MTS Bank deploys graph neural networks to combat cyberattacks

MTS Bank has introduced graph neural networks to detect intrusions into its infrastructure. The bank's ensemble of neural networks identifies over 90% of hacker movement scenarios inside the network that are invisible to classic security systems, as reported by CNews. Modern cyberattacks use a living-off-the-land approach, where attackers mimic administrator behavior, using legitimate accounts and standard protocols to go unnoticed for months or years. The graph-based solution analyzes relationships between accounts, servers, and sessions, revealing attacks through chains of atypical transitions. The ensemble comprises five specialized models, each catching a different type of anomaly, and together they rarely fail. The pilot over a year's data detected more than 90% of 'white' hacker movement vectors, and all 22 penetration tests and one Red Team exercise were caught during the lateral movement stage. Graph neural networks complement traditional defenses like firewalls and antivirus systems, filling their blind spots. MTS Bank plans to scale the solution across its entire infrastructure and develop the graph approach with the information security community.