Article · Computers · July 24, 2025

A Hybrid Approach Using Graph Neural Networks and LSTM for Attack Vector Reconstruction

Yelizaveta Sergeevna Vitulyova, Тетяна Василівна Бабенко, Kateryna V. Kolesnikova, Nikolay A. Kiktev, Olga Abramkina

Abstract

The escalating complexity of cyberattacks necessitates advanced strategies for their detection and mitigation. This study presents a hybrid model that integrates Graph Neural Networks (GNNs) with Long Short-Term Memory (LSTM) networks to reconstruct and predict attack vectors in cybersecurity. GNNs are employed to analyze the structural relationships within the MITRE ATT&CK framework, while LSTM networks are utilized to model the temporal dynamics of attack sequences, effectively capturing the evolution of cyber threats. The combined approach harnesses the complementary strengths of these methods to deliver precise, interpretable, and adaptable solutions for addressing cybersecurity challenges. Experimental evaluation on the CICIDS2017 dataset reveals the model’s strong performance, achieving an Area Under the Curve (AUC) of 0.99 on both balanced and imbalanced test sets, an F1-score of 0.85 for technique prediction, and a Mean Squared Error (MSE) of 0.05 for risk assessment. These findings underscore the model’s capability to accurately reconstruct attack paths and forecast future techniques, offering a promising avenue for strengthening proactive defense mechanisms against evolving cyber threats.

Network Security and Intrusion DetectionInformation and Cyber SecurityAdversarial Robustness in Machine Learninggraph neural networksLSTMMITRE ATT&CK

A Hybrid Approach Using Graph Neural Networks and LSTM for Attack Vector Reconstruction

Abstract

More by Kateryna Kolesnikova