# Tiresias: Predicting Security Events Through Deep Learning

arXiv: https://arxiv.org/abs/1905.10328 · HTML: https://mlsanity.com/paper/1905.10328/

## Key facts

- Cited by 10 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 24 May 2019.

## Built on by (most cited first, 10 of 10)

- [MAGIC: Detecting Advanced Persistent Threats via Masked Graph Representation Learning](https://mlsanity.com/paper/2310.09831/) (2023)
- [LAN: Learning Adaptive Neighbors for Real-Time Insider Threat Detection](https://mlsanity.com/paper/2403.09209/) (2024)
- [A Comprehensive Survey of Logging in Software: From Logging Statements Automation to Log Mining and Analysis](https://mlsanity.com/paper/2110.12489/) (2021)
- [Cerberus: Exploring Federated Prediction of Security Events](https://mlsanity.com/paper/2209.03050/) (2022)
- [Automated Alert Classification and Triage (AACT): An Intelligent System for the Prioritisation of Cybersecurity Alerts](https://mlsanity.com/paper/2505.09843/) (2025)
- [NetSentry: A Deep Learning Approach to Detecting Incipient Large-scale Network Attacks](https://mlsanity.com/paper/2202.09873/) (2022)
- [Insider Threat Detection Using GCN and Bi-LSTM with Explicit and Implicit Graph Representations](https://mlsanity.com/paper/2512.18483/) (2025)
- [A Heterogeneous Graph Learning Model for Cyber-Attack Detection](https://mlsanity.com/paper/2112.08986/) (2021)
- [Collaborative adversary nodes learning on the logs of IoT devices in an IoT network](https://mlsanity.com/paper/2112.12546/) (2021)
- [Scoring the Unscorables: Cyber Risk Assessment Beyond Internet Scans](https://mlsanity.com/paper/2506.06604/) (2025)

## Abstract (arXiv)

With the increased complexity of modern computer attacks, there is a need for defenders not only to detect malicious activity as it happens, but also to predict the specific steps that will be taken by an adversary when performing an attack. However this is still an open research problem, and previous research in predicting malicious events only looked at binary outcomes (e.g., whether an attack would happen or not), but not at the specific steps that an attacker would undertake. To fill this gap we present Tiresias, a system that leverages Recurrent Neural Networks (RNNs) to predict future events on a machine, based on previous observations. We test Tiresias on a dataset of 3.4 billion security events collected from a commercial intrusion prevention system, and show that our approach is effective in predicting the next event that will occur on a machine with a precision of up to 0.93. We also show that the models learned by Tiresias are reasonably stable over time, and provide a mechanism that can identify sudden drops in precision and trigger a retraining of the system. Finally, we show that the long-term memory typical of RNNs is key in performing event prediction, rendering simpler methods not up to the task.