Detecting Anomalous Communication Behaviors in Dynamically Evolving Networked Systems

Devices in real-world networked systems typically exhibit a consistent communication behavior over time. Hence, anomalous communication behaviors may often indicate cyber-attacks taking place in these systems. As a result, identifying anomalous communication links can help us to activate appropriate response mechanisms to ensure the integrity and security of such networked systems. In this study, we propose an approach to detect anomalous communication links in dynamically evolving networked systems. Furthermore, we employ the External Direct Sum of Vector Spaces (EDSoVS) to enable edge/dyad representation learning from node representations. We then use the dyad representations as features to train an SVM model and detect future anomalous links. We evaluate our approach on a synthetic dataset representing a real-world communication network provided by the MITRE Corporation and twelve real-world datasets provided by Cisco. Our empirical results show that the accuracy rates of the proposed model vary between 70.54% to 95.79%, while the F1 score is between 78.22% and 95.97%. We compare our approach against four techniques involving neural networks and graph neural networks. We show that our approach achieves higher accuracy, precision, and recall rates.