Frostbow Proof: Predicting Unseen Attack Variants

The result

Frostbow predicted real attack variants it was never trained on.

We showed the system one set of real attacks, then held back a completely separate set of recordings. From what it learned, it predicted attack patterns that were waiting in the held-out set — new combinations of attack components it had already seen, not new tools or techniques — at 10.0× the rate of chance (10 correct vs about 1.0 expected by guessing).

A concrete case you can check

It recombined two things it had seen into a pairing it never had — and that pairing was real.

The system had seen explorer.exe started in one context, and had separately seen wmiprvse.exe used to start other programs. It had never seen those two together. From the two halves it predicted the combination — explorer.exe started by wmiprvse.exe — and that exact pairing was waiting in a recording we held back.

Component it was shown

explorer.exe

started by userinit.exe

Component it was shown

cmd.exe

started by wmiprvse.exe

→

Combination Frostbow predicted (never seen as a pair)

explorer.exe

started by wmiprvse.exe
(Windows WMI — a remote-execution launch method)

→

Found in held-out data

Confirmed

present in a recording the system never trained on: Lateral Movement/LM_wmi_PoisonHandler_Mr-Un1k0d3r_sysmon_1_13.evtx

Why this counts as genuine novelty: both halves appeared in training (explorer.exe and wmiprvse.exe), but the pairing never co-occurred in any training recording — so the prediction is a new combination of known components, not a memorised one. Tokens are shown raw so the case is checkable against the recordings (EVTX-ATTACK-SAMPLES).

What this means: a skeptic can check this single case end-to-end — the two components it learned from, the combination it predicted, and the held-out recording where that combination actually appears. It wasn't told this pairing existed; it worked it out. This is combinatorial foresight — new arrangements of known pieces — not a claim of predicting wholly new tradecraft.

The receipts — why this isn't luck

It beats chance by 10.0×. Here is the comparison, in the open.

Frostbow (learned structure)

10 correct

Chance — guess by perturbing a known attack

1.0

Chance — random pieces, no structure

0.0

Both "chance" rows draw on the same building blocks Frostbow had. Random recombination with no learned structure predicts 0.0 — it is the learned structure, not the vocabulary, that does the predicting.

56

attack recordings used to learn

29

separate recordings withheld entirely

10

unseen variants correctly predicted

10.0×

better than the chance baseline

6 of 10

were behaviour-level novel — a process+parent pairing that never co-occurred in training

What makes this a fair test: we withheld whole attack recordings, not random rows — so the held-out attacks are genuinely unseen, not near-copies of training data. Of the 10 correct predictions, 6 were combinations that had never co-occurred in any training recording (the rest reused a pairing the system had seen). The method, the split, and the chance baseline are all stated here — nothing is hidden.

The honest limits — this is measurement, not marketing

The 29 withheld recordings contain 79 distinct attack patterns; the counts below refer to attack patterns, not recordings.

The novelty is combinatorial, not wholly new tradecraft. What it predicts are new combinations of attack components it has already seen — not new tools, exploits, or techniques. That is a real and useful capability, and it is also the exact boundary of the claim: it does not foresee an attacker's never-before-seen invention.

It is a hypothesis generator, not an oracle. It casts a wide net: of the 1266 leads it raised, most are possibilities to watch for, not certainties. Each lead only nudges up the monitoring weight on an endpoint — it consumes no analyst time and carries near-zero cost per lead, so the volume is the point, not a burden: a wide net is how a generator surfaces the few real unseen attacks. The point is that it is right about which unseen attacks actually exist far more often than chance — it tells you where to look. Coverage is partial and grows as more fleet-relevant attack data is learned.

It can only predict variants built from pieces it has seen. Of the 79 held-out attacks, 19 were built from components the system had encountered before; the other 60 used a genuinely new tool, which is beyond any system of this kind. Among the ones it could reach, it anticipated 52.6%. More attack data closes that gap directly.

What this means: stating these limits is the proof this is a real, audited measurement rather than a marketing number. The claim at the top is exactly as strong as the evidence below it — no more, no less.

Foresight — Evidence