.png){kind=icon}
返回
Practical Cyber Attack Detection With Continuous Temporal Graph in Dynamic Network System
.png){kind=icon}
PRE
AI
DOI：10.1109/TIFS.2024.3385321.png)
.png){kind=icon}
原文求助.png){kind=icon}
分享.png){kind=icon}
收藏
摘要
En 中文
Deep learning (DL) greatly enhances cyber anomaly detection capabilities through effective statistical network characteristic. However, previous methods have not fully addressed two real-world scenario-driven challenges. 1) Frequent node access and disconnection sourced from free-bounded 5G/B5G cyberspace introduce unfamiliar communication behavior patterns, reducing the detection ability of the pre-trained DL model. 2) Low-frequency or sporadic communication behaviors lack stable patterns, posing a challenge for existing AI-driven models, including DL-based detection methods. To address these issues, we propose a cyber anomaly detection framework based on Continuous Temporal Graph (CTG) neural network from a new interaction-centered perspective. The proposed framework refines the concrete information interaction between network entities into the CTG evolution process, thereby naturally incorporating new node access behaviors into feature extraction on CTG neural network. We furthermore present a message aggregation scheme on CTG with fusion of spatio-temporal neighborhood, the actual time distribution and the historical state, thus transforming communication into a more stable pattern for the learning of low-frequency interactions. Extensive experiments on 4 novel datasets, including ToN-IoT, UNSWNB15, CIC-Dark2020, J.P. Morgan payment, demonstrate that our approach outperforms state-of-the-art methods, particularly in detecting new access and low-frequency behaviors.
Keyword:
Anomaly detection
Feature extraction
Network topology
Intrusion detection
Topology
Cyberspace
Industrial Internet of Things
Graph neural network
intrusion detection
anomaly detection
semisupervised learning
期刊
IF:
8
论文数:
5.3K
被引数:
2.3W
机构
引用论文
TMG-GAN: Generative Adversarial Networks-Based Imbalanced Learning for Network Intrusion DetectionTmg-gan: 用于网络入侵检测的基于生成对抗网络的不平衡学习
PREAI
分享收藏分享收藏Anomal-E: A self-supervised network intrusion detection system based on graph neural networksAnomal-e: 基于图神经网络的自监督网络入侵检测系统
OAAI
OAAI分享收藏Dendritic mechanisms controlling the threshold and timing requirement of synaptic plasticity.png)
Hippocampus
HippocampusIF0
PREAI
分享收藏分享收藏
查看更多内容