不同图构建方法影响物联网僵尸网络检测效果，加布里埃尔图表现最佳。
How the Graph Construction Technique Shapes Performance in IoT Botnet Detection
- 用VAE降维后，五种图构造法生成结构化数据输入GAT模型。
- 加布里埃尔图达97.56%准确率，共享最近邻仅78.56%。
- 适合关注图神经网络在网络安全中应用的研究者。
物联网僵尸网络攻击频发，推动了先进学习模型在检测中的应用。近期研究聚焦于利用注意力机制建模长程特征依赖，并采用图神经网络（GNN）捕捉数据实例间关系。由于GNN需图结构输入，原始表格式NetFlow数据必须转换为图形式。本研究评估了五种图构建方法——k-近邻、互近邻、共享近邻、加布里埃尔图和ε-半径图——对GNN分类性能的影响。为降低高维数据计算负担，先使用变分自编码器（VAE）将原始特征投影至低维潜在空间，再生成图结构。随后在每个图上训练图注意力网络（GAT），对N-BaIoT数据集中的流量进行三类分类：正常、Mirai和Gafgyt。结果表明，采用加布里埃尔图时检测准确率达到97.56%，而共享近邻图性能最差，准确率仅为78.56%。
原文摘要 · Abstract (English)
The increasing incidence of IoT-based botnet attacks has driven interest in advanced learning models for detection. Recent efforts have focused on leveraging attention mechanisms to model long-range feature dependencies and Graph Neural Networks (GNNs) to capture relationships between data instances. Since GNNs require graph-structured input, tabular NetFlow data must be transformed accordingly. This study evaluates how the choice of the method for constructing the graph-structured dataset impacts the classification performance of a GNN model. Five methods--k-Nearest Neighbors, Mutual Nearest Neighbors, Shared Nearest Neighbor, Gabriel Graph, and epsilon-radius Graph--were evaluated in this research. To reduce the computational burden associated with high-dimensional data, a Variational Autoencoder (VAE) is employed to project the original features into a lower-dimensional latent space prior to graph generation. Subsequently, a Graph Attention Network (GAT) is trained on each graph to classify traffic in the N-BaIoT dataset into three categories: Normal, Mirai, and Gafgyt. The results indicate that using Gabriel graph achieves the highest detection performance with an accuracy of 97.56% while SNN recorded the lowest performance with an accuracy as low as 78.56%.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。