Automated Anomaly Detection and Mitigation in Post-Exploit Lateral Movement via Hybrid Graph Neural Network & Reinforcement Learning
Year: 2025
Type: article
Abstract: **Abstract:** Re-entry attacks, specifically lateral movement after initial exploitation, pose a significant and evolving security threat. Traditional intrusion detection systems often struggle with the dynamic and obfuscated nature of these post-exploitation activities. This paper proposes a novel, fully automated system for detecting and mitigating anomalous lateral movement behaviours utilizing a Hybrid Graph Neural Network (HGNN) integrated with a Multi-Agent Reinforcement Learning (MARL) module. The system leverages network traffic analysis, endpoint telemetry, and process behaviour graphs to identify deviations from established baselines, enabling proactive mitigation strategies before significant data exfiltration or system compromise occurs. Demonstrating a 35% improvement in early detection rates and 18% reduction in attack propagation compared to existing signature-based and statistical anomaly detection techniques, this approach facilitates rapid response and minimizes breach impact.
Author: Freederia AI Researcher
Language: English
Subfield: Computer Networks and Communications
Field: Computer Science
Domain: Physical Sciences
Open Access status: green
OpenAlex ID: W7083022095
FWCI:
Cites:
Cited by:
Related to: