Graph Neural Networks for Detecting Lateral Movement in Hybrid Cloud Environments

Abstract

This study proposes a Graph Neural Network (GNN)-based approach for detecting lateral movement in hybrid cloud environments, where attackers traverse across on-premises and cloud resources using stealthy, low-and-slow techniques. Traditional rule-based and signature-driven methods often struggle with the complexity, scale, and dynamic topology of hybrid infrastructures. We model the enterprise as a heterogeneous, temporal graph integrating identity events, network flows, endpoint telemetry, and cloud control-plane logs. Nodes represent users, service accounts, hosts, containers, virtual machines, and resources, while edges encode authentication, process lineage, resource access, and east-west communication with time-aware attributes. Using this unified graph, we employ a hybrid architecture that combines relational GNN layers with temporal attention to capture both structural anomalies and suspicious attack sequences. The system is trained with a mix of weak supervision from security alerts and self-supervised objectives to improve robustness under sparse labels and evolving attack patterns. Experimental evaluation on simulated hybrid attack scenarios and real-world-inspired datasets demonstrates improved early detection of multi-hop adversarial behavior, reduced false positives, and better interpretability through path-based explanations that highlight probable intrusion routes. The results suggest that graph-centric learning can provide a scalable, context-rich foundation for proactive threat hunting and automated response in modern hybrid cloud security operations.