One of the most important pieces of the modern cyberattacks is lateral movement the ability to move around connected systems after the initial compromise and gain access to high-value organizational assets. Conventional approaches to intrusion detection often fail to recognize the sophisticated attack behaviors while being relatively ineffective in detecting relationships among the entities of the network and their communication pattern. This paper introduces a lateral movement detection framework based on a graph neural network (GNN) that represents network traffic as graph-structured data to maintain the relationship among hosts, connections, and communication flows. The proposed system includes the use of advanced graph learning architectures like Graph Convolutional Networks (GCN), Graph Attention Networks (GAT), and GraphSAGE in learning and training the network on the network traffic data for attack classification and anomaly detection, with normal and multiple attack classes. A thorough preprocessing pipeline is used to generate feature encoding and normalization and to construct the graph from the raw traffic data, yielding meaningful graphs for deep learning. It's embedded in a web app built with Flask, which provides real-time prediction, visualization, model comparison, and security analytics via an interactive dashboard. Nevertheless, the attempts to solve problems with graph-based learning models have been proven to be able to effectively detect malicious behavior and differentiate between various types of attacks by using only node attributes or structural relationships. The developed system provides an intelligent and scalable cybersecurity solution to improve the monitoring of networks, identify threats, and provide proactive defenses against lateral movement activities in today's enterprise environments.
Ouku Bhulakshmi, Nagari Kavya Sree, M. Subramanyam et al.· 2026 International Conferenc...· 0 citations
In this paper, an intelligent cyber threat intelligence framework involving automated vulnerability severity assessment, contextual risk interpretation and generation of mitigation recommendation is presented. The proposed system has been designed to analyze the CVE-related description of vulnerabilities and the security metadata related to them, classify the level of severity of the threat and estimate its relevance to risk with the help of a transformer-based natural language processing model. To build contextual awareness beyond classification, it adds a retrieval-augmented mechanism to recognize semantically similar vulnerability records for contextual evidence-based threat interpretation. It is additionally fortified with vulnerability analysis, like CVE retrieval, client qualifications, record following, and even visualisation as a web application platform. The two processes, one involving the severities of the transformers, and the other the retrieval of threat intelligence and mitigation advice, into a single operational flow, thus reducing the manual reliance on Vulnerability Triage and aiding security analysts in prioritizing cyber risks. The proposed framework allows for the automatic processing of textual information on vulnerabilities and the comparison of such information and a contextual analysis with previous vulnerabilities discovered. Unlike conventional vulnerability assessment approaches that perform severity classification independently of contextual threat interpretation, the proposed framework integrates transformer-based semantic analysis, retrieval-augmented vulnerability intelligence, cyber-risk estimation, and mitigation recommendation generation within a unified analytical workflow. By combining predictive language modelling with contextual vulnerability retrieval, the framework supports evidence-driven cyber threat analysis and structured decision support for security analysts. The proposed architecture provides a scalable approach for automated vulnerability prioritization and contextual cyber threat intelligence that is suitable for modern cybersecurity operations involving large volumes of vulnerability reports.
Someru Kuruva Giriraju, Shaik Khaja Baba, F. Mahammad et al.· 2026 International Conferenc...· 0 citations
As MNI becomes increasingly vulnerable to new kinds of attacks from the cyber world, accurate and timely detection of intrusions becomes a primary key to the power of cybersecurity. More complex attack patterns, complex traffic interactions within large scales are not very collaborable with the typical signature-based detection methods. A Transformer Based Network Anomaly Detection System for intelligent cyber security monitoring based on network flow analysis (NFAs) is proposed in the paper. This framework is derived from the CICIDS2017 data-set and proposes 78 of the statistical flow characteristics, where each flow characteristic impacts the behaviour of a packet, protocol, volume of traffic and temporal communication pattern. The model uses a Transformer Encoder network architecture along with multiple heads of self-attention, which provides greater understanding to deal with complex relationships between features from network traffic. LabelEncoder and StandardScaler have been applied to the columns with values that need to be encoded for categorical variables and scaled to fit the values for models training. A trained model is then applied to progress multiple different categories of cyberattacks including DDoS attacks, PortScan, Brute Force, Botnet, Web Based, etc. and different kinds of traffic, all traffic is considered benign traffic. For providing real-time predictions, confidence interval, prediction of class severity and alerts using trained model an API developed on flask to connect the trained model to a dashboard was built. The experimental results show that the Transformer-based learning could be very effective in achieving successful capturing of the network behavior and conducting realistic detection. The overall proposed system offers an intelligent, scalable and deployment-centric approach to improve the monitoring and proactive detection of threats in contemporary networks in the field of cybersecurity.
S. Nagendrudu, Shaik Mohammed Anays, F. Mahammad et al.· 2026 International Conferenc...· 0 citations