Accurate Encrypted Malicious Traffic Identification via Traffic Interaction Pattern Using Graph Convolutional Network
Telecommuting and telelearning have gradually become mainstream lifestyles in the post-epidemic era. The extensive interconnection of massive terminals gives attackers more opportunities, which brings more significant challenges to network traffic security analysis. The existing attacks, often using encryption technology and distributed attack methods, increase the number and complexity of attacks. However, the traditional methods need more analysis of encrypted malicious traffic interaction patterns and cannot explore the potential correlations of interaction patterns in a macroscopic and comprehensive manner. Anyway, the changes in interaction patterns caused by attacks also need further study. Therefore, to achieve accurate and effective identification of attacks, it is essential to comprehensively describe the interaction patterns of malicious traffic and portray the relations of interaction patterns with the appearance of attacks. We propose a method for classifying attacks based on the traffic interaction attribute graph, named G-TIAG. At first, the G-TIAG studies interaction patterns of traffic describes the construction rule of the graphs and selects the attributive features of nodes in each graph. Then, it uses a convolutional graph network with a GRU and self-attention to classify benign data and different attacks. Our approach achieved the best classification results, with 89% accuracy and F1-Score, 88% recall, respectively, on publicly available datasets. The improvement is about 7% compared to traditional machine learning classification results and about 6% compared to deep learning classification results, which finally successfully achieved the classification of attacks.
314
- 10.1109/infocom.2019.8737507
- Apr 1, 2019
800
- 10.14722/ndss.2018.23204
- Jan 1, 2018
91
- 10.1109/tcns.2016.2532804
- Jun 1, 2017
- IEEE Transactions on Control of Network Systems
23
- 10.1007/s10489-021-03138-z
- Mar 1, 2022
- Applied Intelligence
2163
- 10.1109/tits.2019.2935152
- Dec 31, 2018
- IEEE Transactions on Intelligent Transportation Systems
71
- 10.1109/icdmw.2017.93
- Nov 1, 2017
77
- 10.1007/s12530-020-09347-0
- Jun 15, 2020
- Evolving Systems
17
- 10.1016/j.jnca.2021.103079
- Apr 20, 2021
- Journal of Network and Computer Applications
73
- 10.1109/tifs.2022.3208815
- Jan 1, 2022
- IEEE Transactions on Information Forensics and Security
310
- 10.1109/cvpr.2019.01157
- Jun 1, 2019
- Conference Article
- 10.1109/iscait64916.2025.11010233
- Mar 21, 2025
Research on Interactive Network Traffic Anomaly Detection Method with Advice Fusion
- Conference Article
- 10.1109/ngdn61651.2024.10744095
- Apr 26, 2024
A Method for Detecting Post-Exploitation Malicious Communication Traffic Based on Hypergraph Neural Networks
- Book Chapter
1
- 10.1007/978-981-99-9331-4_30
- Jan 1, 2024
Anomaly Detection Method for Integrated Encrypted Malicious Traffic Based on RFCNN-GRU
- Research Article
1
- 10.3390/electronics12102313
- May 20, 2023
- Electronics
Classifying mobile applications from encrypted network traffic is a common and basic requirement in network security and network management. Existing works classify mobile applications from flows, based on which application fingerprints and classifiers are created. However, mobile applications often generate concurrent flows with varying degrees of ties, such as low discriminative flows across applications and application-specific flows. So flow-based methods suffer from low accuracy. In this paper, a novel mobile application-classifying method is proposed, capturing relationships between flows and paying attention to their importance. To capture the inter-flow relationships, the proposed method slices raw mobile traffic into traffic chunks to represent flows as nodes, embeds statistical features into nodes, and adds edges according to cross-correlations between the nodes. To pay different attention to the various flows, the proposed method builds a deep learning model based on graph attention networks, implicitly assigning importance values to flows via graph attention layers. Compared to recently developed techniques on a large dataset with 101 popular apps using the Android platform, the proposed method improved by 4–20% for accuracy, precision, recall, and F1 score, and spent much less time training.
- Research Article
- 10.3390/app142210366
- Nov 11, 2024
- Applied Sciences
While encryption enhances data security, it also presents significant challenges for network traffic analysis, especially in detecting malicious activities. To tackle this challenge, this paper introduces combined Attention-aware Feature Fusion and Communication Graph Embedding Learning (AFF_CGE), an advanced representation learning framework designed for detecting encrypted malicious traffic. By leveraging an attention mechanism and graph neural networks, AFF_CGE extracts rich semantic information from encrypted traffic and captures complex relations between communicating nodes. Experimental results reveal that AFF_CGE substantially outperforms traditional methods, improving F1-scores by 5.3% through 22.8%. The framework achieves F1-scores ranging from 0.903 to 0.929 across various classifiers, exceeding the performance of state-of-the-art techniques. These results underscore the effectiveness and robustness of AFF_CGE in detecting encrypted malicious traffic, demonstrating its superior performance.
- Research Article
- 10.1016/j.comnet.2025.111184
- May 1, 2025
- Computer Networks
RAGN: Detecting unknown malicious network traffic using a robust adaptive graph neural network
- Research Article
49
- 10.1016/j.patcog.2019.06.012
- Jul 2, 2019
- Pattern Recognition
Learning graph structure via graph convolutional networks
- Research Article
3
- 10.1155/2022/2276318
- Aug 12, 2022
- Computational intelligence and neuroscience
The automatic identification of disease types of edible mushroom crops and poisonous crops is of great significance for improving crop yield and quality. Based on the graph convolutional neural network theory, this paper constructs a graph convolutional network model for the identification of poisonous crops and edible fungi. By constructing 6 graph convolutional networks with different depths, the model uses the training mechanism of graph convolutional networks to analyze the results of disease identification and completes the automatic extraction of the disease characteristics of the poisonous crops by overfitting problem. During the simulation, firstly, the relevant PlantVillage dataset is used to obtain the pretrained model, and the parameters are adjusted to fit the dataset. The network framework is trained and parameterized with prior knowledge learned from large datasets and finally synthesized by training multiple neural network models and using direct averaging and weighting to synthesize their predictions. The experimental results show that the graph convolutional neural network model that integrates multi-scale category relationships and dense links can use dense connection technology to improve the representation ability and generalization ability of the model, and the accuracy rate generally increases by 1%–10%. The average recognition rate is about 91%, which greatly promotes the ability to identify the diseases of poisonous crops.
- Conference Article
- 10.1117/12.2681612
- Jun 1, 2023
With the rapid development of graph neural network technology, its application in the field of natural language processing is more and more extensive, text classification is one of the important applications, everyday life will produce a large number of non-Euclidean text data, while the traditional classification methods in the graphic structure of text data has been a great challenge. Graph convolutional neural network(GCN) is considered to be able to model the structural attributes and node feature information of graphs well, and is gradually becoming a good choice for text classification of graph data. This paper proposes a text classification model based on graph convolution network and neural network local enhancement. On the basis of using GCN to extract features, Bi-LSTM method is used to balance the experimental results, enrich the feature information by capturing local information, integrate the attention mechanism, and fuse the evaluation values to improve the accuracy of classification. It is verified that this method has achieved better results than the existing classification methods in many classical data sets such as 20NG and OHSUMED.
- Research Article
7
- 10.1049/ipr2.12632
- Sep 25, 2022
- IET Image Processing
Hyperspectral images (HSIs) contain hundreds of continuous spectral bands and are rich in spectral‐spatial information. In terms of HSIs’ classification, traditional convolutional neural networks (CNNs) extract features based on HSI's spectral‐spatial information through 2D convolution. However, 2D convolution extracts features in 2D plane without considering the relationships between spectral bands, which inevitably leads to insufficient feature extraction. 3D convolutional neural networks (3DCNNs) take account of the correlations among spectral bands and outperform 2D convolutional networks in feature extraction, but the computational cost is rather expensive. To address the above problem, a light‐weight three‐layer 3D convolutional network Module (3D‐M) for HSIs’ spectral‐spatial feature extraction is proposed. Another challenge is that neither 2D convolution nor 3D convolution utilizes the structural information inherent in the data. Graph convolution networks (GCNs) can model and utilize such information through the similarity matrix, also known as adjacency matrix. However, traditional GCNs cannot handle large‐scale data because they construct adjacency matrix on all data, which results in high computational complexity and large storage requirement. To conquer this challenge, this article proposes a batch‐graph strategy on which a scalable GCN is developed. Finally, a hybrid network model (HNM) based on the proposed light‐weight 3D‐M and scalable GCN is presented. HNM extracts spectral‐spatial features of HSIs with low computational complexity through the light‐weight 3D convolution network and leverages the structural information in data via the scalable GCN. The experimental results on three public datasets with different sizes demonstrate that the proposed HNM produces better classification results than other state‐of‐the‐art hyperspectral images classification models in terms of overall accuracy (OA), average accuracy (AA) and kappa coefficient (Kappa).
- Research Article
1
- 10.1155/2024/1728801
- Apr 26, 2024
- International Journal of Intelligent Systems
Precisely segmenting the organs at risk (OARs) in computed tomography (CT) plays an important role in radiotherapy’s treatment planning, aiding in the protection of critical tissues during irradiation. Renowned deep convolutional neural networks (DCNNs) and prevailing transformer-based architectures are widely utilized to accomplish the segmentation task, showcasing advantages in capturing local and contextual characteristics. Graph convolutional networks (GCNs) are another specialized model designed for processing the nongrid dataset, e.g., citation relationship. The DCNNs and GCNs are considered as two distinct models applicable to the grid and nongrid datasets, respectively. Motivated by the recently developed dynamic-channel GCN (DCGCN) that attempts to leverage the graph structure to enhance the feature extracted by the DCNNs, this paper proposes a novel architecture termed adaptive sparse GCN (ASGCN) to mitigate the inherent limitations in DCGCN from the aspect of node’s representation and adjacency matrix’s construction. For the node’s representation, the global average pooling used in the DCGCN is replaced by the learning mechanism to accommodate the segmentation task. For the adjacency matrix, an adaptive regularization strategy is leveraged to penalize the coefficient in the adjacency matrix, resulting in a sparse one that can better exploit the relationships between nodes. Rigorous experiments on multiple OARs’ segmentation tasks of the head and neck demonstrate that the proposed ASGCN can effectively improve the segmentation accuracy. Comparison between the proposed method and other prevalent architectures further confirms the superiority of the ASGCN.
- Research Article
17
- 10.3390/app12189176
- Sep 13, 2022
- Applied Sciences
Graph convolutional neural networks (GCNNs) have been successfully applied to a wide range of problems, including low-dimensional Euclidean structural domains representing images, videos, and speech and high-dimensional non-Euclidean domains, such as social networks and chemical molecular structures. However, in computer vision, the existing GCNNs are not provided with positional information to distinguish between graphs of new structures; therefore, the performance of the image classification domain represented by arbitrary graphs is significantly poor. In this work, we introduce how to initialize the positional information through a random walk algorithm and continuously learn the additional position-embedded information of various graph structures represented over the superpixel images we choose for efficiency. We call this method the graph convolutional network with learnable positional embedding applied on images (IMGCN-LPE). We apply IMGCN-LPE to three graph convolutional models (the Chebyshev graph convolutional network, graph convolutional network, and graph attention network) to validate performance on various benchmark image datasets. As a result, although not as impressive as convolutional neural networks, the proposed method outperforms various other conventional convolutional methods and demonstrates its effectiveness among the same tasks in the field of GCNNs.
- Research Article
4
- 10.3390/buildings12122233
- Dec 15, 2022
- Buildings
Deep learning technology, such as fully convolutional networks (FCNs), have shown competitive performance in the automatic extraction of buildings from high-resolution aerial images (HRAIs). However, there are problems of over-segmentation and internal cavity in traditional FCNs used for building extraction. To address these issues, this paper proposes a new building graph convolutional network (BGC-Net), which optimizes the segmentation results by introducing the graph convolutional network (GCN). The core of BGC-Net includes two major modules. One is an atrous attention pyramid (AAP) module, obtained by fusing the attention mechanism and atrous convolution, which improves the performance of the model in extracting multi-scale buildings through multi-scale feature fusion; the other is a dual graph convolutional (DGN) module, the build of which is based on GCN, which improves the segmentation accuracy of object edges by adding long-range contextual information. The performance of BGC-Net is tested on two high spatial resolution datasets (Wuhan University building dataset and a Chinese typical city building dataset) and compared with several state-of-the-art networks. Experimental results demonstrate that the proposed method outperforms several state-of-the-art approaches (FCN8s, DANet, SegNet, U-Net, ARC-Net, BAR-Net) in both visual interpretation and quantitative evaluations. The BGC-Net proposed in this paper has better results when extracting the completeness of buildings, including boundary segmentation accuracy, and shows great potential in high-precision remote sensing mapping applications.
- Research Article
15
- 10.1063/5.0105020
- Sep 1, 2022
- Journal of Renewable and Sustainable Energy
Solar irradiance data include temporal information and geospatial information, so solar irradiance prediction can be regarded as a spatiotemporal sequence prediction problem. However, at present, most of the research is based on time series prediction models, and the research studies on spatial-temporal series prediction models are relatively few. Therefore, it is necessary to integrate spatial-temporal information to construct a spatial-temporal sequence prediction model for research. In this paper, the spatial-temporal prediction model based on graph convolutional network (GCN) and long short-term memory network (LSTM) was established for short-term solar irradiance prediction. In this model, solar radiation observatories were modeled as undirected graphs, where each node corresponds to an observatory, and a GCN was used to capture spatial correlations between sites. For each node, temporal features were extracted by using a LSTM. In order to evaluate the prediction performance of this model, six solar radiation observatories located in the Xinjiang region of China were selected; together with widely used persistence model seasonal autoregressive integrated moving average and data-driven prediction models such as convolutional neural network, recurrent neural network, and LSTM, comparisons were made under different seasons and weather conditions. The experimental results show that the average root mean square error of the GCN-LSTM model at the six sites is 62.058 W/m2, which is reduced by 9.8%, 14.3%, 6.9%, and 3.3%, respectively, compared with other models; the average MAE is 25.376 W/m2, which is reduced by 27.7%, 26.5%, 20.1%, and 11%, respectively, compared with other models; the average R2 is 0.943, which is improved by 1.4%, 2.2%, 0.8%, and 0.4%, respectively, compared with other models.
- Research Article
14
- 10.3390/s22135006
- Jul 2, 2022
- Sensors (Basel, Switzerland)
Network data traffic is increasing with expanded networks for various applications, with text, image, audio, and video for inevitable needs. Network traffic pattern identification and analysis of traffic of data content are essential for different needs and different scenarios. Many approaches have been followed, both before and after the introduction of machine and deep learning algorithms as intelligence computation. The network traffic analysis is the process of incarcerating traffic of a network and observing it deeply to predict what the manifestation in traffic of the network is. To enhance the quality of service (QoS) of a network, it is important to estimate the network traffic and analyze its accuracy and precision, as well as the false positive and negative rates, with suitable algorithms. This proposed work is coining a new method using an enhanced deep reinforcement learning (EDRL) algorithm to improve network traffic analysis and prediction. The importance of this proposed work is to contribute towards intelligence-based network traffic prediction and solve network management issues. An experiment was carried out to check the accuracy and precision, as well as the false positive and negative parameters with EDRL. Also, convolutional neural network (CNN) machines and deep learning algorithms have been used to predict the different types of network traffic, which are labeled text-based, video-based, and unencrypted and encrypted data traffic. The EDRL algorithm has outperformed with mean Accuracy (97.20%), mean Precision (97.343%), mean false positive (2.657%) and mean false negative (2.527%) than the CNN algorithm.
- Research Article
5
- 10.1108/dta-02-2022-0056
- Feb 7, 2023
- Data Technologies and Applications
PurposeA community demonstrates the unique qualities and relationships between its members that distinguish it from other communities within a network. Network analysis relies heavily on community detection. Despite the traditional spectral clustering and statistical inference methods, deep learning techniques for community detection have grown in popularity due to their ease of processing high-dimensional network data. Graph convolutional neural networks (GCNNs) have received much attention recently and have developed into a potential and ubiquitous method for directly detecting communities on graphs. Inspired by the promising results of graph convolutional networks (GCNs) in analyzing graph structure data, a novel community graph convolutional network (CommunityGCN) as a semi-supervised node classification model has been proposed and compared with recent baseline methods graph attention network (GAT), GCN-based technique for unsupervised community detection and Markov random fields combined with graph convolutional network (MRFasGCN).Design/methodology/approachThis work presents the method for identifying communities that combines the notion of node classification via message passing with the architecture of a semi-supervised graph neural network. Six benchmark datasets, namely, Cora, CiteSeer, ACM, Karate, IMDB and Facebook, have been used in the experimentation.FindingsIn the first set of experiments, the scaled normalized average matrix of all neighbor's features including the node itself was obtained, followed by obtaining the weighted average matrix of low-dimensional nodes. In the second set of experiments, the average weighted matrix was forwarded to the GCN with two layers and the activation function for predicting the node class was applied. The results demonstrate that node classification with GCN can improve the performance of identifying communities on graph datasets.Originality/valueThe experiment reveals that the CommunityGCN approach has given better results with accuracy, normalized mutual information, F1 and modularity scores of 91.26, 79.9, 92.58 and 70.5 per cent, respectively, for detecting communities in the graph network, which is much greater than the range of 55.7–87.07 per cent reported in previous literature. Thus, it has been concluded that the GCN with node classification models has improved the accuracy.
- Book Chapter
2
- 10.1007/978-3-030-96737-6_12
- Jan 1, 2022
Anomalies represent rare observations that vary significantly from others. Anomaly detection intended to discover these rare observations and has the power to prevent detrimental events, such as financial fraud, network intrusion, and social spam. However, conventional anomaly detection methods cannot handle this problem well because of the complexity of graph data (e.g., irregular structures, relational dependencies, node/edge types/attributes/directions/multiplicities/weights, large scale, etc.) (Ma X, Wu J, Xue S, Yang J, Zhou C, Sheng QZ, Xiong H, Akoglu L. IEEE Trans Knowl Data Eng, 2021 [1]). Thanks to the rise of deep learning in solving these limitations, graph anomaly detection with deep learning has obtained an increasing attention from many scientists recently. However, while deep learning can capture unseen patterns of multi-dimensional Euclidean data, there is a huge number of applications where data are represented in the form of graphs. Graphs have been used to represent the structural relational information, which raises the graph anomaly detection problem—identifying anomalous graph objects (i.e., vertex, edges, sub-graphs, and change detection). These graphs can be constructed as a static graph, or a dynamic graph based on the availability of timestamp. Recent years have observed a huge efforts on static graphs, among which Graph Convolutional Network (GCN) has appeared as a useful class of models. A challenge today is to detect anomalies with dynamic structures. In this chapter, we aim at providing methods used for detecting anomalies in static and dynamic graphs using graph analysis, graph embedding, and graph convolutional neural networks. For static graphs we categorize these methods according to plain and attribute static graphs. For dynamic graphs we categorize existing methods according to the type of anomalies that they can detect. Moreover, we focus on the challenges in this research area and discuss the strengths and weaknesses of various methods in each category. Finally, we provide open challenges for graph anomaly detection using graph convolutional neural networks on dynamic graphs.KeywordsAnomaly detectionGraph anomaly detectionGraph analysisGraph embeddingGraph neural networkDynamic graphsStatic graphs
- Research Article
1
- 10.1051/bioconf/202411103017
- Jan 1, 2024
- BIO Web of Conferences
Epilepsy detection is a critical medical task, but traditional methods face challenges in accuracy and reliability due to the difficulty of EEG data acquisition and the limitation of the number of sample seizures. To overcome these challenges, this paper proposes a new model for epilepsy detection that combines Graph Convolutional Neural Network (Graph Convolutional Network, GCN) and Transformer, aiming to significantly improve the accuracy and sensitivity of detection. The core of the model adopts GCN, which utilizes its powerful inter-node relationship capturing capability and graph feature learning mechanism. However, due to the limitation of traditional GCN in integrating global features, this model incorporates the Transformer structure to enhance global feature aggregation and reduce irrelevant feature interactions. After multiple rounds of testing of the GHB-MIT dataset, the model demonstrated excellent performance, with an average sensitivity of 92.97%, specificity of 94.60%, and accuracy of 94.59%, which was significantly better than the traditional method. Further comparison with the latest literature also confirms the advantages of the present method. In summary, the epilepsy detection model we developed based on graph convolutional neural network and Transformer not only shows significant improvement in accuracy and sensitivity, but also provides more accurate and reliable technical support for epilepsy diagnosis, which provides a valuable reference for research in related fields.
- Conference Article
5
- 10.1145/3480571.3480575
- Jul 29, 2021
Geometric deep learning provides a principled and universal way for the integration of imaging and non-imaging modes in the medical field. Graph Convolutional Networks (GCNs) have been widely explored in a variety of problems, such as disease prediction, segmentation, and matrix completion. Using large, multi-modal data sets, graphs can capture the interaction of individual elements represented as nodes in the graphs. In particular, in medical applications, nodes can represent individuals (patients or healthy controls) in a potentially large population and are accompanied by a set of features, while the edges of the graph contain the associations between subjects in an intuitive way. This representation allows the inclusion of rich imaging and non-imaging information as well as individual subject characteristics in the task of disease classification. This article gives an overview of graph convolutional neural networks, focusing on the application of graph convolutional neural networks in disease prediction, and discusses the challenges and prospects of graph convolutional neural networks in disease prediction.
- Research Article
3
- 10.1016/j.dsp.2023.104156
- Jul 24, 2023
- Digital Signal Processing
Dynamic Jacobi graph and trend-aware flow attention convolutional network for traffic forecasting
- Research Article
15
- 10.1007/s00330-023-10414-8
- Nov 14, 2023
- European Radiology
ObjectivesDramatic brain morphological changes occur throughout the third trimester of gestation. In this study, we investigated whether the predicted brain age (PBA) derived from graph convolutional network (GCN) that accounts for cortical morphometrics in third trimester is associated with postnatal abnormalities and neurodevelopmental outcome.MethodsIn total, 577 T1 MRI scans of preterm neonates from two different datasets were analyzed; the NEOCIVET pipeline generated cortical surfaces and morphological features, which were then fed to the GCN to predict brain age. The brain age index (BAI; PBA minus chronological age) was used to determine the relationships among preterm birth (i.e., birthweight and birth age), perinatal brain injuries, postnatal events/clinical conditions, BAI at postnatal scan, and neurodevelopmental scores at 30 months.ResultsBrain morphology and GCN-based age prediction of preterm neonates without brain lesions (mean absolute error [MAE]: 0.96 weeks) outperformed conventional machine learning methods using no topological information. Structural equation models (SEM) showed that BAI mediated the influence of preterm birth and postnatal clinical factors, but not perinatal brain injuries, on neurodevelopmental outcome at 30 months of age.ConclusionsBrain morphology may be clinically meaningful in measuring brain age, as it relates to postnatal factors, and predicting neurodevelopmental outcome.Clinical relevance statementUnderstanding the neurodevelopmental trajectory of preterm neonates through the prediction of brain age using a graph convolutional neural network may allow for earlier detection of potential developmental abnormalities and improved interventions, consequently enhancing the prognosis and quality of life in this vulnerable population.Key Points•Brain age in preterm neonates predicted using a graph convolutional network with brain morphological changes mediates the pre-scan risk factors and post-scan neurodevelopmental outcomes.•Predicted brain age oriented from conventional deep learning approaches, which indicates the neurodevelopmental status in neonates, shows a lack of sensitivity to perinatal risk factors and predicting neurodevelopmental outcomes.•The new brain age index based on brain morphology and graph convolutional network enhances the accuracy and clinical interpretation of predicted brain age for neonates.
- New
- Research Article
- 10.3390/app152111838
- Nov 6, 2025
- Applied Sciences
- New
- Research Article
- 10.3390/app152111830
- Nov 6, 2025
- Applied Sciences
- New
- Research Article
- 10.3390/app152111846
- Nov 6, 2025
- Applied Sciences
- New
- Research Article
- 10.3390/app152111831
- Nov 6, 2025
- Applied Sciences
- New
- Research Article
- 10.3390/app152111833
- Nov 6, 2025
- Applied Sciences
- New
- Research Article
- 10.3390/app152111823
- Nov 6, 2025
- Applied Sciences
- New
- Research Article
- 10.3390/app152111845
- Nov 6, 2025
- Applied Sciences
- New
- Research Article
- 10.3390/app152111840
- Nov 6, 2025
- Applied Sciences
- New
- Research Article
- 10.3390/app152111825
- Nov 6, 2025
- Applied Sciences
- New
- Research Article
- 10.3390/app152111820
- Nov 6, 2025
- Applied Sciences
- Ask R Discovery
- Chat PDF