Detecting and Analysing Cyber Attacks Based on Graph Neural Networks, Ontologies and Large Language Models

This paper presents an intelligent system to automate the process of detecting and analysing cyber-attacks using Suricata logs, graph neural networks (GNNs), and large language models (LLMs). The proposed approach is based on several key components: collecting and preprocessing network events from Suricata, building an ontological model of attacks using MITRE ATT&CK, applying graph neural networks to identify relationships between events, and finally integrating a language model for dialogue interaction with the operator and generating attack hypotheses. Experimental results demonstrate high accuracy in detecting anomalous network patterns and operator friendliness and indicate the potential for further development of the system for use in high-load and distributed infrastructures.