Skip to content
Open access

Hybrid GCN Framework for Insider Threat Detection with Reduced False Alarms

Jul 2026 · International Journal for Research in Applied Science and Engineering Technology · Vol 14, pp. 787-794 · 0 citations

TL;DR

This work proposes a graphstructured detection framework underpinned by a Graph Convolutional Network (GCN), enabling the model to capture interaction-driven threat indicators that scalar feature vectors cannot represent.

Abstract

Among the most consequential vulnerabilities in contemporary IoT-based systems is the insider threat — a class of attack in which authorised users deliberately or inadvertently misuse their privileges, often evading detection for prolonged intervals. Mainstream detection approaches continue to be undermined by three unresolved obstacles: severe class imbalance between benign and malicious records, the curse of dimensionality arising from rich feature sets, and the non-stationary nature of user behavioural profiles. To address these co-occurring challenges within a unified architecture, this work proposes a graphstructured detection framework underpinned by a Graph Convolutional Network (GCN). Relational dependencies among users, devices, and system resources are encoded as graph topology, enabling the model to capture interaction-driven threat indicators that scalar feature vectors cannot represent. Improved Principal Component Analysis (IPCA) performs dimensionality reduction while maximising the retention of discriminative variance. An Outlier-Resistant K-Means algorithm segments the activity space into semantically coherent clusters, and the Enhanced Bidirectional Generative Adversarial Network (EBiGAN) synthesises statistically faithful malicious samples to redress class skew. Hyperparameter optimisation is conducted via Bayesian search guided by the Probability of Improvement (PI) acquisition function. On the CMU CERT benchmark, the proposed system achieves a detection accuracy of 96.8%, a detection rate of 96.7%, and a false alarm rate of only 3%, outperforming all compared baselines and demonstrating readiness for deployment in production IoT security environments.

Read PDF

Similar papers

Open access Jul 2026

Interpretable Deep Learning Defences via User Anomaly Detection in Cloud Platforms

Cloud platforms are the targets of highly advanced attacks that are designed to circumvent traditional rule based IDSs, such as: credential misuse, insider threats, privilege escalation, lateral movements, etc. To protect against user attacks, this paper introduces an interpretable deep learning defence framework in the context of user anomaly detection for both IaaS and PaaS cloud service layers and SaaS application layer. Multi-source authentication logs/records, APIs, networks logs are combined into integrated behavioural tensors and classified as anomalies by processing with the recurrent neural network with attention-based temporal weights. The mathematical model for access probability distribution, the model for anomaly scoring and temporal sequence modeling, as well as the model for Mahalanobis-distance-based deviation analysis further enhance the analysis's rigor and interpretability. Experimental results show that the detection accuracy achieved is 97.4%, followed by 96.8% precision, 97.9% recall and 97.3% F1-score, which are much higher than those of the conventional rule-based and black-box deep learning IDSs.

Madhavi Kapre, P. Sahu, Raman Verma et al. · 0 citations
Open access Jul 2026

Explainable attention-based intrusion detection for encrypted 5G network traffic

The widespread adoption of end-to-end encryption in 5G networks limits the effectiveness of traditional intrusion detection systems that rely on payload inspection. This challenge is particularly critical for detecting Advanced Persistent Threats (APTs), which employ low-rate, long-duration, and stealthy communication strategies to evade conventional defenses. This study presents a privacy-preserving intrusion detection framework that operates exclusively on flow-level traffic metadata without deep packet inspection. Network packets are aggregated into bidirectional flows, from which temporal, statistical, and directional features are extracted to characterize behavioral patterns. A Transformer-based model with self-attention is employed to capture long-range dependencies across encrypted traffic sequences and identify subtle, temporally dispersed attack indicators. The framework is evaluated on a large-scale 5G-relevant dataset containing over one million flow records and compared against classical machine learning, ensemble, CNN, and LSTM models. Results demonstrate high recall and strong F1-score in distinguishing APT from benign traffic. Attention-based and feature-level explanations further reveal that prolonged communication, irregular timing gaps, and directional asymmetry significantly influence detection decisions. The findings support the practicality of explainable Transformer models for secure and scalable APT detection in encrypted 5G environments.

Raghu Dhumpati, Varun Vemulapalli, Udayaraju Pamula et al. · 0 citations
Preprint Aug 2026

Cognitive Graph Intelligence for Adaptive and Robust DDoS Attack Detection in Next Generation Networks

By integrating temporal graph construction, adversarial augmentation, and GCN classification, GraphGAN effectively models coordinated attack behaviors and mitigates class imbalance, providing a robust and topology-aware solution for intrusion detection in data-constrained environments.

Mohammad Arif Hossain, Yeahia Sarker, Md Jafrin Hossain et al. · 0 citations
Open access Aug 2026

Tri-Level Network Attack Risk Stratification Using IDS-Contextual Ensemble Learning

Advanced Persistent Threats (APTs) remain among the most damaging risks to enterprise networks: they evade signature-based defenses, persist inside compromised environments, and cause substantial harm. Most machine learning approaches to intrusion detection treat the problem as binary classification and therefore offer little support for the risk prioritisation that Security Operations Centre (SOC) analysts actually require. This paper presents an Intrusion Detection System (IDS)-contextual ensemble learning framework that assigns network traffic to three operationally meaningful risk tiers: High, Medium and Low. Sixteen domain-knowledge engineered features are combined with IDS-generated contextual annotations, raw behavioural flow measurements and temporal components to form a 36-dimensional input representation. A one-way analysis of variance (ANOVA) with eta-squared effect sizing, performed before any model is trained, shows that none of the nine raw behavioural features carries meaningful discriminating power for risk-tier assignment, which establishes the need for IDS context. Five classifiers are evaluated on a balanced dataset of 125,000 APT flow records. Extra Trees performs best, reaching 89.35% accuracy, a Macro F1 of 0.8941, a Matthews Correlation Coefficient of 0.8404 and a macro Area Under the Curve (AUC) of 0.9829, at an inference cost of approximately 42 microseconds per record. A six-configuration ablation study shows that removing the IDS annotation alone reduces Macro F1 from 0.8941 to 0.3341, the chance level for three balanced classes. Robustness is confirmed by five-fold stratified cross-validation and by a fairness audit across the four network protocol types present in the data.

Reeta Mishra, Neelu Chaudhary · 0 citations
Conference Jul 2026

Generative Adversarial Networks for Hardening Cloud Intrusion Detection Systems

Cloud computing has emerged as an important core to the contemporary digital services, facilitating scalable, on demand provisioning of resources across a variety of application fields. Nevertheless, this multi-tenant and dynamic environment of clouds and the amplified attack surface make the detection of intrusions through reliable methods a consistent issue that cloud security systems struggle with. The proposed work is a Generative Adversarial Network (GAN)-based hardening framework of cloud intrusion detection systems, targeting better resilience to changing and low-rate cyberattacks. The methodology combines a conditional generator which is used to generate realistic cloud-specific attack traffic, a discriminator used to refine the adversarial traffic, as well as a co-trained intrusion classifier trained on both clean and synthetic data in a closed-loop way. The feature-aware regularization is introduced to maintain the statistical consistency of network traffic, and optimize the attack diversity. The proposed approach is proved to yield better results in comparison with signature-based, machine learning, deep learning, and adversarial ML-based IDS models by experimental assessment. Significant gains in the accuracy of identifying, the ability to recall, stability, and minimizing errors are also noticed with quantifiable increases observed in all evaluation measures. These findings represent the usefulness of adversarial data-driven learning to develop robust, adaptive, and future-ready cloud intrusion detection systems.

T. Divya, Sheik Saidhbi, S. Umarani et al. · 0 citations
Open access Jul 2026

Explainable AI-Based Cyber Threat Detection Framework Using LSTM and Autoencoder for Intelligent Network Security

The rapid advancement of digital communication and networking technologies has resulted in a significant increase in the frequency and sophistication of cyber threats, creating new challenges for securing modern computer networks. Traditional intrusion detection approaches mainly depend on signature-based techniques and predefined security rules, making them less effective against newly emerging and continuously evolving cyber attacks. To address these limitations, this study presents an Explainable Artificial Intelligence (XAI)-based cyber threat detection framework that combines Long Short-Term Memory (LSTM) and Autoencoder models for accurate and transparent threat detection. The LSTM model captures sequential network traffic patterns to identify temporal attack behaviours, whereas the Autoencoder detects anomalous activities by learning the characteristics of normal network traffic. The integration of Explainable AI enables users to understand prediction outcomes by highlighting the factors influencing each detection decision. Furthermore, the framework performs quantitative risk assessment, categorizes threats into multiple severity levels, and generates suitable mitigation recommendations through an interactive web-based dashboard. Experimental results demonstrate that the proposed framework provides reliable, interpretable, and effective cyber threat detection, thereby supporting security professionals in making timely and well-informed decisions.

Indu Asitha, Manjunatha B. N. · 0 citations