OCCAM Detection Overview

OCCAM has two stages. The classifier scores each 15-minute asset window into one of 13 ATT&CK tactics (Benign + 12 attack stages). The predictor runs a Hidden Markov Model over the resulting token sequence, predicts Benign by default, and treats prediction failure as the pre-intrusion signal.

Predictor Status

Self-commissioning state machine: Accumulating → Activating → Active. The predictor self-deactivates to Degraded if its confirmation rate drops below threshold.

Pre-Intrusion Alerts

High-surprisal observations in progressive attack sequences. Each row is an assessed-probable intrusion in progress — acted on before the attacker achieves objective.

Viterbi State Paths

The most-likely hidden-state paths decoded from observed token sequences. This is the explainable-AI output that satisfies DoD XAI requirements — every prediction can be traced back to the specific ATT&CK tactic progression that drove it.

Detection Timeline

Detections by ATT&CK Tactic

Dispositions Breakdown

Each token observation is classified into one of four dispositions based on the surprisal score and the surrounding sequence context.

Detections by Segment

Most Anomalous Assets

False Positive Suppression

Recurring patterns the predictor has classified as legitimate. If a suppressed pattern deviates from expected resolution, it escalates to a high-priority alert.