Jul 2026· 2026 International Conference on Intelligent and Sustainable AI Systems (ICOSAAS)· pp. 451-460· 0 citations· 20 references
Abstract
One of the most important pieces of the modern cyberattacks is lateral movement the ability to move around connected systems after the initial compromise and gain access to high-value organizational assets. Conventional approaches to intrusion detection often fail to recognize the sophisticated attack behaviors while being relatively ineffective in detecting relationships among the entities of the network and their communication pattern. This paper introduces a lateral movement detection framework based on a graph neural network (GNN) that represents network traffic as graph-structured data to maintain the relationship among hosts, connections, and communication flows. The proposed system includes the use of advanced graph learning architectures like Graph Convolutional Networks (GCN), Graph Attention Networks (GAT), and GraphSAGE in learning and training the network on the network traffic data for attack classification and anomaly detection, with normal and multiple attack classes. A thorough preprocessing pipeline is used to generate feature encoding and normalization and to construct the graph from the raw traffic data, yielding meaningful graphs for deep learning. It's embedded in a web app built with Flask, which provides real-time prediction, visualization, model comparison, and security analytics via an interactive dashboard. Nevertheless, the attempts to solve problems with graph-based learning models have been proven to be able to effectively detect malicious behavior and differentiate between various types of attacks by using only node attributes or structural relationships. The developed system provides an intelligent and scalable cybersecurity solution to improve the monitoring of networks, identify threats, and provide proactive defenses against lateral movement activities in today's enterprise environments.
Graph Neural Networks (GNNs) have become a potent paradigm of complex data related to relations, and it is especially applicable to threat intelligence analysis and prediction of cyber-attack lines. The proposed paper describes a GNN framework that combines the sources of heterogeneous cyber threat intelligence, including network topology, vulnerability graphs, historic attack data, in predicting potential arrangement of attacks within enterprise networks. The suggested model is the hosts, vulnerabilities, and exploits as nodes, communication relationship and exploitability between the two nodes. Two benchmark data sets were experimentally tested and a synthetic enterprise network with 5,000 nodes and 18,200 edges was investigated. Findings indicate the proposed GNN model yields an attack path prediction rate of 91.3, which is higher than the conventional methods that utilize graph-based heuristics (91.3) and recurrent neural networks baselines (84.1). The model also lowers ratio of false positive prediction by 27.4 percent and ratio time to detect (MTTD) is enhanced by 32.8 percent over system ruled based predictions. Other ablation studies suggest that addition of vulnerability severity scores and temporal threat indicators enhance F1-score increasing to 0.92. The results indicate that GNNs are efficient in modeling structural and dynamic user behavior in a cyber setting. The suggested solution will aid in proactive defense as it will allow security analysts to predict the activity of attackers and give more priority to the mitigation measures, which will lead to the improvement of the overall cyber resilience.
D. Rajesh, Adamala Siri, Bandari Vyshnavi et al.· 2026 International Conferenc...· 0 citations
Purpose. To develop and evaluate a method for detecting anomalies in local network traffic based on the FCRNN-GRU architecture in order to improve classification accuracy and reduce the rate of false positive alerts.
Methodology. In the study, network interactions are represented as normalized time series, which makes it possible to capture the dynamics of traffic changes. The baseline model is a fully connected recurrent neural network capable of identifying complex nonlinear and long-term dependencies due to its densely connected recurrent structure. To improve training efficiency and avoid the vanishing gradient problem, mini-batch stochastic gradient descent is used. The additional integration of GRU (Gated Recurrent Unit) enables optimization of the trade-off between model accuracy and computational complexity. Experimental evaluation was conducted on a dataset of 52,000 network flows, including 32,000 normal traffic instances and 20,000 anomalous ones covering various types of cyber threats. The network environment was simulated on a Linux platform using Mininet and Wireshark, while algorithm implementation was carried out in Python.
Findings. The FCRNN-GRU model demonstrates high performance: detection rate – 98.59 %, false alarm rate – 5.29 %, and classification accuracy – 99.21 %. Compared to traditional and clustering-based methods, the proposed approach provides a significant improvement and confirms its effectiveness.
Originality. The scientific novelty of the study lies in the adaptation of a fully connected recurrent neural network with the integration of gated recurrent units for network traffic analysis tasks. The combination of dense recurrent connections with GRU mechanisms enables more accurate modeling of temporal patterns in traffic behavior, while simultaneously reducing computational costs and improving model efficiency when processing large volumes of data.
Practical value. The proposed approach has practical significance and can be integrated into modern monitoring and cybersecurity systems. Its application contributes to the timely detection of anomalous events in the network, enhances the level of information infrastructure security, and reduces risks associated with cyber threats.
O. Lebid, I. Chikov, S. Khrushchak et al.· Naukovyi Visnyk Natsionalnoh...· 0 citations
A Spatio -Temporal Graph Neural Network (STGNN) framework is presented for precise optical network traffic forecasting and anomaly detection. The model encodes network topology as a directed weighted graph, extracting node features that integrate static attributes and dynamic traffic states. The graph convolutional layer records the spatial relationship, while the temporal attention mechanism imitates the time-related changes according to the changes of traffic flow. Federated learning introduces collaborative model training without raw data exchange to address the scalability and privacy issues in multi-domain environments. Experimental evaluation on public and proprietary datasets shows that the proposed STGNN consistently outperforms statistical and deep learning baselines in terms of prediction accuracy and anomaly detection sensitivity. According to the component ablation study, each module must ensure stable performance. The integrated real-time monitoring and adaptive alarm architecture helps realize elastic and intelligent optical network management and helps quickly identify and mitigate anomalies. The complex traffic analysis and O&M assurance of the next-generation optical network are provided by this technical solution, which is scalable.
Zhi’en Jiang· The 2026 International Confe...· 0 citations
The findings indicate that hybrid deep learning techniques can improve network security by enhancing intrusion detection capability while reducing false alarms.
A. O. Jimoh-Mahmud, Abubakar Dayyabu, Abubakar Sadiq Idris et al.· FUDMA Journal of Sciences· 0 citations
Intrusion Detection Systems (IDSs) based on traditional machine learning treat network flows as independent tabular samples, ignoring the relational and topological structure that characterizes modern distributed attacks. Graph Neural Networks (GNNs) overcome this limitation by modeling network topology, which in turn raise the need to make their predictions transparent. This work develops and compares traditional classifiers against a GNN-based IDS on the UNSW-NB15 dataset, for both binary and multiclass classification. A novel graph construction is proposed in which each node is an individual flow and edges are defined by temporal proximity through three complementary strategies (conversation chains and temporal k-NN by source and destination IP). Three GNN backbones—GraphSAGE, Graph Convolutional Network (GCN) and Graph Attention Network (GAT)—are trained under an identical, matched pipeline and a chronological, inductive evaluation protocol, so that any difference is attributable to the backbone alone. A two-stage classifier then separates detection from attack-type categorisation, with GNNExplainer providing interpretability, and SHAP applied to the traditional models. In binary classification, GraphSAGE achieves an Accuracy of 0.9906, Precision of 0.9856, Recall of 0.9998, F1-Score of 0.9927 and ROC-AUC of 0.9965, exceeding the traditional baselines in their conventional evaluation setting, while GCN and GAT reach comparable detection (F1 ≈ 0.99), showing that the temporal graph rather than the specific backbone drives detection. The explainability analysis identifies TTL-related and connection-state variables as dominant predictors and reveals attack-specific structural patterns, confirming that temporally structured GNNs improve detection while providing interpretable predictions.
Alberto Caballero Ferrero, Shadi Motaali, Xavier Larriva-Novo et al.· Electronics· 0 citations
TAE-MAGSAGE, an edge-centric graph learning model which uses the observed communication structure to construct graphs and applies a line graph transformation to perform flow-level classification without collapsing the interaction relationships, is introduced.
Poonam Nehru, Yunpeng Zhang, Renjie Hu et al.· International Conference on...· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
