Graph Neural Networks for Threat Intelligence and Cyber-Attack Path Prediction

Abstract

Graph Neural Networks (GNNs) have become a potent paradigm of complex data related to relations, and it is especially applicable to threat intelligence analysis and prediction of cyber-attack lines. The proposed paper describes a GNN framework that combines the sources of heterogeneous cyber threat intelligence, including network topology, vulnerability graphs, historic attack data, in predicting potential arrangement of attacks within enterprise networks. The suggested model is the hosts, vulnerabilities, and exploits as nodes, communication relationship and exploitability between the two nodes. Two benchmark data sets were experimentally tested and a synthetic enterprise network with 5,000 nodes and 18,200 edges was investigated. Findings indicate the proposed GNN model yields an attack path prediction rate of 91.3, which is higher than the conventional methods that utilize graph-based heuristics (91.3) and recurrent neural networks baselines (84.1). The model also lowers ratio of false positive prediction by 27.4 percent and ratio time to detect (MTTD) is enhanced by 32.8 percent over system ruled based predictions. Other ablation studies suggest that addition of vulnerability severity scores and temporal threat indicators enhance F1-score increasing to 0.92. The results indicate that GNNs are efficient in modeling structural and dynamic user behavior in a cyber setting. The suggested solution will aid in proactive defense as it will allow security analysts to predict the activity of attackers and give more priority to the mitigation measures, which will lead to the improvement of the overall cyber resilience.