DecodeX
Home/Problem Statements/SIH26153
All 226 Statements
SIH26153SoftwareBlockchain & Cybersecurity
₹1,50,000 Prize (₹75k Joint)
•
Deadline: 20 September 2026
•
Submitted Ideas: 0/500

AI based Network Attack Forecasting from Network Traffic Data

Ministry / Organization: National Technical Research Organisation (NTRO)
SIH Official PortalDataset Repository
Technical Complexity
8/10
Dataset Accessibility
7/10
36h Hackathon Viability
9/10
Step 0 • Zero-Jargon Layman Summary

“Instead of just spotting a virus after it hits, this system acts like a security camera that predicts a break-in by watching how a suspicious person moves before they even touch the door. It learns the normal 'rhythm' of a computer network and alerts defenders the moment it sees patterns that lead to an attack.”

The DecodeX PS Decoder™

Deconstructed Problem Blueprint

Step 1

WHAT TO BUILD?

An AI-powered predictive cybersecurity dashboard that uses 'World Models' to forecast future network states and identify malicious intent before an attack completes.

Step 2

WHO IS IT FOR?

National Technical Research Organisation (NTRO) and Critical Information Infrastructure (CII) security teams.

Step 3

WHY DOES IT EXIST?

Traditional tools only flag known threats (signatures) or single bad packets. They fail to catch 'low and slow' attacks where an intruder moves carefully over time to avoid triggering simple alarms.

Step 4

INPUT → PROCESS → OUTPUT ARCHITECTURE PIPELINE

01 • Inputs & Telemetry

PCAP files, NetFlow/IPFIX logs, and authentication event logs.

02 • Processing & AI Core

Feature extraction (flow + packet level), Temporal sequence modeling (Transformers/GNNs) to predict state transitions, and SHAP-based explainability analysis.

03 • Actionable Deliverables

Infiltration probability timeline, predicted MITRE ATT&CK stage, and a dashboard highlighting the specific 'driving' features causing the alert.

Step 5

CONSTRAINTS

  • Must run fully offline (no cloud dependencies).
  • Must provide explainable AI (XAI) outputs, not black-box predictions.
  • Must handle both flow-level and packet-level data simultaneously.
  • Must be benchmarked against a baseline logistic regression model.
Step 6

JURY METRICS

  • F1-Score (Precision vs Recall balance).
  • Inference latency (time to predict from current state).
  • False Positive Rate (critical for security operations).
  • Explainability score (how accurately the model identifies the 'why' behind an alert).
Step 7

CORE BOTTLENECK

Designing a 'World Model' that effectively learns causal state transitions rather than just memorizing static attack patterns from the training dataset.

Why You Should Choose This PS (Pros)

  • High-impact, cutting-edge AI theme (World Models).
  • Clear, objective evaluation criteria (benchmarking against baseline).
  • Strong alignment with national security priorities.

Challenges & Risks to Watch (Cons)

  • High mathematical complexity in implementing temporal state-transition models.
  • Data preprocessing for raw PCAP files is computationally expensive and time-consuming.
Hackathon Blueprint

Recommended Tech Stack & Grand Finale Features

Frontend & Mobile
StreamlitPlotly for time-series visualization
Backend & APIs
FastAPIPython
AI / ML & Models
Temporal Fusion Transformer (TFT)Graph Neural Networks (PyTorch Geometric)SHAP for explainability
Database & Cloud
DuckDB for fast analytical queriesParquet for dataset storage

Killer Features to Impress the SIH Jury

Interactive 'What-if' scenario builder: Let users simulate how a change in traffic would alter the risk score.
MITRE ATT&CK Heatmap integration: Real-time mapping of predicted states to the official framework.
Automated 'Evidence Report' generation: A one-click PDF summary of why the AI flagged a specific flow.
View Official SIH 2026 Portal Raw Text
▼
•Background This challenge seeks AI systems capable of learning network behaviour, anticipating attacker progression and supporting proactive cyber defence using the emerging concept of World Models. Design and develop a software prototype that learns the evolving state of a computer network from traffic telemetry and predicts the likelihood and progression of malicious activity before compromise is completed. The solution should ingest network traffic, learn temporal behaviour, forecast future attack states and provide interpretable decision support for defenders. Solutions should demonstrate applicability to enterprise environments and Critical Information Infrastructure.
•Represent network state using feature vectors or graphs.
•Learn state-transition dynamics using sequence models (LSTM, Transformer), Graph Neural Networks, latent state models or other AI techniques.
•Forecast future network states and estimate the probability of attacker progression.
•Map predicted behaviour to recognised attack stages (e.g. MITRE ATT&CK).
•Provide explain ability using attention mechanisms, feature attribution or equivalent techniques
•Detailed Description Participants are encouraged to build world models based AI systems that move beyond static intrusion classification towards predictive cyber defence. The solution may utilise flow records, packet captures, authentication logs or other publicly available cybersecurity telemetry. It should model temporal relationships, infer evolving network state, predict future attack progression and present meaningful explanations for its predictions.

Traditional machine learning classifiers applied to network traffic treat each flow in isolation and map it to a binary benign/malicious label. This discards the temporal and causal structure of an infiltration: the sequence in which ports are probed, the pattern in which SYN flags precede ACK floods, the inter-arrival timing of reconnaissance packets before lateral movement begins. An infiltration is a process unfolding over time, not a single anomalous packet.

•World Models — AI architectures that learn an internal causal simulation of how environment states evolve — offer a fundamentally different approach. Rather than classifying traffic, a world model learns the transition dynamics P(S_t+1 | S_t): given the current observed network state (active flows, flag distributions, port activity, packet timing), what is the probability distribution over future states. This enables forward simulation: roll out K steps ahead and identify whether the current trajectory converges to an infiltration state, before the attacker completes the kill chain.
1.Input Data — Two Levels of Traffic Feature Teams must work with both flow-level and packet-level features drawn from open-source network traffic datasets:
•Flow-level features (NetFlow / IPFIX format): source and destination IP/port pairs, TCP flag bitmask (SYN, ACK, FIN, RST, PSH, URG), protocol, bytes transferred per flow, packets per flow, flow duration, inter-arrival time (IAT) statistics (mean, variance, max), and bidirectional flow ratios.
•Packet-level features (PCAP-derived): Time-To-Live (TTL) values and their variance across a session, TCP window size, IP fragment flags, payload size distribution, port scan signatures (sequential or randomised port access patterns), and retransmission counts.

The combination of both levels is required because flow-level features capture aggregate behaviour (a SYN flood) while packet-level features expose timing and sequencing patterns (a slow reconnaissance scan designed to evade flow-based thresholds).

2.World Model Architecture The core deliverable is a learned model of network state transition dynamics — not a static classifier. The model must:
•Represent network state as a structured feature vector or graph encoding active flows at time

t.

•Learn P(S_t+1 | S_t) — the probability distribution over the next network state given the current state — using a sequence model such as an LSTM, Temporal Transformer, or Graph Neural Network (GNN) operating over time-windowed traffic observations.
•Be trained on labelled open-source datasets using supervised dynamics learning, where ground-truth state transitions are derived from the attack timeline annotations in the dataset.
•Generalise to unseen attack patterns — not merely memorize signatures from the training set.
3.Infiltration Prediction and Attack Stage Mapping The world model must support forward simulation: given current observed traffic, roll out K steps and output
•A time-series probability score: likelihood of infiltration in the next K time windows.
•Predicted attack stage: mapping to MITRE ATT&CK phases — Reconnaissance, Initial Access, Lateral Movement, Command & Control, or Exfiltration — based on the predicted future state.
•Driving
FEATURES

which specific flags, ports, or flow patterns are contributing most to the infiltration prediction (via attention weights or SHAP values).

The approaches are provided only as examples and are not mandatory. Teams are free to propose alternative architectures that satisfy the objectives.

•Expected Solution(Indicative)

A software-based, fully open-source solution is expected. The solution may include:

•A feature extraction pipeline that ingests CIC-IDS-2018 or CTU-13 CSV flow records and/or raw PCAP files (parsed using Scapy or PyShark) and outputs a timestamped, normalised feature matrix covering both flow-level and packet-level attributes described above.
•A trained world model (LSTM, Transformer, or GNN architecture) that demonstrably learns traffic state transition dynamics — not a static input-output classifier. Training scripts, model weights, and a reproducible training configuration must be included.
•An infiltration prediction engine that performs K-step forward simulation from a current traffic snapshot and outputs: infiltration probability score, predicted MITRE ATT&CK stage, and top contributing traffic features.
•An explainability output for each prediction — using SHAP values or model attention weights — identifying which flags, ports, or flow statistics are driving the prediction. Black-box outputs without interpretability are not acceptable.
•A working demonstration interface (Streamlit, Flask web app, or CLI) that accepts a PCAP or CSV file as input, runs the world model inference, and displays the infiltration probability timeline, flagged flows, and attack stage annotations. The interface must run fully offline without cloud API dependencies.
•Benchmark results comparing model performance (F1 score, precision, recall, false positive rate) against a logistic regression baseline trained on the same features, demonstrating that the world model's temporal dynamics learning provides measurable improvement.
•Expected Solution/Deliverables for Evaluation
•Source Code Link (GitHub/Drive Link)
•Readme with Setup Instructions
•Architecture Document (Max 2 Pages)
•Demo Video (Max 2 Minutes)
•Technical Presentation (Max 5 Slides) .