Implementation - GNN Based Threat Path Forecasting

I am currently working on my final year major project and require assistance with the implementation.

The project focuses on “Predictive Threat Path Modeling using Graph Neural Networks (GNN) for Lateral Movement Forecasting.”

Core Concept:
We aim to utilize a cybersecurity dataset (such as CICIDS2017 or another relevant dataset) containing both normal and malicious traffic logs. This raw data will be transformed into a graph-based representation where:

Nodes represent hosts, systems, or users

Edges represent network interactions or security events

On top of this graph, a GNN model will be employed to learn node and edge embeddings. To capture sequential attack behavior, the GNN output will be integrated with an RNN/LSTM model, which will then be used to anticipate the next potential attack step (i.e., lateral movement within the network).

Planned Workflow:

Data Preparation – Clean and process the dataset, then map it into a graph structure.

Model Development – Build a hybrid architecture combining GNN (for structural learning) and RNN/LSTM (for temporal prediction).

Model Training & Evaluation – Train on labeled data and validate using performance metrics such as accuracy, precision, and recall.

Result Generation – Output predictions in both CSV and JSON formats, highlighting likely next hops and security alerts.

Project Documentation – Deliver a detailed report, presentation slides, and code explanation.

Deliverables:

Complete implementation code (Python using PyTorch Geometric or DGL)

Data preprocessing scripts

Generated outputs (CSV + JSON)

Documentation, PPT, and final report for academic submission

Step-by-step guidance on execution and usage of the project