Abstract: Aspects of the subject disclosure may include, for example, obtaining data that identifies network traffic associated with a threat actor, responsive to the obtaining the data, performing feature extraction on the data, resulting in extracted features, classifying the network traffic based on the extracted features, detecting, in accordance with the classifying the network traffic, an action change in the network traffic, resulting in a detected action change, predicting a future traffic profile for the threat actor based on the detected action change, and responsive to the predicting the future traffic profile, generating an alert regarding the future traffic profile, thereby enabling mitigation of a security risk associated with the threat actor. Other embodiments are disclosed.