  Attack paths are the potential chain of malicious activities an attacker
performs to compromise network assets and acquire privileges through exploiting
network vulnerabilities. Attack path analysis helps organizations to identify
new/unknown chains of attack vectors that reach critical assets within the
network, as opposed to individual attack vectors in signature-based attack
analysis. Timely identification of attack paths enables proactive mitigation of
threats. Nevertheless, manual analysis of complex network configurations,
vulnerabilities, and security events to identify attack paths is rarely
feasible. This work proposes a novel transferable graph neural network-based
model for shortest path identification. The proposed shortest path detection
approach, integrated with a novel holistic and comprehensive model for
identifying potential network vulnerabilities interactions, is then utilized to
detect network attack paths. Our framework automates the risk assessment of
attack paths indicating the propensity of the paths to enable the compromise of
highly-critical assets (e.g., databases) given the network configuration,
assets' criticality, and the severity of the vulnerabilities in-path to the
asset. The proposed framework, named SPGNN-API, incorporates automated threat
mitigation through a proactive timely tuning of the network firewall rules and
zero-trust policies to break critical attack paths and bolster cyber defenses.
Our evaluation process is twofold; evaluating the performance of the shortest
path identification and assessing the attack path detection accuracy. Our
results show that SPGNN-API largely outperforms the baseline model for shortest
path identification with an average accuracy >= 95% and successfully detects
100% of the potentially compromised assets, outperforming the attack graph
baseline by 47%.
