PaperlayerView exact revision on arXiv

Source-linked AI summary

Cognitive Graph Intelligence for Adaptive and Robust DDoS Attack Detection in Next Generation Networks

Mohammad Arif Hossain, Yeahia Sarker, Md Jafrin Hossain, Most. Humayra Khanom Rime, Nirwan Ansari

arXiv:2608.17352v1cs.AI

TL;DR

DDoS detection must account for relational traffic structure and severe class imbalance, which conventional flow-independent methods may not capture. GraphGAN combines temporal graph modeling, adversarial minority-sample generation, and GCN classification, achieving consistent improvements across four benchmarks, including 95.31% accuracy on CIC-IDS-2017.

  • Problem

    Existing intrusion detectors often treat flows independently and face severe class imbalance, limiting their use for relational, learning-driven DDoS detection.

  • Method

    GraphGAN converts sequential flows into temporal k-nearest-neighbor graphs, generates synthetic DDoS subgraphs adversarially, and uses GCNs for discrimination and final classification.

  • Results

    GraphGAN consistently outperformed competing methods across four benchmarks, achieving 95.31% accuracy on CIC-IDS-2017 and improvements in accuracy, precision, and recall.

  • Takeaways & Limitations

    GraphGAN provides a topology-aware approach for modeling coordinated DDoS behaviors under class imbalance and data scarcity.

  • Takeaways & Limitations

    Because generated features are independent of template topology, adversarial equilibrium does not guarantee matching the joint feature–adjacency distribution.

Abstract

from arXiv · show

Distributed Denial-of-Service (DDoS) attacks threaten network availability, requiring a cognitive detection process that senses traffic, infers intent, and supports an adaptive response under severe class imbalance and non-stationary conditions. This paper proposes a Graph-based Generative Adversarial Network (GraphGAN) that serves as the cognitive detection engine for this task. GraphGAN captures the relational structure among traffic flows while addressing imbalance through adversarial generation of synthetic samples. Sequential flows are converted into $k$-nearest neighbor graphs using sliding windows to preserve feature-similarity and temporal dependencies among flows. The generator learns the distribution of DDoS attacks to synthesize realistic minority samples, while a Graph Convolutional Network (GCN)-based discriminator distinguishes real from synthetic graph data. A separate GCN classifier, trained on the balanced dataset, performs the final detection decision. Evaluations on four benchmark datasets show that GraphGAN achieves superior accuracy, precision, and recall compared to state-of-the-art approaches, particularly in data-scarce scenarios. By integrating temporal graph construction, adversarial augmentation, and GCN classification, GraphGAN effectively models coordinated attack behaviors and mitigates class imbalance, providing a robust and topology-aware solution for intrusion detection in data-constrained environments.

I. INTRODUCTION … C. Contributions

The paper motivates cognitive, adaptive DDoS detection by identifying the limitations of static, independent-flow approaches and proposes GraphGAN to combine temporal graph modeling, adversarial augmentation, and GCN classification. Its contributions target relational structure, class imbalance, topology-aware generation, and coordinated attack detection.

  • I. INTRODUCTION: DDoS attacks increasingly threaten network availability, while their distributed and evolving nature makes real-time mitigation difficult.The paper describes DDoS attacks as persistent threats that disrupt critical infrastructure and exploit compromised hosts to overwhelm services.
  • I. INTRODUCTION: Static, rule-based protection and traditional NIDS struggle with evolving, zero-day, polymorphic, and complex attack behaviors.Signature-based systems require prior attack knowledge, whereas statistical anomaly detectors can produce high false-positive rates and inadequately model complex behavior.
  • I. INTRODUCTION: Next-generation cloud, IoT, and 5G/6G environments motivate cognitive detection that senses traffic, reasons about threats, and supports adaptive mitigation.The paper frames intrusion detection as the learning core of a sense–infer–act process rather than a standalone classifier.
  • A. Motivation: Network flows contain temporal, source-destination, and feature-similarity relationships that independent-sample methods overlook when recognizing coordinated attacks.The proposed k-nearest-neighbor graph construction captures flow interdependencies that conventional vector representations discard.
  • B. Literature Review: Prior DDoS studies address temporal modeling, feature selection, ensemble learning, graph classification, and adversarial augmentation, but retain limitations in imbalance, scalability, robustness, or topology.The literature review notes that existing generative approaches produce isolated synthetic samples without topological context.
  • B. Literature Review: Learning-driven cognitive defense research embeds adaptive detection and mitigation in 5G+, edge, IoT, fog, and federated network environments.These approaches emphasize online adaptation, decentralized learning, resource-aware control, privacy preservation, and in-network mitigation.
  • C. Contributions: GraphGAN unifies structure-aware traffic modeling with adversarial augmentation to mitigate class imbalance while preserving topological integrity.Its graph construction uses k-NN connectivity over sliding temporal windows to capture flow co-occurrence and feature-similarity patterns.
  • C. Contributions: The framework integrates GCN-based adversarial generation of realistic minority-class DDoS samples with GCN classification of coordinated attack patterns.The discriminator processes entire graph structures, while the generated samples preserve statistical fidelity and relational consistency.

II. METHODOLOGY … 3) k-Nearest Neighbor Graph Construction:

GraphGAN frames DDoS detection as a cognitive sense–infer–act pipeline that transforms normalized, sequential flow statistics into temporal k-NN graphs. Its graph construction preserves feature similarity, temporal dependencies, and bounded connectivity for adversarial augmentation and GCN-based classification.

  • II. METHODOLOGY: GraphGAN integrates graph neural networks with adversarial training to model topological relationships in network traffic while addressing class imbalance.The framework uses GraphGAN as the cognitive detection engine within a broader detection process.
  • A. Cognitive Detection Process: The cognitive detection process senses exported per-flow statistics, infers a subgraph-level decision from a temporal graph, and supports network-controller responses under attack.The detector can operate on flow statistics exported from switches or gateways, such as through telemetry or flow export.
  • A. Cognitive Detection Process: Temporal-window decisions avoid per-packet inference and respond to coordinated behavior rather than isolated flows.Detection operates at the granularity of a temporal window, where distributed attacks become distinguishable.
  • B. Graph Construction from Network Traffic: Sequential network flows are transformed into graph-structured representations that preserve feature-level similarities and temporal dependencies.Sliding windows partition the sequence into temporal subgraphs containing consecutive flows and relational edges.
  • 1) Feature Space Representation and Normalization:: Each flow is represented by normalized statistics, including packet size, interarrival time, duration, and protocol-related features, with every feature bounded to [−1, 1].Min–max normalization limits the feature range and aligns it with the generator’s tanh output support.
  • 2) Temporal Graph Construction via Sliding Windows:: Sliding windows of size w and step size s define temporal subgraphs G_t = (V_t, E_t, X_t) over w consecutive flows.The vertex set contains the consecutive flows, while edges encode relational dependencies among them.
  • 3) k-Nearest Neighbor Graph Construction:: Within each temporal window, Euclidean pairwise distances over standardized flow vectors define k-NN edges between feature-similar flows.For each node, the construction selects k nearest neighbors; k balances local-neighborhood capture against graph connectivity.
  • 3) k-Nearest Neighbor Graph Construction:: Symmetric k-NN construction produces an undirected graph with symmetric adjacency and node degrees bounded by k ≤ deg(v_i) ≤ w−1.The bounded degree maintains at least k connections while remaining constrained by the finite window size, supporting subsequent GCN processing.

4) Graph Label Assignment:

Temporal subgraphs receive supervised labels through majority voting over flow labels within each window. Exact ties favor the DDoS class, prioritizing recall, while odd-sized windows guarantee a strict majority.

  • Label assignment: Majority voting assigns each temporal subgraph a single label from the flow labels within its window.This accommodates windows whose individual flows may have different labels.
  • Tie handling: Exact ties for even-sized windows are resolved toward the DDoS class as a security-conservative choice favoring recall over precision.The rule ensures the attack class wins when the two classes split evenly.
  • Labeling assumption: The labeling approach assumes the majority class in a temporal window reflects the overall behavior pattern, particularly for contiguous DDoS-flow segments.Under temporal locality, most windows remain within a single behavioral regime and agreement approaches 1.
  • Agreement guarantee: For any window size w, the majority-voted label agrees with at least ⌈w/2⌉ flows, yielding α_t ≥ 1/2.The guarantee follows because one binary class must comprise at least half the window, with tie-breaking preserving the bound.
  • Agreement guarantee: When w is odd, ties cannot occur and the agreement bound strengthens to α_t ≥ 1/2 + 1/(2w).Odd window sizes force the winning class to contain at least (w+1)/2 flows.

5) When Graph Structure Carries Information:

This section establishes that graph structure improves DDoS detection specifically when individual flows are feature-ambiguous but jointly coordinated. It further shows that topology carries label-relevant information unavailable to feature-only models and accessible to joint feature–graph predictors.

  • Conditions for Graph Advantage: Graph structure provides a detection advantage when individual flows are ambiguous yet neighboring flows retain label dependence beyond their features.Both feature ambiguity and coordination are stated as necessary conditions for structure to help.
  • Conditions for Graph Advantage: Under feature-ambiguous coordination with strength c > 0, a predictor using each flow and its k-NN neighborhood strictly beats the best single-flow predictor.The neighborhood supplies side information about a flow’s label, reducing conditional entropy and enabling lower Bayes risk.
  • Conditions for Graph Advantage: The graph advantage disappears when flows are already separable in feature space, because the optimal single-flow risk is then zero.The theorem characterizes when structure helps rather than claiming that graph structure is universally required.
  • Feature–Topology Information Gap: Because k-NN adjacency is deterministically induced by window features, its topology can encode label-relevant dependence that feature-only models cannot exploit.This feature–topology information gap is identified as unavailable to predictors or generators measurable only from X.
  • Feature–Topology Information Gap: Joint models processing features and adjacency access the conditional topology information that becomes non-zero when topology is label-informative given features.The same information-theoretic quantity links graph construction, adversarial augmentation, and classification across the framework.

C. Adversarial Learning Framework · 1) Generator Network Architecture: · 2) Graph-based Discriminator Network:

The adversarial framework generates realistic minority DDoS node features and uses a GCN discriminator to distinguish synthetic from real graph data through topology-aware neighborhood aggregation. The generator stabilizes training with normalization, dropout, and shared feature support, while the discriminator applies degree-normalized graph convolutions.

  • C. Adversarial Learning Framework: The GAN generator learns the minority DDoS distribution to produce synthetic samples preserving statistical properties and topological relationships.This augmentation targets realistic minority-class samples rather than independent feature vectors.
  • 1) Generator Network Architecture:: The generator maps random noise vectors into synthetic node features that mimic real DDoS traffic using fully connected layers, batch normalization, and dropout.The noise vector is sampled from a multivariate standard normal distribution, and the generator transforms it from dimension z to feature dimension d.
  • 1) Generator Network Architecture:: Batch normalization enforces zero mean and unit variance, while ReLU supplies efficient nonlinearity and dropout with p = 0.3 reduces overfitting.The architecture uses these operations to accelerate training, improve stability, and regularize the generator.
  • 1) Generator Network Architecture:: The generator bounds each synthetic feature to [−1, 1], matching the support of real node features normalized to the same interval.Shared support prevents the discriminator from separating real and synthetic data solely by feature range.
  • 2) Graph-based Discriminator Network:: The discriminator uses Graph Convolutional Networks to process graph-structured data and distinguish real from synthetic samples.Unlike sample-wise discriminators, it considers the entire graph topology for more sophisticated pattern recognition.
  • 2) Graph-based Discriminator Network:: Each GCN layer aggregates neighboring-node information from graph G = (V, E, X), enabling localized convolution over graph-structured traffic features.The adjacency matrix includes self-loops through  = A + I, so each node contributes its own features during aggregation.
  • 2) Graph-based Discriminator Network:: The GCN represents node states as H^(l), transforms them with trainable matrices W^(l), and applies an activation function σ(·).The initial representation is H^(0) = X, and subsequent dimensions follow the layer-specific hidden sizes.
  • 2) Graph-based Discriminator Network:: Degree-normalized propagation prevents high-degree nodes from disproportionately influencing representations and corresponds to a first-order Chebyshev approximation of spectral graph convolutions.The normalization term uses the symmetrically normalized adjacency structure with self-loops.

3) Adversarial Training Objective:

The adversarial objective trains a generator and discriminator in a minimax game targeting real minority-class DDoS subgraphs. Its ideal equilibrium matches synthetic and real graph distributions, but topology-independent feature generation leaves an irreducible feature–topology divergence unless generated features are topology-stable.

  • Adversarial Training Objective: The minimax game trains the generator to fool the discriminator and the discriminator to distinguish real from synthetic samples.The objective uses generator and discriminator parameters θ and ϕ, respectively.
  • Adversarial Training Objective: Augmentation models only the underrepresented DDoS class: pdata is the real minority-subgraph distribution, while pG is the generator-induced synthetic DDoS distribution.Benign graphs are never synthesized.
  • Adversarial Training Objective: The global minimum is achieved if and only if pG = pdata, where the optimal discriminator outputs 1/2 for every graph and minθmaxϕ LGAN = −log 4.The objective can be rewritten using Jensen–Shannon divergence, which is minimized uniquely when the two distributions match.
  • Topology-Independent Generation: Because generated features are independent of real template topology, the induced joint distribution factorizes as pfake(X, A) = pG(X) pdata(A).This independence means distributional matching of features alone does not guarantee matching of features and adjacency jointly.
  • Topology-Independent Generation: The irreducible KL divergence equals the feature–topology mutual information, KL(pdata ∥ pdata(X) pdata(A)) = Idata(X; A).The result identifies the information that topology-independent generation cannot reproduce.
  • Topology-Stable Consistency: If generated features are topology-stable and their k-NN graphs match templates up to bounded edge-edit distance, the synthetic samples’ contributed Idata(X; A) vanishes and augmentation is asymptotically consistent.This condition defines when topology-conditioned generation would be strictly more expressive.

D. Graph-based Classification Network

The classification network is the framework’s final component, using original and synthetically augmented data to perform DDoS detection.

  • The classification network serves as the final component of the framework.
  • It leverages original data for classification.
  • It also uses synthetically augmented data to perform DDoS detection.

1) Classifier Architecture and Feature Learning:

The independently trained GCN classifier uses graph-structured feature learning to distinguish benign and malicious traffic. Its multilayer receptive field captures temporal-window coordination, while bounded graph degree supports robustness to feature and topology perturbations.

  • Classifier Architecture and Feature Learning: The classifier shares the discriminator’s GCN architecture but is trained independently with a classification objective for benign-versus-malicious traffic discrimination.This separates adversarial training from the final detection decision while preserving consistent graph processing.
  • Receptive Field: With L=3, k=5, and window size w=30, the expected degree is approximately 2k=10, causing the receptive field to saturate the full window within two hops.The resulting bound is |N^(L)(v_i)| ≤ w=30.
  • Receptive Field: Each node representation incorporates information from the entire temporal window, enabling global attack-coordination modeling while avoiding over-smoothing from deeper architectures.The classifier therefore aggregates graph information across the complete subgraph window.
  • Stability and Robustness: The bounded degree yields a certified radius within which classifier predictions cannot flip under feature and topology perturbations.The guarantee is formalized for normalized GCNs on symmetric k-NN graphs with degrees in [k, w−1].
  • Stability and Robustness: Changing m edges perturbs the normalized adjacency operator by at most 2m/k in Frobenius norm, with the resulting logit change bounded through the GCN layers.The tolerance scales as 1/k, so a few mis-assigned k-NN edges from feature noise cause graceful degradation rather than abrupt prediction changes.

2) Data Augmentation Strategy for Class Imbalance:

The augmentation strategy uses generator-produced synthetic DDoS graphs to balance classes while preserving real-traffic structure and graph topology. Its guarantees connect class balancing to classifier generalization and reduced real-sample requirements.

  • Augmentation pipeline: Synthetic DDoS graphs are combined with original samples to balance class distribution and improve recognition of attack patterns.The generator produces synthetic samples for the augmented dataset.
  • Augmentation pipeline: Each synthetic graph uses a real-DDoS template populated with generator-produced features, yielding a topology-aware augmentation pipeline.Equations (24)–(26) define the construction process while respecting graph topology.
  • Class balance guarantee: The class balance guarantee sets N_syn = min(N_0 − N_1, N_max), and the augmented dataset achieves perfect balance (ρ = 1) when the generation budget suffices.Here, N_0 and N_1 denote benign and DDoS sample counts, while N_max limits excessive generation that could cause noise or overfitting.
  • Generalization guarantee: At convergence, p_G ≈ p_data preserves real DDoS traffic properties, while discriminator error controls the augmented classifier’s generalization gap.As ε_D approaches 1/2, the divergence term approaches zero, leaving only the irreducible joint risk λ★; the reported fake detection rate is 45.3%.
  • Real-sample efficiency: Graph augmentation requires fewer real DDoS samples than vector augmentation by the corresponding factor under the coordinated regime.Each real DDoS window can carry up to m̄ correlated same-class labels, inflating effective sample size.

3) Classification Training Objective:

The classifier minimizes cross-entropy loss over the augmented dataset. With softmax outputs, updates scale with prediction error, producing small corrections for confident correct predictions and strong gradients for uncertain or incorrect ones.

  • Classification Training Objective: The classifier minimizes cross-entropy loss over the augmented dataset to train probabilistic predictions.Cross-entropy encourages confident correct predictions while heavily penalizing confident misclassifications.
  • Classification Training Objective: The loss uses one-hot labels, with y_c = 1 for the correct class and y_c = 0 otherwise.This formulation yields small updates for confident correct predictions and stronger corrective updates for uncertain or incorrect predictions.
  • Classification Training Objective: For softmax outputs, the gradient with respect to logits is proportional to the prediction error P(y| G) − y.The update vanishes when the predicted distribution matches the true label and grows toward its maximum for confident misclassifications.

III. EXPERIMENTAL RESULTS … E. Impact of Graph Construction Method

Across four benchmark datasets, GraphGAN was evaluated under consistent graph-based training settings, compared with representative intrusion-detection baselines, and examined through augmentation, training-ratio, and graph-construction studies. It achieved its strongest reported results with topology-aware synthetic samples and k-NN graphs, particularly across datasets and graph-topology alternatives.

  • A. Experimental Settings and Datasets: GraphGAN was evaluated on four network intrusion-detection benchmarks to assess generalizability, including CIC-IDS-2017 with approximately 2.8 million records and 80 flow features.CIC-IDS-2017 spans seven days and includes 14 attack types alongside normal flows.
  • A. Experimental Settings and Datasets: The framework used consistent hyperparameters, including Gaussian noise dimension z = 128, three-layer GCN discrimination, and k-NN graph construction with k = 5.The supplied settings specify the generator input dimension, discriminator depth, and graph-neighbor parameter.
  • A. Experimental Settings and Datasets: The classifier comprised three graph-convolutional layers, global mean pooling, and fully connected layers, trained with Adam at learning rate 0.001, dropout p = 0.3, and cross-entropy loss.Models were implemented in PyTorch with PyTorch Geometric and trained on a GPU with batch size 32 for up to 50 epochs.
  • B. Quantitative Results and Analysis: GraphGAN was compared with representative state-of-the-art intrusion-detection methods spanning different architectural paradigms.The supplied comparison passage identifies Causal Deep Learning, CNN, and GRU-BiLSTM among the evaluated approaches.
  • B. Quantitative Results and Analysis: 95.31% accuracy was achieved by GraphGAN on CIC-IDS-2017, while results were 94.87% on CIC-IDS-2018, 93.42% on UNSW-NB15, and 94.56% on ToN-IoT.All baseline methods and GraphGAN were evaluated across the four datasets using 60% of the training data.
  • C. Necessity of Data Augmentation Using GraphGAN: GraphGAN’s adversarial augmentation generated topology-aware synthetic samples that preserved statistical fidelity and structural relationships under class imbalance.The ablation study varied imbalance ratios from 1:2 to 1:20 and compared full augmentation with no augmentation and random feature generation.
  • D. Impact of Different Training Ratio: GraphGAN consistently achieved the highest accuracy across training-data ratios from 10% to 90%, with particularly pronounced advantages in low-data regimes.The experiments preserved the test-set composition and original class distribution while varying the training-data ratio.

F. Effect of Window Size and Step Size … IV. CONCLUDING REMARKS

GraphGAN’s performance is optimized by specific temporal, graph, architectural, and pooling configurations, while the concluding remarks emphasize its topology-aware approach to imbalance and data scarcity and identify future extensions.

  • F. Effect of Window Size and Step Size: With w=30 and s=10, GraphGAN achieves its best reported accuracy across all four benchmarks.The accuracies are 95.31% on CIC-IDS-2017, 94.87% on CIC-IDS-2018, 93.42% on UNSW-NB15, and 94.56% on ToN-IoT.
  • G. Importance of the Number of Nearest Neighbors (k): The k=5 nearest-neighbor configuration consistently provides the optimal balance between local structure and graph connectivity.It achieves 95.31% on CIC-IDS-2017, 94.87% on CIC-IDS-2018, 93.42% on UNSW-NB15, and 94.56% on ToN-IoT.
  • H. Analysis of GCN Layer Depth: A three-layer GCN architecture achieves the highest accuracy across all datasets by capturing multi-hop structural patterns.The reported accuracies are 95.31% on CIC-IDS-2017, 94.87% on CIC-IDS-2018, 93.42% on UNSW-NB15, and 94.56% on ToN-IoT.
  • I. Study of Generator Architecture Complexity: The proposed four-layer generator produces the highest-quality synthetic samples, with a 45.3% fake detection rate and 95.31% downstream classifier accuracy.The comparison included 2-layer, 3-layer, 4-layer, and 5-layer generators.
  • I. Study of Generator Architecture Complexity: Two-layer generators yield a 78.2% fake detection rate and 89.45% classifier accuracy, whereas five-layer generators yield 47.1% and 94.89%, respectively.The five-layer architecture also exhibits training instability and only marginal improvements, indicating diminishing returns beyond four layers.
  • J. Aggregation Function in Graph Pooling: Global mean pooling consistently achieves the highest accuracy across all four benchmarks.Its accuracies are 95.31% on CIC-IDS-2017, 94.87% on CIC-IDS-2018, 93.42% on UNSW-NB15, and 94.56% on ToN-IoT.
  • IV. CONCLUDING REMARKS: GraphGAN models network traffic as temporal graphs and uses adversarial augmentation with GCN classification to address DDoS class imbalance and data scarcity.The framework integrates temporal graph construction, generative augmentation, and graph-based classification.
  • IV. CONCLUDING REMARKS: Future research includes multi-vector attack classification, hierarchical graphs, federated learning, explainable threat attribution, encrypted traffic analysis, and IoT anomaly detection.These directions extend the framework to broader network security domains.
Loading 2608.17352v1…