A single threat family is still an abstraction. To see where a model actually earns its place in a real attack, it helps to break one attack into its stages. Lockheed Martin's Cyber Kill Chain, published in 2011 and still the most widely taught model of its kind, splits an intrusion into seven stages, borrowed deliberately from military targeting doctrine: an attacker must succeed at every stage in order, while a defender only has to break the chain once.
| Kill chain stage | Where a trained model helps |
|---|---|
| 1. Reconnaissance | Anomaly detection (Unit 3) flags unusual scanning or enumeration traffic before any exploit is attempted |
| 2. Weaponisation | Static malware classifiers (Unit 2, Unit 5) can flag a newly built payload before it is ever delivered, if it is submitted to a scanning service |
| 3. Delivery | Phishing and spam classifiers (Unit 1, Unit 5) are the most direct defence against the most common delivery channel, email |
| 4. Exploitation | Behavioural and host-based anomaly detection (Unit 3) can catch an exploit's side effects even when the exploit itself is unknown |
| 5. Installation | Malware classifiers (Unit 2, Unit 5) scanning newly written files or newly loaded processes |
| 6. Command and control (C2) | Network traffic feature engineering (Unit 5) plus anomaly detection (Unit 3) catch the regular, machine-like "beaconing" pattern C2 traffic tends to have |
| 7. Actions on objectives | Fraud detection and data-exfiltration anomaly scoring (Unit 2, Unit 3) are usually the last automated check before a human responder is paged |
Key takeaway
The kill chain reframes "where should we add machine learning" into a concrete question: which stage, for our specific environment, is cheapest to break with a model trained on data we can actually collect? A phishing classifier that stops delivery is usually far cheaper to operate than a classifier that only catches exfiltration after the data has already left the building.