M-GRAD: Fusing Heterogeneous Logs into AI-Driven Graphs for Anomaly Detection and IP Risk Analysis

Abstract

Enterprise security demands actionable threat prioritization across heterogeneous environments. To address the limitations of siloed log analysis, we propose a multi-source, graph-based anomaly detection framework. First, our architecture seamlessly fuses network telemetry from Vectra, Security Information and Event Management (SIEM) logs from QRadar, and endpoint data from CrowdStrike into a unified graph. Second, we utilize the Louvain algorithm to segment the network, identifying functional communities and critical bridge nodes indicative of lateral movement. Third, we extract over 50 structural, behavioral, and temporal features to train an XGBoost-based ensemble classifier. Evaluated on a real-world banking dataset with 31 anomaly types, the proposed system achieves 98% precision. Crucially, empirical analysis reveals that local neighborhood connectivity and traffic dynamics significantly outperform traditional global centrality metrics in detecting complex attacks. Finally, to support operational incident response, we implement a dynamic risk-scoring mechanism that translates model predictions into actionable, IP-level severity assessments across sliding time windows. Ultimately, this framework substantially enhances comprehensive threat visibility and analyst efficiency.