In today's enterprise network landscape, the combination of perimeter and distributed firewall rules governs connectivity. To address challenges arising from increased traffic and diverse network architectures, organizations employ automated tools for firewall rule and access policy generation. Yet, effectively managing risks arising from dynamically generated policies, especially concerning critical asset exposure, remains a major challenge. This challenge is amplified by evolving network structures due to trends like remote users, bring-your-own devices, and cloud integration. This paper introduces a novel graph neural network model for identifying weighted shortest paths. The model aids in detecting network misconfigurations and high-risk connectivity paths that threaten critical assets, potentially exploited in zero-day attacks -- cyber-attacks exploiting undisclosed vulnerabilities. The proposed Pro-ZD framework adopts a proactive approach, automatically fine-tuning firewall rules and access policies to address high-risk connections and prevent unauthorized access. Experimental results highlight the robustness and transferability of Pro-ZD, achieving over 95% average accuracy in detecting high-risk connections. \

翻译：在当今的企业网络环境中，边界防火墙与分布式防火墙规则的组合共同管理着网络连通性。为应对流量增长和网络架构多样化带来的挑战，组织通常采用自动化工具来生成防火墙规则和访问策略。然而，如何有效管理由动态生成策略（尤其是涉及关键资产暴露的策略）所引发的风险，仍然是一个重大挑战。远程用户、自带设备以及云集成等趋势导致网络结构不断演变，进一步加剧了这一挑战。本文提出了一种新颖的用于识别加权最短路径的图神经网络模型。该模型有助于检测网络配置错误以及威胁关键资产的高风险连通路径，这些路径可能在零日攻击（即利用未公开漏洞的网络攻击）中被利用。所提出的Pro-ZD框架采用主动式方法，能够自动微调防火墙规则和访问策略，以处理高风险连接并防止未授权访问。实验结果凸显了Pro-ZD的鲁棒性和可迁移性，其在检测高风险连接方面实现了超过95%的平均准确率。