Pro-ZD: A Transferable Graph Neural Network Approach for Proactive Zero-Day Threats Mitigation

Technical Summary: Pro-ZD: A Transferable Graph Neural Network Approach for Proactive Zero-Day Threats Mitigation

1. Problem Statement

Modern enterprise networks are increasingly dynamic due to cloud integration, remote work, and Bring-Your-Own-Device (BYOD) trends. While automation is used to generate firewall rules and Zero-Trust (ZT) policies, this automation introduces the risk of misconfigurations that can expose critical assets.

The core challenge is the threat of zero-day attacks—exploits targeting undisclosed vulnerabilities. Traditional defense mechanisms (like attack graphs) struggle because:

• Lack of Adaptiveness: They require manual regeneration whenever the network structure changes.
• Information Asymmetry: Defenders cannot predict unknown vulnerabilities.
• Reactive Nature: Most tools focus on detection rather than proactive, automated mitigation.
• GNN Limitations: Existing Graph Neural Networks often fail to capture "positional information," meaning nodes with similar local neighborhoods but different global positions are treated identically.

2. Methodology

The authors propose Pro-ZD, a framework designed for the autonomous identification and mitigation of high-risk connections. The methodology is divided into three main components:

A. GraphWSP (The Core GNN Model):
To solve the positional information problem, the authors introduce GraphWSP (Weighted Shortest Path GNN), an extension of their previous SPGNN work.

• Shortest Path Prediction: It uses an inductive GNN to predict the shortest path distance from any node to a set of "anchor nodes" (critical assets).
• Weighted Path Integration: It incorporates a stacked Graph Attention Network (GAT). Unlike standard GNNs, this GAT uses an attention mechanism to prioritize edges along the path to critical assets, specifically accounting for edge weights (representing connection compliance).
• Inductive Learning: Because it learns structural patterns rather than fixed inputs, it can generate embeddings for previously unseen nodes/networks without retraining the entire model.

B. Feature Extraction:
The framework utilizes two types of features:

• Directly Encoded (FD): IP ranges, open port counts, asset criticality, and Application Criticality (AC)—a novel metric evaluating the potential damage if a specific application fails.
• Structure-Based (FS): A feature (FS1) derived from GraphWSP that measures the "exploitability" of a path based on its length and the number of non-compliant edges.

C. Risk Triage and Proactive Mitigation:
The system employs a DNN Edge Classifier to categorize connections as either "Non-compliant critical" or "Safe." If a connection is flagged as high-risk, the framework autonomously adjusts firewall rules and ZT policies to disrupt the path to critical assets without disrupting overall network functionality.

3. Key Contributions

• Novel Architecture (GraphWSP): A transferable GNN model capable of calculating weighted shortest paths, overcoming the limitations of existing models like SPAGAN.
• Proactive Defense Framework: A complete pipeline that moves from risk assessment (identifying paths) to autonomous mitigation (adjusting policies).
• Addressing Zero-Day Threats: Instead of trying to identify unknown vulnerabilities, the model focuses on mitigating the connectivity that allows those vulnerabilities to be reached, effectively neutralizing the threat vector.
• Data Augmentation Technique: Using overlapping sub-graphs to improve the model's ability to learn local structural interactions.

4. Experimental Results

The authors evaluated Pro-ZD using both synthetic (STD) and real-world (RTD) datasets from a law firm and a university.

• GraphWSP Performance: In a transductive setting, GraphWSP significantly outperformed the state-of-the-art SPAGAN model. In transfer learning (inductive) settings, GraphWSP achieved an average precision of over 75%, whereas SPAGAN dropped to 21%.
• Pro-ZD End-to-End Accuracy: The framework achieved over 95% average accuracy in detecting high-risk connections.
• Robustness: The model demonstrated high performance in both semi-supervised and self-supervised (transfer learning) settings, proving it can be trained on one network and successfully deployed on a completely different, unseen network.

5. Significance

Pro-ZD represents a paradigm shift from reactive detection to proactive, autonomous mitigation. By focusing on the reachability of critical assets rather than the signature of a specific attack, the framework provides a robust defense against zero-day exploits. Its ability to adapt to dynamic network changes through inductive learning makes it highly practical for modern, evolving enterprise environments.