# Zero Day Threat Detection Using Graph and Flow Based Security Telemetry

arXiv: https://arxiv.org/abs/2205.02298 · HTML: https://mlsanity.com/paper/2205.02298/

## Key facts

- Cited by 2 papers in the map (data through 14 Oct 2026).
- Builds on 4 of its 35 references that are in the map.
- First posted on arXiv 4 May 2022.

## Builds on (most cited first, 4 of 4)

- [A Comprehensive Survey on Graph Anomaly Detection with Deep Learning](https://mlsanity.com/paper/2106.07178/) (2021)
- [From Zero-Shot Machine Learning to Zero-Day Attack Detection](https://mlsanity.com/paper/2109.14868/) (2021)
- [Multi-centrality Graph Spectral Decompositions and their Application to Cyber Intrusion Detection](https://mlsanity.com/paper/1512.07372/) (2015)
- [The Performance of Machine and Deep Learning Classifiers in Detecting Zero-Day Vulnerabilities](https://mlsanity.com/paper/1911.09586/) (2019)

## Built on by (most cited first, 2 of 2)

- [Zero Day Threat Detection Using Metric Learning Autoencoders](https://mlsanity.com/paper/2211.00441/) (2022)
- [CSTS: A Canonical Security Telemetry Substrate for AI-Native Cyber Detection](https://mlsanity.com/paper/2603.23459/) (2026)

## Abstract (arXiv)

Zero Day Threats (ZDT) are novel methods used by malicious actors to attack and exploit information technology (IT) networks or infrastructure. In the past few years, the number of these threats has been increasing at an alarming rate and have been costing organizations millions of dollars to remediate. The increasing expansion of network attack surfaces and the exponentially growing number of assets on these networks necessitate the need for a robust AI-based Zero Day Threat detection model that can quickly analyze petabyte-scale data for potentially malicious and novel activity. In this paper, the authors introduce a deep learning based approach to Zero Day Threat detection that can generalize, scale, and effectively identify threats in near real-time. The methodology utilizes network flow telemetry augmented with asset-level graph features, which are passed through a dual-autoencoder structure for anomaly and novelty detection respectively. The models have been trained and tested on four large scale datasets that are representative of real-world organizational networks and they produce strong results with high precision and recall values. The models provide a novel methodology to detect complex threats with low false-positive rates that allow security operators to avoid alert fatigue while drastically reducing their mean time to response with near-real-time detection. Furthermore, the authors also provide a novel, labelled, cyber attack dataset generated from adversarial activity that can be used for validation or training of other models. With this paper, the authors' overarching goal is to provide a novel architecture and training methodology for cyber anomaly detectors that can generalize to multiple IT networks with minimal to no retraining while still maintaining strong performance.