Authors:
Rocco Zaccagnino
1
;
Antonio Cirillo
1
;
Alfonso Guarino
2
;
Nicola Lettieri
3
;
Delfina Malandrino
1
and
Gianluca Zaccagnino
4
Affiliations:
1
Department of Computer Science, University of Salerno, Via Giovanni Paolo II, 84084, Fisciano (SA), Italy
;
2
Department of Law, Economics, Management and Quantitative Methods, University of Sannio, Via delle Puglie 82, 82100, Benevento (BN), Italy
;
3
National Institute for Public Policy Analysis (INAPP), Corso d’Italia 33, 00198, Rome, Italy
;
4
TopNetwork, Via Simone Martini, 143 00142, Rome, Italy
Keyword(s):
Network Traffic Intrusion Detection, Behavior Modeling, Geometric Deep Learning, Graph Neural Network.
Abstract:
Networks play a key role in modern society and are therefore the target of many threats aimed at performing malicious activities. In recent years, the so-called behavioral anomaly detection is becoming a de facto standard paradigm for different cyber security scenarios, such as network system intrusion detection. This paradigm relies on the idea to detect behavioral patterns that do not match the normal activity. To build more effective behavioral models, researchers are putting efforts on the use of behavioral events’ data in advanced machine learning methods, such as Convolutional and Recurrent Neural Networks. Recently, the fledging Geometric Deep Learning research area has proposed Graph Neural Networks (GNNs), which are particularly suitable to model the data connections and interactions as entities and relationships of a graph. To exploit the benefits of using such models in network system intrusion detection, we propose a novel graph-based behavioral modeling approach using GN
Ns. Preliminary experiments have been carried out to measure the effectiveness of our approach on the UNSW-NB15 dataset. The results obtained show that our proposal reaches performances comparable, and in some cases, better than some state-of-the-art approach.
(More)