GraphCyber: Identifying IP Usage Scenarios for Cyberspace Mapping

Understanding the network characteristics of IP nodes and identifying their potential usage scenarios are crucial for cyberspace applications, such as asset evaluation, fraud prevention, and network attack prevention. However, many studies related to IP nodes primarily focused on IP geolocation and anomaly detection, with very little attention given to IP usage. Identifying the usage scenarios of IP node can facilitate network optimization, enhance security and improve resource allocation, which is crucial for network management and security. In this work, we propose a novel framework named GraphCyber based on graph neural network to identify street-level IP usage for cyberspace mapping. We first design a topology rule-based approach dividing a large number of IP nodes into regional blocks. Then we devise regional blocks to fuse the self-information of IP nodes and various neighborhood relationships into the graph. Last, based on an uncertainty-aware graph neural network, we identify the usage scenarios of IP nodes within regional blocks. Extensive experiments conducted on three large-scale real-world data sets demonstrate the superiority of GraphCyber over several state-of-the-art baselines in accurately identifying the IP usage scenarios.