Using Graph Theory for Improving Machine Learning-based Detection of
  Cyber Attacks
Giacomo Zonneveld Lorenzo Principi Marco Baldi
Early detection of network intrusions and cyber threats is one of the main
pillars of cybersecurity. One of the most effective approaches for this purpose
is to analyze network traffic with the help of artificial intelligence
algorithms, with the aim of detecting the possible presence of an attacker by
distinguishing it from a legitimate user. This is commonly done by collecting
the traffic exchanged between terminals in a network and analyzing it on a
per-packet or per-connection basis. In this paper, we propose instead to
perform pre-processing of network traffic under analysis with the aim of
extracting some new metrics on which we can perform more efficient detection
and overcome some limitations of classical approaches. These new metrics are
based on graph theory, and consider the network as a whole, rather than
focusing on individual packets or connections. Our approach is validated
through experiments performed on publicly available data sets, from which it
results that it can not only overcome some of the limitations of classical
approaches, but also achieve a better detection capability of cyber threats.