Generation of predictive cybersecurity data queries

A non-transitory computer readable medium comprising one or more sequences of instructions, which, when executed by a processor, causes a computing system to perform operations comprising:

• identifying, by the computing system, an evidence set associated with a detected cybersecurity attack, the evidence set comprising logs that include security alerts associated with the detected cybersecurity attack;
• analyzing, by the computing system, the evidence set to predict actions taken by a malicious actor by applying an influence model to the evidence set, wherein applying the influence model comprises propagating probabilities to historical actions and future actions based on the influence model, wherein the historical actions and the future actions comprise the actions taken by the malicious actor, and wherein the influence model comprises nodes representing attack steps, edges defining cause-and-effect transition directions between the attack steps, and each node is assigned a conditional probability table that describes a transition probability into the node from directly connected nodes;
• analyzing, by the computing system, the predicted actions to classify the historical actions and future actions taken by the malicious actor, by analyzing the predicted historical actions and the predicted future actions, using a graph, to classify attack sequences;
• generating, by the computing system, a query for analyzing the evidence set based on the classified historical actions and the future actions;
• pre-fetching, by the computing system, search results of one or more related queries;
• maintaining, by the computing system, the pre-fetched search results in memory;
• and
• executing, by the computing system, a search of generated query within a data repository and the memory.

A system comprising:

• a processor;
• and
• a memory having programming instructions stored thereon, which, when executed by one or more processors, causes the system to perform operations comprising:
• identifying an evidence set associated with a detected cybersecurity attack, the evidence set comprising logs that include security alerts associated with the detected cybersecurity attack;
• analyzing the evidence set to predict actions taken by a malicious actor by applying an influence model to the evidence set, wherein applying the influence model comprises propagating probabilities to historical actions and future actions based on the influence model, wherein the historical actions and the future actions comprise the actions taken by the malicious actor, and wherein the influence model comprises nodes representing attack steps, edges defining cause-and-effect transition directions between the attack steps, and each node is assigned a conditional probability table that describes a transition probability into the node from directly connected nodes;
• analyzing the predicted actions to classify the historical actions and the future actions taken by the malicious actor by analyzing the predicted historical actions and the predicted future actions, using a graph, to classify attack sequences;
• generating a query for analyzing the evidence set based on the classified historical actions and the classified future actions;
• pre-fetching, by the system, search results of one or more related queries;
• maintaining, by the system, the pre-fetched search results in memory;
• and
• executing, by the system, a search of generated query within a data repository and the memory.