Zero-Trust Graph Neural Networks: Dynamic Lateral Movement Detection and Attack Path Reconstruction in Hybrid Cloud Infrastructure

Abstract

Modern enterprise enterprise cloud ecosystems face severe security risks from Advanced Persistent Threats (APTs) and sophisticated lateral movement techniques that evade traditional signature-based Intrusion Detection Systems (IDS). Under the Zero-Trust Architecture (ZTA) paradigm, continuous authentication and microscopic behavioral verification are required across every entity and communication flow. However, modeling the high-velocity, heterogeneous provenance graphs generated by millions of cloud events in real time presents immense computational and algorithmic hurdles. In this paper, we propose ZT-GNN (Zero-Trust Graph Neural Network), a novel dynamic spatio-temporal graph neural network engineered for continuous lateral movement detection and automated attack path reconstruction. ZT-GNN maps cloud microservices, identity access management (IAM) roles, container runtimes, and VPC network flows into dynamic multi-relational heterogeneous provenance graphs. Utilizing a temporal edge-gated attention convolution mechanism with adaptive topological decay, ZT-GNN captures subtle privilege escalation cascades and stealthy lateral transitions across enterprise hybrid clouds. We evaluate ZT-GNN on the DARPA Transparent Computing (THEIA and CADETS) benchmarks and a large-scale real-world hybrid cloud telemetry dataset (CIC-IDS2018 + CloudTrail logs comprising over 42 million audit events). ZT-GNN achieves an exceptional F1-score of 98.4% and an ultra-low False Positive Rate (FPR) of 0.08%, outperforming baseline graph learning models (GCN, GraphSAGE, E-GraphSAGE) and industrial rule-based SIEMs by +14.2% in precision. Crucially, our automated attack graph backtracking reconstructs end-to-end APT breach chains in under 1.8 seconds, empowering security operations centers (SOC) with instantaneous threat mitigation.