GAP-Net: A Temporal Graph Neural Framework for Predictive Attack Path Forecasting in Enterprise Networks
Year: 2026
Type: conference-paper
Abstract: Predicting multi-stage attacker movement in enterprise networks is an important step to be proactive in the cyber defence, but current approaches find it difficult to model the structural and temporal complexity of real-life attack movement. This paper introduces GAP-Net, which builds a framework to predict next step and multi step attacker actions based on attention-driven message passing, temporal graph snapshots, and structured path decoder. The model is tested over two real-world data-sets, i.e., DARPA TC Engagement dataset and LANL Cyber Security dataset and showcases its superior performance than GCN, GAT, GraphSAGE, and LSTM baselines. We find that on the DARPA dataset, GAP-Net achieves an accuracy of 0.91, precision of 0.90, recall of 0.88 and F1-score of 0.89; and achieves Top-1, Top-3, Top-5 and Top-10 path prediction accuracies of 0.62, 0.78, 0.84 and 0.91, respectively. Ablation studies emphasise the dependency of each architectural component as removal of attention causes 0.87 accuracy, removal of structured path decoder gives 0.75 Top-5 accuracy and lastly, eliminating temporal context decreases accuracy to 0.82 in total accuracy. These results demonstrate that GAP-Net can indeed be used to capture dynamic patterns of adversary behavior while giving reliable ranked predictions of future attacker behavior. The results highlight the possibilities of GNN-based predictive models for improved threat hunting, threat Defence action priority, as well as early warning function in enterprise security operation support.
Language: English
Subfield: Computer Networks and Communications
Field: Computer Science
Domain: Physical Sciences
Open Access status: hybrid
OpenAlex ID: W7171507828