Researchers have shown that modeling an attacker’s behaviour as a hidden state that can switch during an episode, and explicitly linking feasible actions to that state, boosts next‑action predictions.

The new method builds a hidden‑Markov model whose latent variable represents the attacker’s current regime. The action law is defined on a feasibility‑masked decision tree, ensuring that only valid operation‑argument combinations appear. Filtering over the model updates the regime belief whenever an action is observed, and the same likelihood grants the next‑action distribution.

Inference combines exact filtering with convex logistic regression fits for the action choice law. When the regimes are unlabeled, the Baum–Welch algorithm re‑uses these convex fits, keeping estimation tractable.

On the CAGE 2 cyber‑defense benchmark, the approach delivers a 0.8‑nat per‑step improvement in negative log‑likelihood over a filtered baseline. After a controller switch, the loss begins to fall in just three steps, versus ten for a recurrent baseline that does not model regimes.

The model does not include an explicit fallback state that emits uniformly over feasible actions, which may lead to overconfidence in some detection‑setting experiments—a limitation noted by the authors.

The work demonstrates that incorporating persistent, switchable regimes and feasibility‑masked action trees yields measurable gains in predicting attacker behaviour.