MDPI - Publisher of Open Access Journals

37 pages, 18036 KiB

Open AccessArticle

Node Classification of Network Threats Leveraging Graph-Based Characterizations Using Memgraph

by Sadaf Charkhabi, Peyman Samimi, Sikha S. Bagui, Dustin Mink and Subhash C. Bagui

Computers 2024, 13(7), 171; https://doi.org/10.3390/computers13070171 - 15 Jul 2024

Viewed by 610

This research leverages Memgraph, an open-source graph database, to analyze graph-based network data and apply Graph Neural Networks (GNNs) for a detailed classification of cyberattack tactics categorized by the MITRE ATT&CK framework. As part of graph characterization, the page rank, degree centrality, betweenness centrality, and Katz centrality are presented. Node classification is utilized to categorize network entities based on their role in the traffic. Graph-theoretic features such as in-degree, out-degree, PageRank, and Katz centrality were used in node classification to ensure that the model captures the structure of the graph. The study utilizes the UWF-ZeekDataFall22 dataset, a newly created dataset which consists of labeled network logs from the University of West Florida’s Cyber Range. The uniqueness of this study is that it uses the power of combining graph-based characterization or analysis with machine learning to enhance the understanding and visualization of cyber threats, thereby improving the network security measures. Full article

(This article belongs to the Special Issue Human Understandable Artificial Intelligence 2024)

► Show Figures

Figure 1

30 pages, 16108 KiB

Open AccessArticle

Graphical Representation of UWF-ZeekData22 Using Memgraph

by Sikha S. Bagui, Dustin Mink, Subhash C. Bagui, Dae Hyun Sung and Farooq Mahmud

Electronics 2024, 13(6), 1015; https://doi.org/10.3390/electronics13061015 - 7 Mar 2024

Viewed by 1133

Abstract

This work uses Memgraph, an open-source graph data platform, to analyze, visualize, and apply graph machine learning techniques to detect cybersecurity attack tactics in a newly created Zeek Conn log dataset, UWF-ZeekData22, generated in The University of West Florida’s cyber simulation environment. The dataset is transformed to a representative graph, and the graph’s properties studied in this paper are PageRank, degree, bridge, weakly connected components, node and edge cardinality, and path length. Node classification is used to predict the connection between IP addresses and ports as a form of attack tactic or non-attack tactic in the MITRE framework, implemented using Memgraph’s graph neural networks. Multi-classification is performed using the attack tactics, and three different graph neural network models are compared. Using only three graph features, in-degree, out-degree, and PageRank, Memgraph’s GATJK model performs the best, with source node classification accuracy of 98.51% and destination node classification accuracy of 97.85%. Full article

(This article belongs to the Special Issue Advances in Graph-Based Data Mining)

► Show Figures

Figure 1

Search Results (2)

Further Information

Guidelines

MDPI Initiatives

Follow MDPI

Saved Queries

Search Filter Reset All

Years

Feature Papers

Subjects

Journals

Article Types

Countries / Regions

Search Results (2)

Further Information

Guidelines

MDPI Initiatives

Follow MDPI