ATT&CK Flow is attack-pattern — T1078 (Valid Accounts), which targets infrastructure — Active-Directory (Corporate Domain Controller). When Advanced TIE predicts attack-pattern — T1046 (Network Service Discovery) as the successor, it outputs a single, unified STIX 2.1 bundle where both the sequence progression and the environmental target are preserved.

Because the input and output schemas are symmetric STIX 2.1 ATT&CK Flows, this bundle can be piped directly into Threat Intelligence Platforms (TIPs), SOAR playbooks, or visualization interfaces without custom parsing. Instead of waiting for the adversary to execute their next move and trigger a downstream alert, defenders can visualize the projected path across their exact infrastructure, pre-stage targeted threat hunts, and reinforce the specific chokepoints that lie directly in the adversary's trajectory.

Continue Reading: Under the Hood of the Neuromorphic Engine

While this article covered the operational architecture of Advanced TIE — from hyperdimensional graph encoding (VSA) to symmetric STIX 2.1 context inheritance — building a world model capable of true causal reasoning required rethinking standard deep learning paradigms.

In Part 2, we dive deep into the engineering and computational physics of the Advanced TIE Spiking World Model. We explore why we chose a 10,000-node Leaky Integrate-and-Fire (LIF) Spiking Neural Network over Transformers and GNNs, how we eliminated synchronous GPU overhead using jax.lax.scan XLA kernel fusion, and how Three-Factor STDP plasticity enables continuous, observer-agnostic learning without offline retraining.

👉 Read Part 2: Advanced TIE (Part 2): Inside the Spiking World Model, JAX Optimization, and Continuous Learning