Jul 2026· 2026 International Conference on Emerging Trends in Information, Communication & Systems (ICETICS)· pp. 1-6· 0 citations· 19 references
Abstract
Graph Neural Networks (GNNs) have become a potent paradigm of complex data related to relations, and it is especially applicable to threat intelligence analysis and prediction of cyber-attack lines. The proposed paper describes a GNN framework that combines the sources of heterogeneous cyber threat intelligence, including network topology, vulnerability graphs, historic attack data, in predicting potential arrangement of attacks within enterprise networks. The suggested model is the hosts, vulnerabilities, and exploits as nodes, communication relationship and exploitability between the two nodes. Two benchmark data sets were experimentally tested and a synthetic enterprise network with 5,000 nodes and 18,200 edges was investigated. Findings indicate the proposed GNN model yields an attack path prediction rate of 91.3, which is higher than the conventional methods that utilize graph-based heuristics (91.3) and recurrent neural networks baselines (84.1). The model also lowers ratio of false positive prediction by 27.4 percent and ratio time to detect (MTTD) is enhanced by 32.8 percent over system ruled based predictions. Other ablation studies suggest that addition of vulnerability severity scores and temporal threat indicators enhance F1-score increasing to 0.92. The results indicate that GNNs are efficient in modeling structural and dynamic user behavior in a cyber setting. The suggested solution will aid in proactive defense as it will allow security analysts to predict the activity of attackers and give more priority to the mitigation measures, which will lead to the improvement of the overall cyber resilience.
This paper presents the problem of detecting complex, coordinated cyber-attacks at multiple intervals across enterprise networks. Traditional intrusion detection systems lack the ability to identify the ‘when’ and ‘where’ of attacks, resulting in an incomplete understanding of an attack’s propagation. Most current methodologies focus on the analysis of single, disconnected, and isolated events. This fundamentally limits their ability and effectiveness to understand or conceptualise complex attacks that develop or evolve over time. This paper presents a framework composed of GNNs that captures and analyses the activity of enterprises as dynamic interaction graphs, applying a temporal attention mechanism to focus and prioritise the analysis of high-risk, risky behavioural patterns. The framework is tested against the LAANL Logs and DARPA Transparent Computing cybersecurity datasets. The proposed adaptive temporal GNN achieves a 5% improvement over the strongest baseline (GAT) in detection accuracy, demonstrating its effectiveness in capturing multi-stage coordinated cyber-attacks. Furthermore, the framework provided a consistent and significant improvement in test environments that were imposed with noise. Lastly, the framework was also able to improve explainability through the analysis of the path of an attack’s propagation. This suggests that the results of the framework will validate the radical combination of the structural and the temporal elements of a complex cyber attack MODEL as a possible answer to the challenge of providing a simple, dynamic, and effective scalable solution to the detection of sophisticated cyber disasters in realistic and complex environments.
Teguh Nurhadi Suharsono, T. Kurniawan, Deshinta Arova Dewi et al.· Discover Computing· 0 citations
Industrial Control Systems (ICS) and Supervisory Control and Data Acquisition (SCADA) environments are vulnerable to multi-stage cyber attacks that evolve across interconnected devices, protocols, and physical processes. Detection is difficult because each stage of such an attack, evaluated in isolation, may resemble legitimate operational behaviour, while the malicious intent becomes evident only when the structural relationships among assets and the temporal progression of events are considered together. Traditional signature-based, anomaly-based, and classical machine learning approaches typically evaluate individual packets or short windows and therefore struggle with multi-stage campaigns. This paper proposes a comparative evaluation framework for Graph Neural Network (GNN) models, specifically Graph Convolutional Networks (GCN), Graph Attention Networks (GAT), GraphSAGE, and Graph Isomorphism Networks (GIN), applied to multi-stage attack detection in ICS environments. Industrial network traffic and process interactions are represented as graphs in which nodes correspond to controllers, sensors, actuators, engineering workstations, and network devices, and edges capture communication and control relationships. Attack stages are labelled at the node level so that detection becomes a structured classification problem. The paper does not report experimental results. Implementation and empirical benchmarking are planned as future work on publicly available SCADA-grade datasets including SWaT, WADI, HAI, and additional Power System and industrial datasets where available. The contribution is the proposed evaluation framework, the graph representation strategy for ICS environments, and the methodological groundwork for a rigorous future comparison.
Naga Venkata Aswini Pavan Kumar Inguva· International journal of com...· 0 citations
One of the most important pieces of the modern cyberattacks is lateral movement the ability to move around connected systems after the initial compromise and gain access to high-value organizational assets. Conventional approaches to intrusion detection often fail to recognize the sophisticated attack behaviors while being relatively ineffective in detecting relationships among the entities of the network and their communication pattern. This paper introduces a lateral movement detection framework based on a graph neural network (GNN) that represents network traffic as graph-structured data to maintain the relationship among hosts, connections, and communication flows. The proposed system includes the use of advanced graph learning architectures like Graph Convolutional Networks (GCN), Graph Attention Networks (GAT), and GraphSAGE in learning and training the network on the network traffic data for attack classification and anomaly detection, with normal and multiple attack classes. A thorough preprocessing pipeline is used to generate feature encoding and normalization and to construct the graph from the raw traffic data, yielding meaningful graphs for deep learning. It's embedded in a web app built with Flask, which provides real-time prediction, visualization, model comparison, and security analytics via an interactive dashboard. Nevertheless, the attempts to solve problems with graph-based learning models have been proven to be able to effectively detect malicious behavior and differentiate between various types of attacks by using only node attributes or structural relationships. The developed system provides an intelligent and scalable cybersecurity solution to improve the monitoring of networks, identify threats, and provide proactive defenses against lateral movement activities in today's enterprise environments.
Ouku Bhulakshmi, Nagari Kavya Sree, M. Subramanyam et al.· 2026 International Conferenc...· 0 citations
The integration of IT and OT networks in smart factories has expanded the attack surface, necessitating proactive and precise defense strategies. This article presents a dual-layer prediction framework targeting two core challenges: (1) macro-level attack path identification across converged IT/OT networks, and (2) micro-level attack technique evolution prediction. First, a multi-source network security knowledge base is constructed to model the threat ontology, and device threat levels are quantified based on the Common Vulnerability Scoring System (CVSS). Macro attack paths are predicted using threat propagation algorithms. Second, micro-level attack techniques are predicted along the macro paths by integrating Firewall-Intrusion Detection System(FW-IDS) configurations and Adversarial Tactics, Techniques, and Common Knowledge(ATT&CK) techniques into an evolution path prediction algorithm. The dual-layer prediction results are visualized to enhance interpretability. They demonstrate improved accuracy in attack path and technique prediction as well as real-time threat perception. Simulation experiments show that this approach significantly enhances the security posture of factory networks. Compared to existing methods, the dual-layer architecture proposed in this paper reduces the Weighted Mean Residual Paths (WMRP) by over 30%. This metric is used to quantify the number of potential attack paths remaining during the repair process. This significant reduction demonstrates that our method can more effectively contain threats at an early stage and minimize the attack surface more efficiently.This enables earlier detection and response to complex threats, thereby strengthening the protection of critical systems and devices in industrial environments.Beyond the implemented prediction tasks, the ontology-based semantic integration and cross-layer prediction structure also provide a foundational pathway toward future (self-*)adaptive security in Industry 5.0 smart factories, where online knowledge evolution, closed-loop feedback, and adaptive response orchestration are required to cope with dynamic and uncertain industrial threat environments.
Yang Peng, Ziyuan Yu, Li Zhen et al.· ACM Transactions on Autonomo...· 0 citations
The rapid growth of digital communication technologies, cloud computing, Internet of Things (IoT) devices, and interconnected network infrastructures has significantly increased the complexity and frequency of cyber threats, making accurate threat detection and intelligent cyber risk assessment essential for ensuring network security. Conventional machine learning-based intrusion detection techniques often experience limitations in handling uncertain network behaviours, evolving attack patterns, and complex relationships among communicating entities, resulting in reduced detection accuracy and increased false alarm rates. To address these challenges, this study proposes an Intelligent Fuzzy Graph-Based Framework that integrates fuzzy reasoning with graph-based network modelling to enhance network threat detection, cyber risk assessment, and adaptive mitigation. Initially, network traffic was collected and pre-processed through feature extraction and normalization to remove redundancy and improve data quality. Subsequently, the processed network entities are represented as a weighted fuzzy graph, where nodes denote network devices and edges represent communication relationships with fuzzy membership values reflecting uncertainty in network interactions. A fuzzy inference mechanism was then employed to calculate dynamic cyber risk scores by analysing multiple security indicators, while graph-based structural analysis captures communication dependencies and attack propagation patterns for improved threat identification. Based on the computed risk scores, the framework performs intelligent threat classification and prioritises adaptive mitigation strategies for high-risk network entities. The proposed framework was evaluated using benchmark cybersecurity datasets and compared with conventional models, including Support Vector Machine (SVM), Random Forest, XGBoost, and Graph Neural Network (GNN). Experimental results demonstrate superior performance, achieving an accuracy of 99.28%, precision of 99.12%, recall of 99.05%, F1-score of 99.10%, Matthews Correlation Coefficient (MCC) of 98.92%, and ROC-AUC of 99.36%. The framework substantially reduces false positive and false negative predictions while maintaining consistent detection capability across multiple cyber-attack categories. These findings confirm that the integration of fuzzy reasoning and graph-based analysis provides a robust, scalable, and reliable solution for intelligent cybersecurity systems, enabling accurate threat detection, continuous cyber risk assessment, and adaptive mitigation in dynamic and large-scale network environments.
S. al., Ravi Kumar D, B. M. Hemalatha et al.· International journal of com...· 0 citations
Although the framework performed slightly better than the best baseline under the tested conditions, the improvement was not statistically significant enough to establish consistent superiority and emphasize the need for further evaluation of deployment time, base-rate estimation, and real-world cybersecurity scenarios.
N. Deotale, Annaluri Sreenivasa Rao, E. Sreedevi et al.· International Journal for Gl...· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
