A graph neural network-based method for enterprise network lateral movement detection

Abstract

A hierarchical attention-based graph neural network is introduced to address the challenge of detecting lateral movement within large-scale enterprise networks. By representing users, hosts, and endpoint devices as nodes and encoding authentication and communication events as edges, the proposed framework captures both structural and semantic relationships critical for attack path identification. The multi-layer attention mechanism is used to adaptively focus on the salient features and dependencies in the heterogeneous enterprise graph. This enables local and global context modeling. Experimental evaluation on benchmark intrusion detection datasets and real enterprise log data shows that the method greatly improves the detection accuracy and robustness. The method improves detection accuracy and robustness compared to established baselines including LSTM, GCN, and random forest. The method consistently outperforms traditional methods in F1 score and AUC, while maintaining a low false positive rate and efficient inference suitable for real-time deployment. Further analysis confirms the system's sensitivity to structural noise and adversarial perturbations, and highlights its applicability in operational security monitoring. The results show that combining hierarchical attention with graph-based modeling can provide a scalable and accurate solution for enterprise lateral movement detection. This pushes the state-of-the-art in cybersecurity analytics.