arXivDaily arXiv每日学术速递 周一至周五更新
北美退伍军人节(Veterans Day),12 日无更新
arXiv 2010.04777cs.LGcs.NI
收藏

基于图神经网络的企业网可扩展动态IP相似度计算方法

A Graph Neural Network Approach for Scalable and Dynamic IP Similarity in Enterprise Networks

RANK Software Inc.(RANK软件公司)

Hazem M. Soliman, Geoff Salmon, Dusan Sovilij, Mohan Rao

摘要:

测量IP地址之间的相似性是任何企业网日常操作中的一项重要任务。依赖于IP相似性度量的应用包括测量安全警报之间的相关性、构建行为建模基线、调试网络故障和跟踪持续攻击。然而,IP没有一个自然的相似性度量的定义。深度学习架构是一个很有前途的解决方案,因为它们能够直接从数据中学习IP的数值表示,允许在计算的表示上应用各种距离度量。当前的工作已经利用自然语言处理(NLP)技术来学习IP嵌入。然而,这些方法没有适当的方法来处理在训练过程中看不到的词汇表外(OOV)IP。在本文中,我们提出了一种新的方法,IP嵌入使用自适应图神经网络(GNN)架构。这种方法具有处理原始数据、可扩展性以及最重要的归纳的优点,即能够测量以前未见过的IP之间的相似性。使用来自企业网的数据,我们的方法能够识别本地DNS服务器和根DNS服务器之间的相似性,即使其中一些机器在训练阶段从未遇到过。

英文摘要:

Measuring similarity between IP addresses is an important task in the daily operations of any enterprise network. Applications that depend on an IP similarity measure include measuring correlation between security alerts, building baselines for behavioral modelling, debugging network failures and tracking persistent attacks. However, IPs do not have a natural similarity measure by definition. Deep Learning architectures are a promising solution here since they are able to learn numerical representations for IPs directly from data, allowing various distance measures to be applied on the calculated representations. Current works have utilized Natural Language Processing (NLP) techniques for learning IP embeddings. However, these approaches have no proper way to handle out-of-vocabulary (OOV) IPs not seen during training. In this paper, we propose a novel approach for IP embedding using an adapted graph neural network (GNN) architecture. This approach has the advantages of working on the raw data, scalability and, most importantly, induction, i.e. the ability to measure similarity between previously unseen IPs. Using data from an enterprise network, our approach is able to identify similarities between local DNS servers and root DNS servers even though some of these machines are never encountered during the training phase.

机构、总结、中文摘要均由AI分析而来,可能存在错误,请以论文正文为准。

↑