Enhancing Network Anomaly Detection Using Graph Neural Networks

Marfo, William; Tosh, Deepak K.; Moore, Shirley V.

doi:10.1109/medcomnet62012.2024.10578278

Enhancing Network Anomaly Detection Using Graph Neural Networks

Conference · 11 June 2024 · 2024 22nd Mediterranean Communication and Computer Networking Conference (MedComNet)

DOI:https://doi.org/10.1109/medcomnet62012.2024.10578278· OSTI ID:2426922

Marfo, William ^[1]; Tosh, Deepak K. ^[1]; Moore, Shirley V. ^[1]

University of Texas at El Paso,Department of Computer Science,El Paso,USA

In the world of Internet of Things (IoT) networks, where devices are constantly communicating, keeping them secure from cyber threats is critical. This paper introduces a novel approach to detecting unusual and potentially harmful activities in these networks using graph neural networks (GNNs). We combine two specific types of GNNs-GraphSAGE and graph attention networks (GAT)-to create a model that understands and represents the behaviors and interactions in a network. GraphSAGE creates an embedding of network activities by examining local data interactions, while GAT directs the model's focus to the most critical interactions. By integrating these two methods in a single model that considers different types of interactions (both host and flow nodes), we aim to create a system that accurately represents the current state of a network and can also spot anomalies effectively while reducing false positives and negatives. Our innovative approach has demonstrated promising results, achieving an accuracy of 98% on the UNSW-NB15 dataset, significantly outperforming standalone GraphSAGE and GAT models. This underscores its potential as a robust framework for securing IoT networks against cyber threats and anomalies.

View Conference

Research Organization:: Univ. of Texas at El Paso, TX (United States)

Sponsoring Organization:: USDOE Office of Fossil Energy and Carbon Management (FECM)

DOE Contract Number:: DE-FE0032089

OSTI ID:: 2426922

Journal Information:: 2024 22nd Mediterranean Communication and Computer Networking Conference (MedComNet), Conference: 22nd Mediterranean Communication and Computer Networking Conference (MedComNet)

Country of Publication:: United States

Language:: English

References (17)

Network Anomaly Detection Using Federated Learning No authors listed MILCOM 2022 - 2022 IEEE Military Communications Conference (MILCOM) https://doi.org/10.1109/MILCOM55135.2022.10017793		November 2022
Condition monitoring and anomaly detection in cyber-physical systems No authors listed 2022 17th Annual System of Systems Engineering Conference (SOSE) https://doi.org/10.1109/SOSE55472.2022.9812638		June 2022
Anomaly Detection in In-Vehicle Networks with Graph Neural Networks No authors listed 2023 31st Signal Processing and Communications Applications Conference (SIU) https://doi.org/10.1109/SIU59756.2023.10223760		July 2023
Graph Anomaly Detection With Graph Neural Networks: Current Status and Challenges No authors listed IEEE Access https://doi.org/10.1109/ACCESS.2022.3211306		January 2022
Network Anomaly Detection Using a Graph Neural Network No authors listed 2023 International Conference on Computing, Networking and Communications (ICNC) https://doi.org/10.1109/ICNC57223.2023.10074111		February 2023
Performance Analysis of Intrusion Detection Systems Using a Feature Selection Method on the UNSW-NB15 Dataset No authors listed Journal of Big Data https://doi.org/10.1186/s40537-020-00379-6		November 2020
Detection of Message Injection Attacks Onto the CAN Bus Using Similarities of Successive Messages-Sequence Graphs No authors listed IEEE Transactions on Information Forensics and Security https://doi.org/10.1109/TIFS.2021.3098162		January 2021
The Elements of Statistical Learning No authors listed Springer Series in Statistics https://doi.org/10.1007/978-0-387-84858-7		January 2009
Graph Neural Networks for Anomaly Detection in Industrial Internet of Things No authors listed IEEE Internet of Things Journal https://doi.org/10.1109/JIOT.2021.3094295		June 2022
UNSW-NB15: a comprehensive data set for network intrusion detection systems (UNSW-NB15 network data set) No authors listed 2015 Military Communications and Information Systems Conference (MilCIS) https://doi.org/10.1109/MilCIS.2015.7348942		November 2015
An Anomaly Mitigation Framework for IoT Using Fog Computing No authors listed Electronics https://doi.org/10.3390/electronics9101565		September 2020
Towards Network Anomaly Detection Using Graph Embedding No authors listed Lecture Notes in Computer Science https://doi.org/10.1007/978-3-030-50423-6_12		June 2020
Exploiting Edge Features for Graph Neural Networks No authors listed 2019 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) https://doi.org/10.1109/CVPR.2019.00943		June 2019
A Novel Multimodal-Sequential Approach Based on Multi-View Features for Network Intrusion Detection No authors listed IEEE Access https://doi.org/10.1109/ACCESS.2019.2959131		January 2019
An ensemble learning and fog-cloud architecture-driven cyber-attack detection framework for IoMT networks No authors listed Computer Communications https://doi.org/10.1016/j.comcom.2020.12.003		January 2021
An Experimental Analysis of Attack Classification Using Machine Learning in IoT Networks No authors listed Sensors https://doi.org/10.3390/s21020446		January 2021
E-GraphSAGE: A Graph Neural Network based Intrusion Detection System for IoT No authors listed NOMS 2022-2022 IEEE/IFIP Network Operations and Management Symposium https://doi.org/10.1109/NOMS54207.2022.9789878		April 2022

Similar Records

Graph neural networks for detecting anomalies in scientific workflows

Journal Article · 2023 · International Journal of High Performance Computing Applications · OSTI ID:1975863

Jin, Hongwei; Raghavan, Krishnan; Papadimitriou, George; +5 more

CPES-QSM: A Quantitative Method Towards the Secure Operation of Cyber-Physical Energy Systems

Journal Article · 2022 · IEEE Internet of Things Journal (Online) · OSTI ID:1901938

Ospina, Juan; Venkataramanan, Venkatesh; Konstantinou, Charalambos

Facility Cybersecurity Framework Best Practices

Technical Report · 2020 · OSTI ID:1660771

Gourisetti, Sri Nikhil G.; Reeve, Hayden; Rotondo, Julia A.; +1 more

Enhancing Network Anomaly Detection Using Graph Neural Networks

Citation Formats

References (17)

Similar Records

Related Subjects