# Malicious Internet Entity Detection Using Local Graph Inference

arXiv: https://arxiv.org/abs/2408.03287 · HTML: https://mlsanity.com/paper/2408.03287/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 21 of its 68 references that are in the map.
- First posted on arXiv 6 Aug 2024.

## Builds on (most cited first, 21 of 21)

- [Adam: A Method for Stochastic Optimization](https://mlsanity.com/paper/1412.6980/) (2014)
- [Semi-Supervised Classification with Graph Convolutional Networks](https://mlsanity.com/paper/1609.02907/) (2016)
- [Batch Normalization: Accelerating Deep Network Training by Reducing Internal Covariate Shift](https://mlsanity.com/paper/1502.03167/) (2015)
- [Inductive Representation Learning on Large Graphs](https://mlsanity.com/paper/1706.02216/) (2017)
- [A Comprehensive Survey on Graph Neural Networks](https://mlsanity.com/paper/1901.00596/) (2019)
- [Graph Neural Networks: A Review of Methods and Applications](https://mlsanity.com/paper/1812.08434/) (2018)
- [Geometric deep learning: going beyond Euclidean data](https://mlsanity.com/paper/1611.08097/) (2016)
- [Heterogeneous Graph Attention Network](https://mlsanity.com/paper/1903.07293/) (2019)
- [SIGN: Scalable Inception Graph Neural Networks](https://mlsanity.com/paper/2004.11198/) (2020)
- [Heterogeneous Information Network Embedding for Recommendation](https://mlsanity.com/paper/1711.10730/) (2017)
- [Towards a Neural Statistician](https://mlsanity.com/paper/1606.02185/) (2016)
- [TESSERACT: Eliminating Experimental Bias in Malware Classification across Space and Time](https://mlsanity.com/paper/1807.07838/) (2018)
- [Learned-Norm Pooling for Deep Feedforward and Recurrent Neural Networks](https://mlsanity.com/paper/1311.1780/) (2013)
- [NF-GNN: Network Flow Graph Neural Networks for Malware Detection and Classification](https://mlsanity.com/paper/2103.03939/) (2021)
- [Detection of Early-Stage Enterprise Infection by Mining Large-Scale Log Data](https://mlsanity.com/paper/1411.5005/) (2014)
- [Approximation capability of neural networks on spaces of probability measures and tree-structured domains](https://mlsanity.com/paper/1906.00764/) (2019)
- [Discriminative models for multi-instance problems with tree-structure](https://mlsanity.com/paper/1703.02868/) (2017)
- [Using Neural Network Formalism to Solve Multiple-Instance Problems](https://mlsanity.com/paper/1609.07257/) (2016)
- [Nested Multiple Instance Learning in Modelling of HTTP network traffic](https://mlsanity.com/paper/2002.04059/) (2020)
- [Joint Embedding of Meta-Path and Meta-Graph for Heterogeneous Information Networks](https://mlsanity.com/paper/1809.04110/) (2018)
- [Mapping the Internet: Modelling Entity Interactions in Complex Heterogeneous Networks](https://mlsanity.com/paper/2104.09650/) (2021)

## Abstract (arXiv)

Detection of malicious behavior in a large network is a challenging problem for machine learning in computer security, since it requires a model with high expressive power and scalable inference. Existing solutions struggle to achieve this feat -- current cybersec-tailored approaches are still limited in expressivity, and methods successful in other domains do not scale well for large volumes of data, rendering frequent retraining impossible. This work proposes a new perspective for learning from graph data that is modeling network entity interactions as a large heterogeneous graph. High expressivity of the method is achieved with neural network architecture HMILnet that naturally models this type of data and provides theoretical guarantees. The scalability is achieved by pursuing local graph inference, i.e., classifying individual vertices and their neighborhood as independent samples. Our experiments exhibit improvement over the state-of-the-art Probabilistic Threat Propagation (PTP) algorithm, show a further threefold accuracy improvement when additional data is used, which is not possible with the PTP algorithm, and demonstrate the generalization capabilities of the method to new, previously unseen entities.