Using Causality-Driven Graph Representation Learning for APT Attacks Path Identification

At present, APT attack detection has become the focus of the network security protection field. APT attacks are one of the most difficult attacks in cyber attacks. The complexity and variability of APT attack behavior greatly increases the difficulty of attack detection. In order to cope with APT attack, some well-known network security companies at home and abroad have developed a commercial APT intrusion detection system. This highly targeted attack can not be identified by the traditional intrusion detection system. Therefore, in order to deal with this new type of cyber attack. The paper proposes a new method to detect APT attack from different organizations. Data mining algorithm is used to analyze every organization’s APT network attack behavior and obtain association rules, so as to customize the design of the Snort rules and apply them to intrusion detection system. Experiments have shown that the evaluation index of the intrusion detection system using the extended Snort rule is significantly better than the traditional Snort intrusion detection system when detecting the same test data. The precision of the extended Snort intrusion detection system is as high as 98.3%, and the false alarm rate is almost 0, which ultimately achieves the purpose of APT detection.

Recently personal information due to the APT attack, the economic damage and leakage of confidential information is a serious social problem, a great deal of research has been done to solve this problem. APT attacks are threatening traditional hacking techniques as well as to increase the success rate of attacks using sophisticated attack techniques such attacks Zero-Day vulnerability in order to avoid detection techniques and state-of-the-art security because it uses a combination of intelligence. In this paper, the malicious code is designed to detect APT attack based on APT attack behavior ontology that occur during the operation on the target system, it uses intelligent APT attack than to define inference rules can be inferred about malicious attack behavior to propose a method that can be detected.

The quantity of wind and photovoltaic power-based distributed generators (DGs) is continually rising within the distribution network, presenting obstacles to its safe, steady, and cost-effective functioning. Active distribution network dynamic reconfiguration (ADNDR) improves the consumption rate of renewable energy, reduces line losses, and optimizes voltage quality by optimizing the distribution network structure. Despite being formulated as a highly dimensional and combinatorial nonconvex stochastic programming task, conventional model-based solvers often suffer from computational inefficiency and approximation errors, whereas population-based search methods frequently exhibit premature convergence to suboptimal solutions. Moreover, when dealing with high-dimensional ADNDR problems, these algorithms often face modeling difficulties due to their large scale. Deep reinforcement learning algorithms can effectively solve the problems above. Therefore, by combining the graph attention network (GAT) with the deep deterministic policy gradient (DDPG) algorithm, a method based on the graph attention network deep deterministic policy gradient (GATDDPG) algorithm is proposed to online solve the ADNDR problem with the uncertain outputs of DGs and loads. Firstly, considering the uncertainty in distributed power generation outputs and loads, a nonlinear stochastic optimization mathematical model for ADNDR is constructed. Secondly, to mitigate the dimensionality of the decision space in ADNDR, a cyclic topology encoding mechanism is implemented, which leverages graph-theoretic principles to reformulate the grid infrastructure as an adaptive structural mapping characterized by time-varying node–edge interactions Furthermore, the GATDDPG method proposed in this paper is used to solve the ADNDR problem. The GAT is employed to extract characteristics pertaining to the distribution network state, while the DDPG serves the purpose of enhancing the process of reconfiguration decision-making. This collaboration aims to ensure the safe, stable, and cost-effective operation of the distribution network. Finally, we verified the effectiveness of our method using an enhanced IEEE 33-bus power system model. The outcomes of the simulations demonstrate its capacity to significantly enhance the economic performance and stability of the distribution network, thereby affirming the proposed method’s effectiveness in this study.

A new ensemble deep graph reinforcement learning network for spatio-temporal traffic volume forecasting in a freeway network

Relational Database Management Systems (RDBMSs) are foundational to operations across finance, healthcare, and government sectors. However, they remain susceptible to advanced threats such as polymorphic SQL injection, insider misuse, and timing-based data exfiltration.Traditional intrusion detection systems (IDSs), including signature-based and static machine learning models, often struggle to detect evolving and obfuscated attacks, resulting in high false-positive rates and limited adaptability.This paper presents the Triple Loop Learning (TLL) framework—a recursive, multi-tiered architecture that integrates supervised learning, reinforcement learning (RL), and meta-learning for real-time anomaly detection in SQL-based environments. To the best of our knowledge, TLL is the first framework to unify these three learning paradigms into a recursive, explainable, and low-latency anomaly detection system specifically tailored for structured SQL workloads.TLL comprises three interdependent loops: (i) an operational loop utilizing SQL-aware autoencoders for fine-grained anomaly detection, (ii) a tactical loop leveraging Deep Q-Networks (DQN) for adaptive threshold calibration, and (iii) a strategic loop based on Model-Agnostic Meta-Learning (MAML) for rapid cross-domain adaptation.TLL was evaluated on a composite dataset comprising the UNSW-NB15 benchmark, anonymized SQL logs from financial and healthcare institutions, and adversarial samples generated with MAD-GAN. The framework achieved an F1 score of 0.94, an AUC of 0.976, and an average inference latency of 84 ms.The results demonstrate that TLL enables robust, low-latency detection of zero-day and obfuscated SQL threats. Its explain-ability is enhanced through SHAP-based attributions, and its deployment is version-controlled and reproducible, ensuring traceability, compliance, and production readiness.

With the rapid development of machine learning and Internet technology, the combination of the two methods is well appreciated recently.An anomaly and intrusion detection system is a mechanism that monitors network or system activities for malicious activities.Intrusion detection and prevention systems are primarily focused on identifying possible incidents, logging information about them and reporting attempts.As far as other usages of Intrusion detection and prevention systems are concerned, such as identifying problems with security policies and deterring individuals from violating security policies.Anomaly detection systems are becoming an important addition to the security infrastructure of nearly every organization.In this paper, we propose a novel mechanism for real-world traffic and research there cases with theoretical analysis.

In the field of information and cybersecurity, one of the most important and critical challenges is the human factor, because no software or technical tool can fully compensate for the lack of awareness of information and cyber risks, appropriate behavior and a responsible attitude to information protection. The introduction of cognitive science theories into the field of cyber security will increase the level of effectiveness of protection strategies. Cognitive modeling contributes to the creation of mathematical models that simulate the processes of human thinking, decision-making and behavior, which brings the transition from reactive protection to a proactive approach. This article is devoted to the study of the implementation of the cognitive approach in security systems. Based on the analysis of scientific literature, the main definitions of cognitive science are highlighted, in particular, the concepts of cognitive modeling, cognitive analysis and synthesis, types of cognitive models, fuzzy cognitive map. The advantages of cognitive theories in various sectors of society are outlined. It has been proven that cognitive modeling can be applied in the field of cybersecurity to understand and predict the behavior of both attackers and protective systems. The following cognitive models in cyber systems are described: symbolic modeling (rule-based modeling) is used to build intrusion detection systems (IDS) that analyze network traffic for known attacks; network modeling (modeling using neural networks) includes anomaly detection systems that analyze typical network behavior; Bayesian models (probabilistic modeling) help predict risks and the probability of a successful attack on a specific system; agent-based modeling is used to simulate cyberattacks and test the resilience of systems. It was determined that the use of hybrid models that combine the above is effective. The challenges of implementing cognitive modeling in the security field are highlighted. These are the difficulties associated with the need for large volumes of qualitative data on the behavior of attackers, the complexity of modeling human behavior, and ethical issues. The results of the study can be used as educational material for students of the specialty F5 Cybersecurity and Information Protection.

Investigating the use of moving target defense (MTD) mechanisms in IoT networks is ongoing research, with unfathomable potential to equip IoT devices and networks with the ability to fend off cyber attacks despite the computational deficiencies many IoT ecosystems typically have. The AI community has extensively studied adversarial threats and attacks on machine learning-based systems, emphasizing the need to address the potential compromise of anomaly-based intrusion detection systems (IDS) through adversarial attacks. Another concept that has gained significant attention in the networking community is Game Theory. Protecting any given network is almost a never-ending battle between the attacker and defender, and hence a natural game of competitors can be modelled based on one’s parametric specifications to gain more insight into how attackers might interact with one’s system. The goal of this thesis is to propose a comprehensive, experimentally verifiable game-theoretic model of MTD in IoT networks to secure the IDS against adversarial attacks. Once a game with state transitions based on given actions can be modelled, reinforcement learning is used to develop policies based on various episodes (rounds) of the game, ultimately optimizing network decisions to minimize successful attacks on machine learning-based IDS. The state-of-the-art ToN-IoT dataset was investigated for MTD feasibility to implement the feature-based MTD approach. The overall performance of the proposed MTD-based IDS was compared to a conventional IDS by analyzing the accuracy curve of the MTD-based IDS and the conventional IDS for varying attacker success rates and resource demands. Our approach has proven effective in securing the IDS against adversarial learning.

At present, APT attack detection mainly focuses on the specific realization of detection technology, and there is little research on the timing strategy for active detection of APT attack. This paper focuses on the problem of APT dynamic detection with timing decision intelligence. We use the FlipIt game model and reinforcement learning method of Q-learning algorithm, consider the APT attack events as an exponentially distributed random process, and the defender using the attacker’s last move time (LM-defender) to learn his optimal timing strategy using Q-Learning algorithm. The defender's reinforcement learning mechanism for the timing of the APT attack action and outputs its timing selection strategy. Simulation experiments show that compared with the existing greedy algorithm, the timing strategy based on the Q-Learning algorithm does not require the attacker's prior information under the premise, it can achieve a higher average benefit than the greedy strategy. This result provides a theoretical reference for the design of timing strategy to defend APT attack intelligently and efficient.

In recent years, the identification of abnormalities in attributed networks has become essential for applications including social media analysis, cybersecurity, and financial fraud detection. Unsupervised graph anomaly detection techniques seek to recognize infrequent and anomalous patterns in graph-structured data without the necessity of labelled instances. Conventional methods employing Graph Neural Networks (GNNs) frequently encounter difficulties, especially due to the transmission of noisy edges and the intrinsic intricacy of node interrelations. To overcome these restrictions, we introduce ANOGAT-Sparse-TL, an innovative hybrid framework that integrates graph sparsification and Graph Attention Networks (GAT) with autoencoder-based reconstruction for anomaly detection in attributed networks. The sparsification procedure removes extraneous edges and highlights significant node connections, thereby enhancing computational efficiency and improving anomaly detection efficacy. By including GAT, our model carefully allocates significance to pertinent neighboring nodes, yielding enhanced node embeddings. The autoencoder subsequently reconstructs these embeddings to detect abnormalities via reconstruction errors. Incorporating Tversky Loss in the reconstruction process further improves the robustness of the model by effectively addressing the imbalance between normal and anomalous data, prioritizing the detection of rare anomalies. This optimized loss function allows ANOGAT-Sparse-TL to focus on hard-to-reconstruct instances, which are typically indicative of anomalies, and reduces the impact of noisy data on the model's performance. ANOGAT-Sparse-TL effectively integrates attribute-based and structural anomalies, yielding comprehensive anomaly ratings. Comprehensive studies on the four real-world datasets indicate that our strategy surpasses current state-of-the-art methodologies, with enhanced performance. Moreover, the scalability of our methodology guarantees its relevance to extensive real-world networks, rendering it an adaptable option for diverse graph anomaly detection activities. ANOGAT-Sparse-TL, despite its complexity, maintains computational efficiency and provides substantial improvements in anomaly detection inside attributed networks. Future research may concentrate on enhancing interpretability and broadening generalizability to various network architectures.

Predicting the next phases of an ongoing cyberattack is critical for proactive cybersecurity, enabling defenders to anticipate and mitigate threats effectively. This paper presents a context-aware meta-model framework designed to dynamically select the most suitable prediction model for projecting the next phase of an attack. Depending on real-time situational parameters, the meta-model determines whether to employ a Graph Attention Network (GAT) or a Deep Q-Network (DQN). The GAT model captures complex, graph-based relationships in attack patterns, while the DQN model excels in sequential decision-making for evolving attack scenarios. Experimental evaluations using the CTU-13 dataset demonstrate the effectiveness of this approach: GAT achieves 99.20% accuracy, and DQN achieves 100% in predicting the second phase of an attack based on an alert set representing the first phase. These results highlight the potential of the meta-model framework to enhance adaptive cybersecurity defenses by optimizing model selection for accurate attack projections.

Off-policy actor-critic deep reinforcement learning methods for alert prioritization in intrusion detection systems

The rapid expansion of blockchain technology has led to increased security challenges, particularly in detecting fraudulent transactions and malicious activities within decentralized networks. Traditional anomaly detection techniques, including rule-based heuristics and supervised learning models, struggle to adapt to the dynamic and complex nature of blockchain transactions. This paper introduces a graph neural network (GNN)-based anomaly detection framework designed to improve blockchain security by leveraging the inherent graph structure of transaction networks. The proposed approach models blockchain transactions as a directed graph, where nodes represent wallet addresses and edges correspond to transaction flows. By applying spatial and temporal graph learning techniques, the framework captures both network topology and transaction evolution over time, allowing for the identification of anomalous activities such as money laundering, phishing scams, and Ponzi schemes. The GNN model incorporates graph convolutional networks (GCN), graph attention networks (GAT), and gated recurrent units (GRU) to learn both spatial dependencies and sequential patterns within blockchain transactions. Experiments conducted on Bitcoin and Ethereum transaction datasets demonstrate that the GNN-based framework outperforms conventional fraud detection methods in terms of precision, recall, and false positive reduction. The model successfully detects fraudulent transactions with an F1-score of 0.92, showing its effectiveness in identifying emerging threats in blockchain networks. These results highlight the potential of deep learning-based anomaly detection in enhancing blockchain security, providing a scalable and adaptive solution for detecting fraud in decentralized financial ecosystems.

The APT attack on the Internet is becoming more serious, and most of intrusion detection systems can only generate alarms to some steps of APT attack and cannot identify the pattern of the APT attack. To detect APT attack, many researchers established attack models and then correlated IDS logs with the attack models. However, the accuracy of detection deeply relied on the integrity of models. In this paper, we propose a new method to construct APT attack scenarios by mining IDS security logs. These APT attack scenarios can be further used for the APT detection. First, we classify all the attack events by purpose of phase of the intrusion kill chain. Then we add the attack event dimension to fuzzy clustering, correlate IDS alarm logs with fuzzy clustering, and generate the attack sequence set. Next, we delete the bug attack sequences to clean the set. Finally, we use the nonaftereffect property of probability transfer matrix to construct attack scenarios by mining the attack sequence set. Experiments show that the proposed method can construct the APT attack scenarios by mining IDS alarm logs, and the constructed scenarios match the actual situation so that they can be used for APT attack detection.

Recommendation systems is the core of most online experiences, guiding people to the right products, films, music, courses, and even social links when the choices are overwhelming. They work by learning from large interaction logs and applying predictive models to surface content that fits each user’s tastes, steadily improving as algorithms and data grow richer. As AI and deep learning have developed, classic strategies like collaborative filtering and content-based filtering are increasingly paired with, or superseded by, neural architectures that can model more nuanced patterns in behaviour and content. Among these neural approaches, graph neural networks—and especially Graph Attention Networks (GATs)—have become influential for recommendation because they treat users and items as nodes in a graph and learn from the connections between them. With attention mechanisms, GATs decide which neighbours matter most for a given prediction, amplifying useful signals and dampening noise to learn stronger user and item representations. This survey traces how the industry moved from traditional methods to graph-based models centred on GATs, comparing approaches on scalability, ranking accuracy, data sparsity, and interpretability across widely used benchmarks. Drawing from recent peer‑reviewed work, it highlights architectures and training practices that consistently help in real-world settings, as well as gaps that still limit robust deployment at scale. Looking forward, several directions stand out: using explainable AI to clarify why specific items are recommended, combining reinforcement learning with GATs for adaptive policies, and adopting federated learning to protect user privacy while training on distributed data. The versatility of GAT-based recommenders is already visible across domains—from e‑commerce and online learning to healthcare and social feeds—where graph structure and selective attention naturally fit the data. Overall, the evidence points to GATs as a key ingredient for the next generation of personalized, context‑aware, and trustworthy recommendation systems. Keywords: Recommendation Systems, Collaborative Filtering, Graph Neural Networks, Graph Attention Networks