Graph-based ransomware propagation modelling and early interception in enterprise networks using dynamic attack surface analysis

Ransomware incidents consistently bypass endpoint detection due to their rapid lateral movement through shared drives and remote services before detonating encryption payloads. Existing detection systems react to encryption activity rather than intercepting propagation. This study models enterprise network topology as a dynamic knowledge graph where node attributes represent device vulnerability scores and edge weights encode lateral-movement probability based on historical authentication logs. A graph attention network (GAT) trained on historical ransomware campaigns predicts high-risk propagation paths in real time, enabling proactive isolation of vulnerable nodes before encryption initiates. A simulation environment built on MITRE ATT&CK ransomware scenarios validates that the proposed interception strategy reduces the mean encrypted file value by 85% compared to endpoint-only detection (median reduction 98%, reflecting a heavy-tailed outcome distribution we characterise in full), even when encryption begins on the first affected host. We further report three results obtained for this extended study. First, the GAT already achieves a 76.2% reduction when trained on a single enterprise network and reaches 89.6% with four, after which it plateaus, indicating the learned propagation cues are not network-specific. Second, and most importantly for an adversarial domain, we introduce and evaluate an abstract “patient” attacker that delays visible encryption to deny the defender its primary dynamic signal: at short silent dwell the proposed defense retains a large advantage, but as the silent dwell grows all detonation-reactive defenses, including ours, converge toward the no-defense outcome, exposing a genuine and previously uncharacterised limitation of detection-triggered interception that we discuss together with complementary mitigations. Third, a GCN baseline slightly outperforms the GAT on interception (89% versus 85%) and an ensemble of the two performs best (91%), confirming that the gains come from the graph formulation and the isolation policy rather than from the attention mechanism itself. The model runs entirely on-premise with no dependence on external threat feeds. We position the contribution deliberately: rather than a new graph-neural-network primitive, it is a problem formulation (early interception as hidden-front prediction on a dynamic enterprise graph), a containment-aware isolation policy with proved structural guarantees, and, most importantly for an adversarial domain, a characterisation of when detonation-triggered defence works and when it provably fails against an adaptive, patient adversary. Ransomware propagation throughout is represented as an abstract probabilistic contagion on a graph.