Towards a Geometric Deep Learning-Based Cyber Security: Network System Intrusion Detection Using Graph Neural Networks

Networks play a key role in modern society and are therefore the target of many threats aimed at performing malicious activities. In recent years, the so-called behavioral anomaly detection is becoming a de facto standard paradigm for different cyber security scenarios, such as network system intrusion detection. This paradigm relies on the idea to detect behavioral patterns that do not match the normal activity. To build more effective behavioral models, researchers are putting efforts on the use of behavioral events' data in advanced machine learning methods, such as Convolutional and Recurrent Neural Networks. Recently, the fledging Geometric Deep Learning research area has proposed Graph Neural Networks (GNNs), which are particularly suitable to model the data connections and interactions as entities and relationships of a graph. To exploit the benefits of using such models in network system intrusion detection, we propose a novel graph-based behavioral modeling approach using GNNs. Preliminary experiments have been carried out to measure the effectiveness of our approach on the UNSW-NB15 dataset. The results obtained show that our proposal reaches performances comparable, and in some cases, better than some state-of-the-art approach.