为保护组织端点免受复杂网络攻击，需要先进的检测方法。本研究提出GCNetOmaly：一种基于图卷积网络（GCN）的变分自编码器（VAE）异常检测器，其训练数据包含内部与外部机器之间的连接事件。所提出的基于GCN的VAE模型接收两个矩阵作为输入：(i) 归一化邻接矩阵，表示机器之间的连接关系；(ii) 特征矩阵，包含用于刻画单个节点/机器的多种特征（人口统计、统计、进程相关以及Node2vec结构特征）。在预定义时间窗口内收集的数据上训练模型后，将模型应用于相同数据；模型对给定机器获得的重构分数即作为该机器的异常分数。GCNetOmaly在来自一家大型金融机构自动柜员机（ATM）以及其与Active Directory（AD）服务器通信的、由Carbon Black EDR记录的真实大规模数据上进行了评估，评估设置包括无监督和监督两种。评估结果表明，GCNetOmaly在无监督数据上检测机器异常行为方面具有有效性。
英文摘要：
To protect an organizations' endpoints from sophisticated cyberattacks, advanced detection methods are required. In this research, we present GCNetOmaly: a graph convolutional network (GCN)-based variational autoencoder (VAE) anomaly detector trained on data that include connection events among internal and external machines. As input, the proposed GCN-based VAE model receives two matrices: (i) the normalized adjacency matrix, which represents the connections among the machines, and (ii) the feature matrix, which includes various features (demographic, statistical, process-related, and Node2vec structural features) that are used to profile the individual nodes/machines. After training the model on data collected for a predefined time window, the model is applied on the same data; the reconstruction score obtained by the model for a given machine then serves as the machine's anomaly score. GCNetOmaly was evaluated on real, large-scale data logged by Carbon Black EDR from a large financial organization's automated teller machines (ATMs) as well as communication with Active Directory (AD) servers in two setups: unsupervised and supervised. The results of our evaluation demonstrate GCNetOmaly's effectiveness in detecting anomalous behavior of machines on unsupervised data.
An Automated Machine Learning Approach for Detecting Anomalous Peak Patterns in Time Series Data from a Research Watershed in the Northeastern United States Critical Zone
Detecting Anomalies in Blockchain Transactions using Machine Learning Classifiers and Explainability Analysis
Premier University（总理大学）；United International University（联合国际大学）；Cyber Security Cooperative Research Centre（网络安全合作研究中心）；Edith Cowan University（埃迪斯科文大学）
PhishGuard: A Convolutional Neural Network Based Model for Detecting Phishing URLs with Explainability Analysis
Uttara University（乌拉拉大学）；University of Oslo（奥斯陆大学）；Khulna University of Engineering and Technology (KUET)（库尔纳工程技术大学）；BRAC University（BRAC大学）；North South University（北南大学）；American International University Bangladesh (AIUB)（孟加拉国美国国际大学）
