2026· International Conference on Software and Data Technologies· pp. 369-380· 0 citations· 18 references
Computer Science
TL;DR
TAE-MAGSAGE, an edge-centric graph learning model which uses the observed communication structure to construct graphs and applies a line graph transformation to perform flow-level classification without collapsing the interaction relationships, is introduced.
Abstract
: The modern network environment, whether enterprise systems or critical infrastructure, is increasingly exposed to sophisticated cyber threats that must be effectively detected. The existing GNN-based approaches construct graphs using feature-similarity heuristics, and connect flows that are statistically similar to one another but not necessarily communicating, hence capturing geometry specific to the dataset. On the other hand, communication topology is a representation of interaction patterns based on real network behaviour. We introduce TAE-MAGSAGE, an edge-centric graph learning model which uses the observed communication structure to construct graphs and applies a line graph transformation to perform flow-level classification without collapsing the interaction relationships. A Mahalanobis-inspired metric warp in message passing re-configures neighborhood similarity with respect to the discriminative feature dimensions, and a Ledoit–Wolf regularized Mahalanobis distance-based classifier learns class-conditional distributions to deal with severe class imbalance. TAE-MAGSAGE achieves an accuracy of 99.31% on the CIC-IDS-2017 dataset, macro F1 of 98.10%, and a false alarm rate of 0.56%, outperforming graph-based baselines. These results show that constructing graphs based on communication structure, combined with metric-conscious embedding and distribution-conscious classification, improves minority attack detection while reducing false alarms.
Graph Neural Networks achieve strong closed-set accuracy in network intrusion detection but cannot flag zero-day attacks, because the closed-world assumption forces every input into a known class. OpenMax adds an Extreme Value Theory reject option, yet its Euclidean distance ignores the class-conditional covariance that encodes attack-specific structure, which produces unreliable tail models and rejection thresholds. We propose MaGOS-IDS, which extracts topology-aware embeddings with an edge-aware GCN that fuses flow-level edge features directly into message passing, whitens each class with a regularized Mahalanobis distance so the reject decision respects per-class variance and correlation, and calibrates a per-class EVT tail on these distances to set an attack-pattern-aware rejection boundary without a hand-tuned cutoff. We provide a theoretical justification via a peaks-over-threshold argument: whitening removes the per-class covariance dependence of the distance tail, so a single extreme-value tail model calibrates consistently across classes. On three benchmarks (NF-BoT-IoT, CIC-IDS-2017, UNSW-NB15) under withheld zero-day families, MaGOS-IDS raises open-set AU-PR over the Euclidean OpenMax baseline (0.932 vs. 0.848 on UNSW-NB15) while adding negligible inference cost.
Thanh T. Nguyen, Minho Park· Electronics· 0 citations
Enterprise security demands actionable threat prioritization across heterogeneous environments. To address the limitations of siloed log analysis, we propose a multi-source, graph-based anomaly detection framework. First, our architecture seamlessly fuses network telemetry from Vectra, Security Information and Event Management (SIEM) logs from QRadar, and endpoint data from CrowdStrike into a unified graph. Second, we utilize the Louvain algorithm to segment the network, identifying functional communities and critical bridge nodes indicative of lateral movement. Third, we extract over 50 structural, behavioral, and temporal features to train an XGBoost-based ensemble classifier. Evaluated on a real-world banking dataset with 31 anomaly types, the proposed system achieves 98% precision. Crucially, empirical analysis reveals that local neighborhood connectivity and traffic dynamics significantly outperform traditional global centrality metrics in detecting complex attacks. Finally, to support operational incident response, we implement a dynamic risk-scoring mechanism that translates model predictions into actionable, IP-level severity assessments across sliding time windows. Ultimately, this framework substantially enhances comprehensive threat visibility and analyst efficiency.
Çagatay Ates, Ilgin Safak, Fatih Alagöz et al.· International Conference on...· 0 citations
GIC-IDS is proposed, a unified intrusion detection framework that integrates graph structure learning, information bottleneck, and contrastive learning that consistently outperforms representative baseline methods in terms of detection accuracy, robustness, and generalization capability.
Ya Guo, Junyi Wang, Boyu Liu et al.· Journal of Signal Processing...· 0 citations
Graph topology and model architecture are routinely co-designed in GNN-based fraud detection, making it impossible to attribute performance gains to either component. We address this by fixing the training loop, features, and evaluation protocol while independently varying the graph construction strategy and GNN architecture. Three strategies are evaluated: multi-relation temporal, hybrid structural similarity, and intra-group, each evaluated across three GNN architectures (GATv2, GCN, and GraphSAGE). A feature-identical MLP with no graph structure serves as an empirical anchor. On the Sparkov dataset, all three GNN strategies exceed the MLP by 5.0–9.7 F1 points, confirming that topology contributes genuine discriminative value when per-cardholder histories are dense. On the IBM dataset, the intra-group strategy collapses 6.9 F1 points below the MLP, a consequence of near-empty neighbourhoods (mean degree 1.1) following down-sampling, while multi-relation retains ranking advantages in AUC (Area Under the Curve; 0.985) and Average Precision (0.908) despite marginal F1 parity. Across both datasets, multi-relation temporal construction is the highest-performing strategy, achieving F1 0.908 and AUC 0.994 on Sparkov and F1 0.831 on IBM, though this ranking is not entirely architecture-independent: GraphSAGE narrowly inverts the multi-relation/intra-group order on Sparkov. These results suggest that graph construction quality, rather than mere graph presence, matters more for GNN performance than connectivity alone under the conditions evaluated here.
Roya Amiri, Sardar F. Jaf· Big Data and Cognitive Compu...· 0 citations
One of the most important pieces of the modern cyberattacks is lateral movement the ability to move around connected systems after the initial compromise and gain access to high-value organizational assets. Conventional approaches to intrusion detection often fail to recognize the sophisticated attack behaviors while being relatively ineffective in detecting relationships among the entities of the network and their communication pattern. This paper introduces a lateral movement detection framework based on a graph neural network (GNN) that represents network traffic as graph-structured data to maintain the relationship among hosts, connections, and communication flows. The proposed system includes the use of advanced graph learning architectures like Graph Convolutional Networks (GCN), Graph Attention Networks (GAT), and GraphSAGE in learning and training the network on the network traffic data for attack classification and anomaly detection, with normal and multiple attack classes. A thorough preprocessing pipeline is used to generate feature encoding and normalization and to construct the graph from the raw traffic data, yielding meaningful graphs for deep learning. It's embedded in a web app built with Flask, which provides real-time prediction, visualization, model comparison, and security analytics via an interactive dashboard. Nevertheless, the attempts to solve problems with graph-based learning models have been proven to be able to effectively detect malicious behavior and differentiate between various types of attacks by using only node attributes or structural relationships. The developed system provides an intelligent and scalable cybersecurity solution to improve the monitoring of networks, identify threats, and provide proactive defenses against lateral movement activities in today's enterprise environments.
Ouku Bhulakshmi, Nagari Kavya Sree, M. Subramanyam et al.· 2026 International Conferenc...· 0 citations
Intrusion Detection Systems (IDSs) based on traditional machine learning treat network flows as independent tabular samples, ignoring the relational and topological structure that characterizes modern distributed attacks. Graph Neural Networks (GNNs) overcome this limitation by modeling network topology, which in turn raise the need to make their predictions transparent. This work develops and compares traditional classifiers against a GNN-based IDS on the UNSW-NB15 dataset, for both binary and multiclass classification. A novel graph construction is proposed in which each node is an individual flow and edges are defined by temporal proximity through three complementary strategies (conversation chains and temporal k-NN by source and destination IP). Three GNN backbones—GraphSAGE, Graph Convolutional Network (GCN) and Graph Attention Network (GAT)—are trained under an identical, matched pipeline and a chronological, inductive evaluation protocol, so that any difference is attributable to the backbone alone. A two-stage classifier then separates detection from attack-type categorisation, with GNNExplainer providing interpretability, and SHAP applied to the traditional models. In binary classification, GraphSAGE achieves an Accuracy of 0.9906, Precision of 0.9856, Recall of 0.9998, F1-Score of 0.9927 and ROC-AUC of 0.9965, exceeding the traditional baselines in their conventional evaluation setting, while GCN and GAT reach comparable detection (F1 ≈ 0.99), showing that the temporal graph rather than the specific backbone drives detection. The explainability analysis identifies TTL-related and connection-state variables as dominant predictors and reveals attack-specific structural patterns, confirming that temporally structured GNNs improve detection while providing interpretable predictions.
Alberto Caballero Ferrero, Shadi Motaali, Xavier Larriva-Novo et al.· Electronics· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
