Malicious Node Identification for DNS Data Using Graph Convolutional Networks

Graph Learning has gotten increased attention nowadays. The machine learning fraternity is working towards application of Graph learning coupled with deep neural networks to design and develop state-of-the-art models for problems where data can be represented as knowledge graphs. The simplicity and effective visualization makes this more attractive. DNS is such a huge dynamic network where millions of nodes and connections are available. Thus it is always preferable to use a large dataset for analyzing DNS. In this paper, we introduce the largest ever reported knowledge graph for DNS- node classification problem which has over 6.23 million nodes and 93 million connections. The results and model performance are found to be promising and interesting. We have got an accuracy of 0.95 with a simple GCN model. The dependency of model performance upon feature selection and type of edges (graph density) is also studied in detail. It is evident that choosing a valid set of features improves the model performance phenomenally whereas addition of less important edges, just to make graph dense contribute at a lesser rate towards the model performance improvement.