Jul 2026· Annual International Computer Software and Applications Conference· pp. 2517-2524· 0 citations· 13 references
Abstract
Reinforcement learning-based intrusion detection systems achieve strong detection performance in unbalanced network traffic, but offer limited insight into which features have played a significant role in driving their decisions. To determine the key network features in detecting malicious packets, this paper presents a Graph Attention Network (GAT) model architecture applied to a feature dependency graph to analyze inter-feature influence in an RL-based intrusion detection system. Rather than ranking features independently, the framework uses GAT attention weights to reveal which feature relationships the model relies on most and how those relationships differ between malicious and benign traffic networks. Applied to a Rainbow DQN agent, a well-known RL-based agent, and trained on real botnet network traffic, the analysis identifies interpretable behavioral signatures in the feature influence structure that distinguish attack traffic from legitimate connections. The results demonstrate that attention-based influence analysis provides a richer characterization of detection decisions than per-feature importance methods alone.
: The modern network environment, whether enterprise systems or critical infrastructure, is increasingly exposed to sophisticated cyber threats that must be effectively detected. The existing GNN-based approaches construct graphs using feature-similarity heuristics, and connect flows that are statistically similar to one another but not necessarily communicating, hence capturing geometry specific to the dataset. On the other hand, communication topology is a representation of interaction patterns based on real network behaviour. We introduce TAE-MAGSAGE, an edge-centric graph learning model which uses the observed communication structure to construct graphs and applies a line graph transformation to perform flow-level classification without collapsing the interaction relationships. A Mahalanobis-inspired metric warp in message passing re-configures neighborhood similarity with respect to the discriminative feature dimensions, and a Ledoit–Wolf regularized Mahalanobis distance-based classifier learns class-conditional distributions to deal with severe class imbalance. TAE-MAGSAGE achieves an accuracy of 99.31% on the CIC-IDS-2017 dataset, macro F1 of 98.10%, and a false alarm rate of 0.56%, outperforming graph-based baselines. These results show that constructing graphs based on communication structure, combined with metric-conscious embedding and distribution-conscious classification, improves minority attack detection while reducing false alarms.
Poonam Nehru, Yunpeng Zhang, Renjie Hu et al.· Proceedings of the 21st Inte...· 0 citations
One of the most important pieces of the modern cyberattacks is lateral movement the ability to move around connected systems after the initial compromise and gain access to high-value organizational assets. Conventional approaches to intrusion detection often fail to recognize the sophisticated attack behaviors while being relatively ineffective in detecting relationships among the entities of the network and their communication pattern. This paper introduces a lateral movement detection framework based on a graph neural network (GNN) that represents network traffic as graph-structured data to maintain the relationship among hosts, connections, and communication flows. The proposed system includes the use of advanced graph learning architectures like Graph Convolutional Networks (GCN), Graph Attention Networks (GAT), and GraphSAGE in learning and training the network on the network traffic data for attack classification and anomaly detection, with normal and multiple attack classes. A thorough preprocessing pipeline is used to generate feature encoding and normalization and to construct the graph from the raw traffic data, yielding meaningful graphs for deep learning. It's embedded in a web app built with Flask, which provides real-time prediction, visualization, model comparison, and security analytics via an interactive dashboard. Nevertheless, the attempts to solve problems with graph-based learning models have been proven to be able to effectively detect malicious behavior and differentiate between various types of attacks by using only node attributes or structural relationships. The developed system provides an intelligent and scalable cybersecurity solution to improve the monitoring of networks, identify threats, and provide proactive defenses against lateral movement activities in today's enterprise environments.
Ouku Bhulakshmi, Nagari Kavya Sree, M. Subramanyam et al.· 2026 International Conferenc...· 0 citations
Graph Neural Networks (GNNs) have become a potent paradigm of complex data related to relations, and it is especially applicable to threat intelligence analysis and prediction of cyber-attack lines. The proposed paper describes a GNN framework that combines the sources of heterogeneous cyber threat intelligence, including network topology, vulnerability graphs, historic attack data, in predicting potential arrangement of attacks within enterprise networks. The suggested model is the hosts, vulnerabilities, and exploits as nodes, communication relationship and exploitability between the two nodes. Two benchmark data sets were experimentally tested and a synthetic enterprise network with 5,000 nodes and 18,200 edges was investigated. Findings indicate the proposed GNN model yields an attack path prediction rate of 91.3, which is higher than the conventional methods that utilize graph-based heuristics (91.3) and recurrent neural networks baselines (84.1). The model also lowers ratio of false positive prediction by 27.4 percent and ratio time to detect (MTTD) is enhanced by 32.8 percent over system ruled based predictions. Other ablation studies suggest that addition of vulnerability severity scores and temporal threat indicators enhance F1-score increasing to 0.92. The results indicate that GNNs are efficient in modeling structural and dynamic user behavior in a cyber setting. The suggested solution will aid in proactive defense as it will allow security analysts to predict the activity of attackers and give more priority to the mitigation measures, which will lead to the improvement of the overall cyber resilience.
D. Rajesh, Adamala Siri, Bandari Vyshnavi et al.· 2026 International Conferenc...· 0 citations
: Social network platforms have become primary channels for information dissemination, yet they are increasingly exploited by anomalous users such as bots, fake accounts, and coordinated disinformation spreaders. These malicious actors manipulate public opinion, spread misinformation and undermine platform integrity, posing severe threats to the security of the online ecosystem. Accurate detection of such users is challenging because they often organize into sophisticated high-order connection patterns that extend beyond local neighborhoods. Existing methods address this by either injecting predefined motifs as handcrafted features, which lack flexibility to discover unknown patterns, or employing higher-order Graph neural networks (GNNs) at prohibitive costs. Crucially, neither method treats structural information as learnable knowledge that can be automatically acquired from data and explicitly represented. To bridge this gap, we propose SparseGNN, a structural-knowledge-enhanced framework for anomalous user detection. It regards atomic subgraph patterns as fundamental, learnable units of structural knowledge. This framework is concatenated with original node features and fed into any standard GNN, without modifying the backbone architecture. Experiments on real-world datasets demonstrate that SparseGNN improves the accuracy and F1-score of standard GNNs for anomalous users detection without requiring predefined patterns, while maintaining linear complexity. Because the learned atomic patterns capture global high-order topology, the resulting structural knowledge representation is inherently less sensitive to localized edge perturbations, incidentally conferring improved stability under adversarial structural attacks.
Zehan Li, Yingyi Li, Zhiwei Tang et al.· Computers, Materials & C...· 0 citations
To improve the discriminability of the network flow graph, a new node‑edge‑node attention algorithm is introduced for graph enhancement representation that integrates edge-aware attention and intra-edge feature self-attention collaboratively, thereby assists the model to perceive complex attack behaviors at multiple granular levels effectively.
Yuxin Zhang, Yanxiang Hu, Bo Zhang et al.· Scientific Reports· 0 citations
The rapid evolution of cyber threats has significantly increased the demand for intelligent intrusion detection systems (IDSs) capable of accurately distinguishing malicious network activities from legitimate traffic. Traditional signature-based IDSs are often ineffective against previously unseen attacks, while many machine learning-based approaches suffer from limited interpretability despite achieving high detection performance. To address these challenges, this paper proposes an explainable network intrusion detection framework that integrates Mutual Information (MI)-based feature selection, a stacking ensemble classifier, and SHapley Additive exPlanations (SHAP). The proposed framework is evaluated using the UNSW-NB15 benchmark dataset. During preprocessing, categorical attributes are transformed using label encoding, highly skewed numerical features are normalized through logarithmic transformation, and robust scaling is applied to mitigate the influence of outliers. Mutual Information is employed to rank feature relevance, and the twenty most informative features are selected to reduce computational complexity while preserving discriminative information. A stacking ensemble model comprising XGBoost, LightGBM, and CatBoost as base learners, with Logistic Regression serving as the meta-learner, is then trained for binary intrusion detection. Experimental evaluation demonstrates that the proposed model achieves an accuracy of 93.40%, precision of 94.50%, recall of 95.22%, F1-score of 94.86%, and an ROC-AUC score of 98.74%. Furthermore, SHAP-based explainability provides both global and local interpretations of model decisions, identifying sttl, sbytes, and synack as the most influential features contributing to attack detection. The experimental results indicate that the proposed framework offers a robust balance between predictive performance and interpretability, making it suitable for practical cybersecurity applications.
Anjali Singh· Applied Science and Engineer...· 0 citations