# Machine learning on knowledge graphs for context-aware security monitoring

arXiv: https://arxiv.org/abs/2105.08741 · HTML: https://mlsanity.com/paper/2105.08741/

## Key facts

- Cited by 5 papers in the map (data through 14 Oct 2026).
- Builds on 5 of its 31 references that are in the map.
- First posted on arXiv 18 May 2021.

## Builds on (most cited first, 5 of 5)

- [A Comprehensive Survey of Graph Embedding: Problems, Techniques and Applications](https://mlsanity.com/paper/1709.07604/) (2017)
- [Graph-based Anomaly Detection and Description: A Survey](https://mlsanity.com/paper/1404.4679/) (2014)
- [RelExt: Relation Extraction using Deep Learning approaches for Cybersecurity Knowledge Graph Improvement](https://mlsanity.com/paper/1905.02497/) (2019)
- [Cybersecurity for Industrial Control Systems: A Survey](https://mlsanity.com/paper/2002.04124/) (2020)
- [Cyber-All-Intel: An AI for Security related Threat Intelligence](https://mlsanity.com/paper/1905.02895/) (2019)

## Built on by (most cited first, 5 of 5)

- [Learning through structure: towards deep neuromorphic knowledge graph embeddings](https://mlsanity.com/paper/2109.10376/) (2021)
- [An energy-based model for neuro-symbolic reasoning on knowledge graphs](https://mlsanity.com/paper/2110.01639/) (2021)
- [Relational representation learning with spike trains](https://mlsanity.com/paper/2205.09140/) (2022)
- [Detection, Explanation and Filtering of Cyber Attacks Combining Symbolic and Sub-Symbolic Methods](https://mlsanity.com/paper/2212.13991/) (2022)
- [Efficient Network Representation for GNN-based Intrusion Detection](https://mlsanity.com/paper/2310.05956/) (2023)

## Abstract (arXiv)

Machine learning techniques are gaining attention in the context of intrusion detection due to the increasing amounts of data generated by monitoring tools, as well as the sophistication displayed by attackers in hiding their activity. However, existing methods often exhibit important limitations in terms of the quantity and relevance of the generated alerts. Recently, knowledge graphs are finding application in the cybersecurity domain, showing the potential to alleviate some of these drawbacks thanks to their ability to seamlessly integrate data from multiple domains using human-understandable vocabularies. We discuss the application of machine learning on knowledge graphs for intrusion detection and experimentally evaluate a link-prediction method for scoring anomalous activity in industrial systems. After initial unsupervised training, the proposed method is shown to produce intuitively well-calibrated and interpretable alerts in a diverse range of scenarios, hinting at the potential benefits of relational machine learning on knowledge graphs for intrusion detection purposes.