Network Anomaly Detection Using a Graph Neural Network

Contrary to the many traditional network security approaches that focus on volume-based threats, the Activity and Event Network (AEN) is a new approach built on a graph model, which addresses both volumetric attacks and long-term threats that traditional security tools cannot deal with. The AEN graph structural foundation can serve as a basis to construct a graph to be used in Graph Neural Network (GNN) for anomaly and threat detection purposes. In this paper, an AEN-based supervised Graph Convolutional Network (GCN) model is proposed, then evaluated using two labelled datasets, namely, the distributed denial of service (DDoS) and the TOR-nonTOR datasets, yielding an accuracy score of 76% with the DDoS dataset and 88% with the TOR-nonTOR dataset, respectively.

I. Introduction

Over the years, several network tools such as antivirus software, intrusion prevention systems (IPSs) and intrusion detection systems (IDSs), have been developed to detect anomalies in a network environment. However, the mechanisms sustaining these approaches have focused on everyday volumetric anomalies, but have failed in addressing silent long-term security breaches. These stealthy threats can remain undetectable for a long period of time, causing tremendous leak of information, including private ones. To address this challenge, the AEN model has been proposed [1] as a new graph framework approach for detecting not only traditional network attacks, but also long-term attacks. AEN can be used to perform a continuous real-time analysis of a network while capturing the silent network attacks that can be undetected using regular or conventional detection mechanisms [1].