Automated Anomaly Detection and Mitigation in Post-Exploit Lateral Movement via Hybrid Graph Neural Network & Reinforcement Learning

**Abstract:** Re-entry attacks, specifically lateral movement after initial exploitation, pose a significant and evolving security threat. Traditional intrusion detection systems often struggle with the dynamic and obfuscated nature of these post-exploitation activities. This paper proposes a novel, fully automated system for detecting and mitigating anomalous lateral movement behaviours utilizing a Hybrid Graph Neural Network (HGNN) integrated with a Multi-Agent Reinforcement Learning (MARL) module. The system leverages network traffic analysis, endpoint telemetry, and process behaviour graphs to identify deviations from established baselines, enabling proactive mitigation strategies before significant data exfiltration or system compromise occurs. Demonstrating a 35% improvement in early detection rates and 18% reduction in attack propagation compared to existing signature-based and statistical anomaly detection techniques, this approach facilitates rapid response and minimizes breach impact.