GAT-APG: Graph Attention Network-Based Attack Path Generation for Security Simulation

As network system complexity increases through the integration of diverse technologies, attackers employ increasingly sophisticated strategies that challenge traditional static defense approaches. The need for adaptive security assessment methods has become critical, particularly in dynamic environments where network topologies and configurations change frequently. Existing attack path generation methods face limitations in dynamic simulation environments, particularly their reliance on static network models and computational inefficiencies that complicate security assessment in evolving network topologies. This study proposes a reinforcement learning-based framework that combines GAT with policy gradient methods to improve attack path generation for simulation-based security assessment. Our approach employs a node-centric vulnerability assessment methodology that transforms network traffic data into vulnerability metrics, potentially reducing the need for complete recalculation when network configurations change. The GAT architecture uses multi-head attention mechanisms to capture complex node interdependencies, while the reinforcement learning component optimizes path selection through policy gradient techniques. Experimental validation using both controlled sample graphs and the Kyoto dataset demonstrates promising performance: achieving up to 93% accuracy compared to brute-force methods in moderately connected networks, and showing 69.1% exact matches with 15.9% superior paths compared to Dijkstra’s algorithm on real-world network topologies derived from historical traffic data. The framework provides a simulation-ready environment that enables pre-deployment vulnerability assessment, automated red-team exercises, and defensive resource optimization through realistic attack path modeling. While performance degrades in highly complex networks, the framework shows potential to enhance vulnerability assessment and defensive planning in simulation environments, particularly for applications that require adaptive attack path modeling without complete graph reconstruction.