.png){kind=icon}
Return
Trace2Vec: Detecting complex multi-step attacks with explainable graph neural network
.png){kind=icon}
PRE
AI
DOI：10.1016/j.patcog.2025.111363.png)
.png){kind=icon}
Original request for help.png){kind=icon}
Share.png){kind=icon}
Save
Abstract
En 中文
Complex multi-step attacks have caused significant damage to numerous critical infrastructures. Recognizing the pattern of such attacks is a challenging task, and graph neural network based methods have shown promising results via modeling the system's events as a graph. However, existing methods still face several limitations when deployed in practice. First, there is a lack of sufficient real attack data especially considering the large volume of normal data. Second, attack patterns are complex and evolve over time due to the dynamic and heterogeneous nature of events. Third, the lack of explanation in learned models undermines the trustworthiness of such methods in production environments. To address the above challenges, in this paper, we propose an attack detection method, TRACE2VEC. The approach first designs an corruption function to augment rare attack samples, and integrates them into the event graphs. Next, it models the event graphs via a continuous-time dynamic heterogeneous graph neural network. Finally, it employs the Monte Carlo tree search algorithm to identify events with greater contributions to the attack, thus enhancing the explainability of the detection result. We have implemented a prototype for TRACE2VEC, and the experimental evaluations demonstrate its superior detection and explanation performance compared to existing methods.
Keywords:
Complex multi-step attack
Anomaly detection
Dynamic heterogeneous graph
Attack sample construction
Explainability
Journal
IF:
7.6
Papers:
1.3W
Citations:
4.5W
Organization
No organization information available
Cited Papers
ShareSaveOn Evaluating Black-Box Explainable AI Methods for Enhancing Anomaly Detection in Autonomous Driving Systems.png)
SENSORS
OAAI
SENSORSIF3.5
OAAIShareSaveMF-Net: Multi-frequency intrusion detection network for Internet traffic dataPATTERN RECOGNITION
PATTERN RECOGNITIONIF7.6
PREAI
ShareSaveDepth-based subgraph convolutional auto-encoder for network representation learningPATTERN RECOGNITIONOAAI
PATTERN RECOGNITIONIF7.6
OAAIShareSaveShareSaveShareSave
View more