Graph Neural Network based Lateral Movement Detection in Enterprise Network Traffic

Abstract

One of the most important pieces of the modern cyberattacks is lateral movement the ability to move around connected systems after the initial compromise and gain access to high-value organizational assets. Conventional approaches to intrusion detection often fail to recognize the sophisticated attack behaviors while being relatively ineffective in detecting relationships among the entities of the network and their communication pattern. This paper introduces a lateral movement detection framework based on a graph neural network (GNN) that represents network traffic as graph-structured data to maintain the relationship among hosts, connections, and communication flows. The proposed system includes the use of advanced graph learning architectures like Graph Convolutional Networks (GCN), Graph Attention Networks (GAT), and GraphSAGE in learning and training the network on the network traffic data for attack classification and anomaly detection, with normal and multiple attack classes. A thorough preprocessing pipeline is used to generate feature encoding and normalization and to construct the graph from the raw traffic data, yielding meaningful graphs for deep learning. It's embedded in a web app built with Flask, which provides real-time prediction, visualization, model comparison, and security analytics via an interactive dashboard. Nevertheless, the attempts to solve problems with graph-based learning models have been proven to be able to effectively detect malicious behavior and differentiate between various types of attacks by using only node attributes or structural relationships. The developed system provides an intelligent and scalable cybersecurity solution to improve the monitoring of networks, identify threats, and provide proactive defenses against lateral movement activities in today's enterprise environments.