Abstract

The rapid expansion of Internet of Things (IoT) devices and advanced high-speed data transmission networks has complicated modern cyber attacks to the point that it is now relatively simple for attackers to evade the traditional security controls in place. The current generation of standard Intrusion Detection Systems (IDS) has a significant limitation in that they are based on signatures, which are merely an inventory of all of the previously identified threats to computer systems. Therefore, if there is a new type of attack that has not been previously identified or is a slightly altered version of an existing attack, then the IDS will not detect it, and therefore will provide no alerts to the security personnel. Although it is not a perfect solution, one potential solution that addresses the shortcomings of IDS is Deep Learning. Deep Learning could be considered useful in identifying known attack types using Supervised Learning. However, it is significantly less effective in identifying any kind of a Zero-Day attack. In order to address this limitation, Unsupervised Learning could be applied to identify any distinct activity or pattern within a user’s behavior. However, many Unsupervised Learning techniques are unable to provide sufficient accuracy to accurately distinguish the actual type of attack being detected. Although some Unsupervised Learning techniques may be used to discover statistical anomalies, they typically do not provide specific details regarding the attack. This paper proposes a hybrid framework combining a supervised Graph Attention Network (GAT) and an unsupervised Graph Auto-Encoder (GAE) into a single architecture, allowing us to benefit from both high-accuracy feature extraction capabilities of the supervised GAT, and the flexibility of the unsupervised GAE. Rather than treating each packet in a network as an independent and unconnected static unit of data, we define the traffic (or stream) across the entire network through temporal connection windows. The GAT serves as the primary means to detect known threats, with an accuracy of 91.24%. The GAE is used to verify the classification of ‘normal’ traffic by checking for possible Zero-Day anomalies via reconstruction errors with a threshold set at 0.6. Evaluation results using the UNSW-NB15 dataset demonstrate that this multi-layered framework is more stable and has a higher ability to detect threats than traditional CNN and GCN methods.