Detecting Unknown Threat Based on Continuous-Time Dynamic Heterogeneous Graph Network

Abstract

Unknown threats have caused severe damage in critical infrastructures. To solve this issue, the graph-based methods have been proposed because of their ability for learning complex interaction patterns of network entities with discrete graph snapshots. However, such methods are challenged by the computer networking model characterized by the natural continuous-time dynamic heterogeneous graph (CDHG). In this paper, we propose a CDHG-based graph neural network model, namely, CDHGN, for unknown threat detection. It first constructs the CDHG using interaction relationships among network entities extracted from various log records. Then, it trains the detection model based on a heterogeneous attention network and performs streaming detection for live online network events. We implement a prototype and conduct extensive experiments on a comprehensive cybersecurity dataset with more than nine million records. Experimental result shows that the proposed method can achieve superior detection performance than the state-of-the-art methods.

Knowledge Graph Based Large Scale Network Security Threat Detection Techniques

“…Literature [16] envisioned a deep learning model developed to address network traffic security for various IoTs to solve network security problems; testing the above model on an open dataset showed that the model achieved 99% accuracy in identifying potential threats. Literature [17] conceptualized a cdhg-based graph neural network model for the detection of unknown threats to the network, and tests were conducted on a comprehensive network security dataset of 9 million+ data records, which corroborated the reliability and excellent performance of this method. Literature [18] proposed a Deep Embedded Neural Network Expert System (DeNNeS), which refines rules through deep autonomous learning and classifies them based on its knowledge base.…”