Before the Breach

Why it matters

Standard defenses observe systems in two states: normal and compromised. By the time an attack is detected, an adversary may already hold credentials, persistence, or data. If a measurable Pre-Attack Behavioral State exists — detectable drift in system behavior before the boundary is crossed — defenses could engage before the real cost of compromise is paid. This reframes security from reaction toward early warning at the operating-system layer.

Research gap

The key research challenge is defining and validating a measurable Pre-Attack Behavioral State rather than simply detecting an attack after it begins. Existing intrusion detection leans heavily on known signatures and established indicators of compromise; the transition region between normal operation and active compromise remains comparatively underexplored, and it is unclear which telemetry streams carry the earliest reliable signal.

Research questions

1. 01 Which OS-level signals — syscalls, scheduling behavior, memory access patterns, I/O latency — drift earliest and most consistently during a pre-attack phase?
2. 02 Can a single behavioral index reliably separate benign system noise from measurable pre-attack drift?
3. 03 How much lead time is realistically available between the first detected pre-attack state and the first confirmed compromise event?
4. 04 Which learning architectures stay stable across heterogeneous workloads while remaining sensitive to pre-attack anomalies?

Suggested technologies

RusteBPFLinuxPythonscikit-learn

Required skills

Systems ProgrammingMachine LearningAnomaly DetectionThreat Modeling

Team and supervisor

3-5 researchers, supervised by Muhammad Qasim.

Suitable for: CS, SE, Cybersecurity, DS, AI, OS.

Expected deliverables

• Formal definition and experimental validation of a Pre-Attack Behavioral State
• Open-source OS telemetry dataset from staged pre-attack experiments
• Research paper analyzing detection lead time versus false-positive rates