A Graph Neural Network Detection Scheme for Malicious Behavior Knowledge Base (original) (raw)

Abstract

Network intelligence has become an important trend in modern communication networks. In the future 6G network, the unrestricted communication between massive heterogeneous terminals will lead to more and more kinds of DDoS attacks, which will become an important factor affecting network security. In this paper, we propose a knowledge base detection scheme for malicious behavior of DDoS attacks based on graph neural networks. First, this paper constructs a malicious behavior knowledge base for a variety of common DDoS attacks. Considering the problem of multi-source heterogeneity under 6G network, this paper proposes a malicious behavior knowledge graph construction algorithm, which constructs a global malicious behavior knowledge graph from both address correlation and time correlation of network services. And the graph attention network is introduced on the basis of the knowledge graph to identify the malicious behaviors occurring in the network. The experimental results show that the detection scheme can enrich the feature representation of malicious behavior nodes. The scheme has a better performance compared with the machine learning scheme, and ultimately reduces the malicious traffic caused by DDoS attacks by more than an order of magnitude.

Similar content being viewed by others

References

  1. Yang, H., Alphones, A., Xiong, Z., Niyato, D., Zhao, J., Wu, K.: Artificial-intelligence-enabled intelligent 6G networks. IEEE Network 34(6), 272–280 (2020)
    Article Google Scholar
  2. Guo, J., Wang, L.: Learning to upgrade internet information security and protection strategy in big data era. Comput. Commun. 160, 150–157 (2020)
    Article Google Scholar
  3. Jing, X., Yan, Z., Pedrycz, W.: Security data collection and data analytics in the internet: a survey. IEEE Commun. Surv. Tutor. 21(1), 586–618 (2018)
    Article Google Scholar
  4. Galeano-Brajones, J., Carmona-Murillo, J., Valenzuela-Valdés, J., Luna-Valero, F.: Detection and mitigation of dos and DDoS attacks in IoT-based stateful SDN: an experimental approach. Sensors 20(3), 816 (2020)
    Article Google Scholar
  5. Qi, G., Gao, H., Wu, T.: The research advances of knowledge graph. Technol. Intell. Eng. 3(1), 4–25 (2017)
    Google Scholar
  6. Arshi, M., Nasreen, M., Madhavi, K.: A survey of DDoS attacks using machine learning techniques. In: E3S Web of Conferences, vol. 184, p. 01052. EDP Sciences (2020)
    Google Scholar
  7. Obrst, L., Chase, P., Markeloff, R.: Developing an ontology of the cyber security domain. In: STIDS, pp. 49–56. Citeseer (2012)
    Google Scholar
  8. Sadighian, A., Fernandez, J.M., Lemay, A., Zargar, S.T.: ONTIDS: a highly flexible context-aware and ontology-based alert correlation framework. In: Danger, J.-L., Debbabi, M., Marion, J.-Y., Garcia-Alfaro, J., Zincir Heywood, N. (eds.) FPS -2013. LNCS, vol. 8352, pp. 161–177. Springer, Cham (2014). https://doi.org/10.1007/978-3-319-05302-8_10
    Chapter Google Scholar
  9. Chen, X., Jia, S., Xiang, Y.: A review: knowledge reasoning over knowledge graph. Expert Syst. Appl. 141, 112948 (2020)
    Article Google Scholar
  10. Pujol-Perich, D., Suárez-Varela, J., Cabellos-Aparicio, A., Barlet-Ros, P.: Unveiling the potential of graph neural networks for robust intrusion detection. ACM SIGMETRICS Perform. Eval. Rev. 49(4), 111–117 (2022)
    Article Google Scholar
  11. Nagaraj, K., Starke, A., McNair, J.: Glass: a graph learning approach for software defined network based smart grid DDoS security. In: ICC 2021-IEEE International Conference on Communications, pp. 1–6. IEEE (2021)
    Google Scholar
  12. Cao, Y., Jiang, H., Deng, Y., Wu, J., Zhou, P., Luo, W.: Detecting and mitigating DDoS attacks in SDN using spatial-temporal graph convolutional network. IEEE Trans. Dependable Secure Comput. 19(6), 3855–3872 (2021)
    Article Google Scholar
  13. Veličković, P., Cucurull, G., Casanova, A., Romero, A., Lio, P., Bengio, Y.: Graph attention networks. arXiv preprint arXiv:1710.10903 (2017)
  14. Li, M., Zhou, H., Qin, Y.: Two-stage intelligent model for detecting malicious DDoS behavior. Sensors 22(7), 2532 (2022)
    Article Google Scholar

Download references

Acknowledgements

This paper is supported by National Key R&D Program of China under Grant No. 2018YFA0701604.

Author information

Authors and Affiliations

  1. School of Electronic and Information Engineering, Beijing Jiaotong University, Beijing, 100044, China
    OuYang Liu, Kun Li, Ziwei Yin & Huachun Zhou

Authors

  1. OuYang Liu
  2. Kun Li
  3. Ziwei Yin
  4. Huachun Zhou

Corresponding author

Correspondence toKun Li .

Editor information

Editors and Affiliations

  1. Kookmin University, Seoul, Korea (Republic of)
    Ilsun You
  2. Sangmyung University, Cheonan-si, Korea (Republic of)
    Hwankuk Kim
  3. Middle East Technical University, Ankara, Türkiye
    Pelin Angin

Rights and permissions

© 2023 The Author(s), under exclusive license to Springer Nature Singapore Pte Ltd.

About this paper

Cite this paper

Liu, O., Li, K., Yin, Z., Zhou, H. (2023). A Graph Neural Network Detection Scheme for Malicious Behavior Knowledge Base. In: You, I., Kim, H., Angin, P. (eds) Mobile Internet Security. MobiSec 2022. Communications in Computer and Information Science, vol 1644. Springer, Singapore. https://doi.org/10.1007/978-981-99-4430-9\_9

Download citation

Keywords

Publish with us