Network traffic analysis through node behaviour classification: a graph-based approach with temporal dissection and data-level preprocessing

Zola, Francesco; Segurola-Gil, Lander; Bruse, Jan L.; Galar, Mikel; Orduna-Urrutia, Raul

doi:10.1016/j.cose.2022.102632

Cited by 30 publications

(10 citation statements)

References 44 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…An important consideration when converting from time series to graph structure is determining a fixed time interval to use to sample the network flow to avoid creating a graph that is too large to input/train by a trained model. 8 Xiao et. al.…”

Section: Related Workmentioning

confidence: 99%

Graph representation learning for context-aware network intrusion detection

Premkumar,

Schneider,

Spivey

et al. 2023

Artificial Intelligence and Machine Learning for Multi-Domain Operations Applications V

View full text Add to dashboard Cite

Detecting malicious activity using a network intrusion detection system (NIDS) is an ongoing battle for the cyber defender. Increasingly, cyber-attacks are sophisticated and occur rapidly, necessitating the use of machine/deep learning (ML/DL) techniques for network intrusion detection. Traditional ML/DL techniques for NIDS classifiers, however, are often unable to sufficiently find context-driven similarities between the various network flows and/or packet captures. In this work, we leverage graph representation learning (GRL) techniques to successfully detect adversarial intrusions by exploiting the graph structure of NIDS data to derive context awareness, as graphs are a universal language for describing entities and their relationships. We explore several methods for NIDS data graph representation at both the network flow and packet level utilizing the CIC-IDS2017 dataset. We leverage graph neural networks and graph embedding algorithms to create a context-aware network intrusion detection system. Results indicate that adding context derived from GRL improves performance for detecting attacks. Our highest-scoring classifier incorporated both GNN embeddings and flow-level features and achieved an accuracy of 99.9%. Adding GRL methods to augment the flow/packet features improved accuracy by as much as 52.41%.

show abstract

Section: Related Workmentioning

confidence: 99%

Graph representation learning for context-aware network intrusion detection

Premkumar,

Schneider,

Spivey

et al. 2023

Artificial Intelligence and Machine Learning for Multi-Domain Operations Applications V

View full text Add to dashboard Cite

show abstract

“…Anomalous nodes → modeling stochasticity and multi-scale ST dependency GCN and GRU DEGCN [50] To capture node-and global-level patterns → DGCN and GGRU GCN alone TDG with GCN [51] Malicious connections on traffic → extracting TDGs graph. It used the GCN encoder and the deconvolutional decoder.…”

Section: Gcn and Drnn-based Gae H-vgrae [49]mentioning

confidence: 99%

“…Zola et al [51] proposed a graph-based approach to detect malicious connections on traffic networks. Specifically, in the first stage, a temporal dissection operation was used to split the entire network information into time intervals and to extract Traffic Dispersion Graphs (TDGs).…”

Section: ) Anomalous Node Detectionmentioning

confidence: 99%

Graph Anomaly Detection With Graph Neural Networks: Current Status and Challenges

et al. 2022

View full text Add to dashboard Cite

Graphs are used widely to model complex systems, and detecting anomalies in a graph is an important task in the analysis of complex systems. Graph anomalies are patterns in a graph that do not conform to normal patterns expected of the attributes and/or structures of the graph. In recent years, graph neural networks (GNNs) have been studied extensively and have successfully performed difficult machine learning tasks in node classification, link prediction, and graph classification thanks to the highly expressive capability via message passing in effectively learning graph representations. To solve the graph anomaly detection problem, GNN-based methods leverage information about the graph attributes (or features) and/or structures to learn to score anomalies appropriately. In this survey, we review the recent advances made in detecting graph anomalies using GNN models. Specifically, we summarize GNN-based methods according to the graph type (i.e., static and dynamic), the anomaly type (i.e., node, edge, subgraph, and whole graph), and the network architecture (e.g., graph autoencoder, graph convolutional network). To the best of our knowledge, this survey is the first comprehensive review of graph anomaly detection methods based on GNNs.

show abstract

“…Due to its usefulness and importance in detecting a class type, the IGR [28] is also employed as a weight for attributes in this work (2).…”

Section: Information Gainmentioning

confidence: 99%

“…By overwhelming the infrastructure that surrounds the internet traffic flow, a DoS attack is a malicious technique that interferes with the regular traffic and networking operations of a targeted server. The rate and volume of network traffic sent to the target closely correlate with the attack's severity [2].…”

Section: Introductionmentioning

confidence: 99%

K-Means clustering-based semi-supervised for DDoS attacks classification

Jasim

Gaata

2022

Bulletin EEI

View full text Add to dashboard Cite

Network attacks of the distributed denial of service (DDoS) form are used to disrupt server replies and services. It is popular because it is easy to set up and challenging to detect. We can identify DDoS attacks on network traffic in a variety of ways. However, the most effective methods for detecting and identifying a DDoS attack are machine learning approaches. This attack is considered to be among the most dangerous internet threats. In order for supervised machine learning algorithms to function, there needs to be tagged network traffic data sets. On the other hand, an unsupervised method uses network traffic analysis to find assaults. In this research, the K-Means clustering algorithm was developed as a semi-supervised approach for DDoS classification. The proposed algorithm is trained and tested with the CICIDS2017 dataset. After using the proposed hybrid feature selection methods and applying multiple training, testing, and carefully sorting DDoS traffic through a series of experiments, the optimum 2 centroids were found to be DDoS and normal. The generated centroids can be used to classify network traffic. So the proposed method succeeded to cluster the network traffic to safe and theat.

show abstract

Network traffic analysis through node behaviour classification: a graph-based approach with temporal dissection and data-level preprocessing

Cited by 30 publications

References 44 publications

Graph representation learning for context-aware network intrusion detection

Graph representation learning for context-aware network intrusion detection

Graph Anomaly Detection With Graph Neural Networks: Current Status and Challenges

K-Means clustering-based semi-supervised for DDoS attacks classification

Contact Info

Product

Resources

About