A set and a second set of collections of forecasted feature vectors are selected from a repository for a future time window, a cyber-attack being in progress in a data processing environment at the present time, a collection in the set and a collection in the second set indicating an event related to the cyber-attack in a first region and a second event in a second region, respectively, of the environment at a discrete time. The events corresponding to the collections are classified, using an LTSM network, into a class of cyber-attack. From a mapping between a set of phases of the cyber-attack and a set of classes, a phase that corresponds to the class is predicted as likely to occur during the future time window in the region.