Jul 2026· International Conference on Control, Decision and Information Technologies· pp. 1940-1945· 0 citations· 13 references
Abstract
Enterprise security demands actionable threat prioritization across heterogeneous environments. To address the limitations of siloed log analysis, we propose a multi-source, graph-based anomaly detection framework. First, our architecture seamlessly fuses network telemetry from Vectra, Security Information and Event Management (SIEM) logs from QRadar, and endpoint data from CrowdStrike into a unified graph. Second, we utilize the Louvain algorithm to segment the network, identifying functional communities and critical bridge nodes indicative of lateral movement. Third, we extract over 50 structural, behavioral, and temporal features to train an XGBoost-based ensemble classifier. Evaluated on a real-world banking dataset with 31 anomaly types, the proposed system achieves 98% precision. Crucially, empirical analysis reveals that local neighborhood connectivity and traffic dynamics significantly outperform traditional global centrality metrics in detecting complex attacks. Finally, to support operational incident response, we implement a dynamic risk-scoring mechanism that translates model predictions into actionable, IP-level severity assessments across sliding time windows. Ultimately, this framework substantially enhances comprehensive threat visibility and analyst efficiency.
Intrusion Detection Systems (IDS) are essential tools for detecting and analyzing malicious system activity. Anomaly-based IDS have gained popularity due to their ability to detect zero-day attacks, unlike signature-based IDS. Although this approach is promising, recent AI-based IDS still suffer from high false positive rates, non-scalability and biases, which limit their practicality in real-world deployments.This paper presents GRAAL, an end-to-end unsupervised graph-based anomaly-based IDS that allows a scalable multi-level detection, achieves a low false positive rate, and provides intuitive and interpretable outputs to assist analysts in threat detection and investigation. GRAAL proposes a method to extract features from heterogeneous provenance graphs, using a combination of structural and attribute embeddings. These vectors are then processed by multiple autoencoder models to detect anomalies at both graph and system entity levels. GRAAL’s models leverage the relationship between the graph and entity levels, sharing knowledge through transfer learning and combining their results. We compare GRAAL against six state-of-the-art IDS on several datasets. These comparisons reveal methodological and reproducible biases in the evaluation of the current IDS and lead us to define best practices. To perform a comprehensive comparison, we mitigate biases still present in these state-of-the-art IDS. These extensive evaluations of GRAAL show that GRAAL outperforms these IDS, with a higher precision.
Fanny Dijoud, Pierre-François Gimenez, Michel Hurfin et al.· European Symposium on Securi...· 0 citations
Due to the explosive growth in cloud-native infrastructures, the attack surface has dramatically increased in modern enterprise identity systems, where privilege escalation has become a major security risk. Conventional rule-based intrusion detection systems fall short in identifying multi-hop privilege inheritance paths and lateral movements over heterogeneous and dynamic identity graphs. This study introduces PEGraphSec-Net, a graph-theoretical framework for detecting privilege-escalation-relevant identity behavior, modeling cloud identity interactions as dynamic heterogeneous graphs of users, services, roles, tokens, and workloads. The core contribution of this framework is a graph-based detection pipeline—an Identity Relationship Graph Constructor, a Privilege-Escalation Path Encoder, and a Temporal Graph Attention Detection layer—evaluated on privilege-escalation-relevant attack categories using a documented proxy identity-graph construction derived from the UNSW-NB15 network-traffic benchmark, and benchmarked against six non-graph tabular classifiers (CNN, LightGBM, XGBoost, Random Forest, SVM, and MLP) trained under identical preprocessing; this pipeline achieves 98.78% accuracy, a weighted F1-score of 0.98692 (macro F1-score of 0.91828), and an AUC of 1.000 on the held-out test partition. PEGraphSec-Net is further benchmarked against three graph neural network baselines (GCN, GAT, and GraphSAGE) trained on the identical identity-graph topology and node attributes; all three substantially underperform PEGraphSec-Net (best case, GraphSAGE: 63.66% accuracy, 0.239 macro F1-score), indicating that a large share of PEGraphSec-Net’s performance derives from its explicit privilege-path encoding and temporal attention mechanisms rather than from the graph topology alone. An Adaptive Containment and Isolation Engine and a Mitigation Policy Reinforcement Optimizer are further proposed as risk-scoring and reward-driven policy-learning components, whose contribution is validated through module-wise ablation on classification performance; live containment action and reinforcement-learning-specific evaluation are left for future validation. The term “privilege escalation” is used throughout to denote the evaluated proxy attack categories (Exploits, Backdoor/Backdoors, and Reconnaissance) under a documented, decade-old (2015) network-intrusion benchmark, rather than production cloud-native IAM behavior, for which native-dataset validation remains an open direction. SHAP-based interpretability analysis links the model’s top-ranked traffic-level features back to the identity-graph risk, role, and trust-transition attributes they populate, evidencing that the learned representation captures semantically meaningful identity-behavior patterns within this proxy setting.
Md. Nuruzzaman Pranto, Md. Deluar Hossen, Mamunur R. Raja et al.· Computers· 0 citations
An explainable deep learning framework evaluated across multiple heterogeneous cyber attack datasets, including Kitsune, Server-Based network data,enterprise logs, and Malware Traffic datasets, demonstrating the effectiveness of the proposed framework in handling heterogeneous network traffic while providing interpretable insights into model predictions.
: The modern network environment, whether enterprise systems or critical infrastructure, is increasingly exposed to sophisticated cyber threats that must be effectively detected. The existing GNN-based approaches construct graphs using feature-similarity heuristics, and connect flows that are statistically similar to one another but not necessarily communicating, hence capturing geometry specific to the dataset. On the other hand, communication topology is a representation of interaction patterns based on real network behaviour. We introduce TAE-MAGSAGE, an edge-centric graph learning model which uses the observed communication structure to construct graphs and applies a line graph transformation to perform flow-level classification without collapsing the interaction relationships. A Mahalanobis-inspired metric warp in message passing re-configures neighborhood similarity with respect to the discriminative feature dimensions, and a Ledoit–Wolf regularized Mahalanobis distance-based classifier learns class-conditional distributions to deal with severe class imbalance. TAE-MAGSAGE achieves an accuracy of 99.31% on the CIC-IDS-2017 dataset, macro F1 of 98.10%, and a false alarm rate of 0.56%, outperforming graph-based baselines. These results show that constructing graphs based on communication structure, combined with metric-conscious embedding and distribution-conscious classification, improves minority attack detection while reducing false alarms.
Poonam Nehru, Yunpeng Zhang, Renjie Hu et al.· Proceedings of the 21st Inte...· 0 citations
The current state of IT infrastructure creates a huge volume of logs, which cannot be effectively monitored manually nor detected by rule-based methods due to rapidly changing cyber threats. Therefore, this paper presents a solution based on explainable AI approaches that focuses on detecting anomalies in server logs using a specialized LogHub HDFS v1 benchmark dataset containing 113,896 labeled blocks. For this purpose, several statistical aggregations and log vectorizations are performed to calculate 34 behavioral features (for example, Shannon Entropy or rare event ratio). The proposed method includes a hybrid engine that incorporates an unsupervised Isolation Forest algorithm used for discovering new threats and a supervised model called XGBoost that helps detect known failure types. In order to increase transparency of such black box models, SHAP explanations were used. By leveraging SHAP explanations, specific log events that triggered alerts can be determined (such as write exceptions, E2, or verification failures, E23). As per rigorous evaluation, it is seen that whereas the isolated forest alone provided a ROC-AUC score of 0.99, the XGBoost model attained near perfect accuracy with an F1-Score of 99.84%. The resultant combined decision-making process ensures the best possible compromise between security, resulting in an accurate score of 97.40% with the extremely important Recall rate of 99.97% such that just one of the 3,368 anomalies were missed. With the ability to provide valuable insights at the milliseconds’ notice, the system converts automated log analysis into meaningful decision support.
D. P. Kumar, M. Prakya, G. Harshit et al.· 2026 4th International Confe...· 0 citations
The rapid adoption of 5G—offering ultra-low latency, enhanced connectivity, and massive throughput, broadens the network-security threat landscape. Monitoring intelligent anomaly detection systems for network security is now a necessity rather than an option. This paper presents a unique approach to Explainable Artificial Intelligence (XAI) for 5G networks using Shapley Additive Explanations (SHAP) and Local Interpretable Model-Agnostic Explanation (LIME), not only to discover anomalies but also to explain them coherently while providing intuitive interpretations. A novel framework was developed to augment the Canadian Institute for Cybersecurity Intrusion Detection System 2017 (CICIDS2017) dataset with simulated features such as latency and throughput associated specifically with 5G networks, training a Random Forest (RF) classifier yielding 91% accuracy (precision = 0.89, recall = 0.85). SHAP attributes a higher percentage of the model’s attack detection logic to three features—Backward Packet Length Minimum (Bwd Packet Length Min), Total Length of Forward Packets (Total Length of Fwd Packets), Flow inter-arrival time Minimum (Flow IAT Min), while LIME identifies causal trigger points like explicit congestion notification echo (ECE) Flag Count spikes. For the real-time evaluation and benchmarking, we compare the efficiencies of RF, Deep Neural Networks (DNN), and Autoencoders. We find that RF is remarkably fast for real-time explainability compared to its counterparts. The new framework enables network administrators to make informed decisions based on concrete evidence, which marks a progressive achievement in explainable 5G security technology.
G. A. Ajibade, Ebenezer Esenogho, Cameron Modisane· IEEE Access· 0 citations