Using Graph Theory for Improving Machine Learning-based Detection of Cyber Attacks

Early detection of network intrusion attempts is one of the main pillars of cybersecurity. An effective approach in this regard consists in analyzing network traffic with the help of artificial intelligence algorithms, with the aim of detecting the possible presence of an attacker by distinguishing it from a legitimate user. This is commonly done by collecting the traffic exchanged between terminals in a network and analyzing it on a per-packet or per-connection basis. In this paper, we propose instead to perform pre-processing of network traffic under analysis with the aim of extracting some new metrics, on which we can perform detection more efficiently and overcome some limitations of classical approaches. These new metrics are based on graph theory, and consider the network as a whole, rather than focusing on individual packets or connections. Our approach is validated through experiments performed on publicly available data sets, from which it turns out not only to overcome some of the limitations of classical approaches, but also achieve an improved detection capability of intrusion attempts.