# Detecting Anomalous Network Communication Patterns Using Graph Convolutional Networks

arXiv: https://arxiv.org/abs/2311.18525 · HTML: https://mlsanity.com/paper/2311.18525/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 6 of its 21 references that are in the map.
- First posted on arXiv 30 Nov 2023.

## Builds on (most cited first, 6 of 6)

- [Adam: A Method for Stochastic Optimization](https://mlsanity.com/paper/1412.6980/) (2014)
- [node2vec: Scalable Feature Learning for Networks](https://mlsanity.com/paper/1607.00653/) (2016)
- [Variational Graph Auto-Encoders](https://mlsanity.com/paper/1611.07308/) (2016)
- [Collective Anomaly Detection based on Long Short Term Memory Recurrent Neural Network](https://mlsanity.com/paper/1703.09752/) (2017)
- [Network Traffic Anomaly Detection Using Recurrent Neural Networks](https://mlsanity.com/paper/1803.10769/) (2018)
- [Sequence Aggregation Rules for Anomaly Detection in Computer Network Traffic](https://mlsanity.com/paper/1805.03735/) (2018)

## Abstract (arXiv)

To protect an organizations' endpoints from sophisticated cyberattacks, advanced detection methods are required. In this research, we present GCNetOmaly: a graph convolutional network (GCN)-based variational autoencoder (VAE) anomaly detector trained on data that include connection events among internal and external machines. As input, the proposed GCN-based VAE model receives two matrices: (i) the normalized adjacency matrix, which represents the connections among the machines, and (ii) the feature matrix, which includes various features (demographic, statistical, process-related, and Node2vec structural features) that are used to profile the individual nodes/machines. After training the model on data collected for a predefined time window, the model is applied on the same data; the reconstruction score obtained by the model for a given machine then serves as the machine's anomaly score. GCNetOmaly was evaluated on real, large-scale data logged by Carbon Black EDR from a large financial organization's automated teller machines (ATMs) as well as communication with Active Directory (AD) servers in two setups: unsupervised and supervised. The results of our evaluation demonstrate GCNetOmaly's effectiveness in detecting anomalous behavior of machines on unsupervised data.