We propose a Recursive Stochastic Tensor Estimation (RSTE) framework for modeling user behavior in cyber-affected traffic distribution systems. Conventional Markov chain models assume static transition probabilities, which fail to capture the dynamic nature of cyber threats. To address this limitation, we introduce a time-varying third-order transition tensor that evolves via an online stochastic approximation algorithm. The tensor encodes transition probabilities between behavioral states as functions of both time and a latent cyber-risk context vector, which is derived from real-time network anomaly signals. A Robbins-Monro procedure updates the tensor upon each observed user transition, with an adaptive damping factor that attenuates noise from false positive anomaly signals while preserving sensitivity to genuine cyber events. The update is focused on the context dimension most activated by the current threat environment, thereby enabling efficient learning under non-stationary conditions. The estimated tensor is then marginalized across context dimensions to produce a time-varying equilibrium distribution, which directly informs traffic distribution optimization and risk assessment. The anomaly signals themselves are generated by a Transformer-encoder pre-trained on the CICIDS2017 dataset and fine-tuned with a supervised contrastive loss. This encoder processes aggregated NetFlow records to produce a 16-dimensional anomaly vector. The RSTE framework integrates seamlessly with existing user classification and traffic logging modules, and its outputs feed into a utility function that balances bandwidth utilization, latency, and cyber risk costs. The primary contribution is a principled, mathematically grounded method for recursively estimating non-stationary Markov dynamics under cyber perturbations, without requiring explicit labeling of attack types. This work therefore provides a novel analytical tool for operators to dynamically adjust traffic distribution strategies in response to evolving cyber threats.