# Data driven approach to study the transition from dispersive to dissipative
systems through dimensionality reduction techniques

Mairembam Kelvin Singh1 A. Surjalal Sharma2 N. Nimai Singh1 Moirangthem
Shubhakanta Singh1<EMAIL_ADDRESS>1Department of Physics, Manipur
University, Canchipur-795003, Imphal, Manipur, India.
2Department of Astronomy, University of Maryland, College Park, MD 20742-2421,
USA.

###### Abstract

Complexity is often exhibited in dynamical systems, where certain parameters
evolve with time in a strange and chaotic nature. These systems lack
predictability and are common in the physical world. Dissipative systems are
one of such systems where the volume of the phase space contracts with time.
On the other hand, we employ dimensionality reduction techniques to study
complicated and complex data, which are tough to analyse. The Principal
Component Analysis (PCA) is a dimensionality reduction technique used as a
means to study complex data. Through PCA, we studied the reduced dimensional
features of the numerical data generated by a nonlinear partial differential
equation called the Korteweg de Vries (KdV) equation, which is a nonlinear
dispersive system, where solitary waves travel along a specific direction with
finite amplitude. Dissipative nature, specific to that of the Lorenz system,
were observed in the dimensionally reduced data, which implies a transition
from a dispersive system to a dissipative system.

Keywords: Dispersive system; Dissipative system; Dimensionality reduction;
Principal Component Analysis.

##  IIntroduction

Dynamical systems Birkhoff ; Brin  that evolve with space and time show
contrasting and varying features that uniquely define the system. These
features are often found to be complex and cannot be studied easily. They are
mathematically represented by linear or nonlinear differential equations and
there are various analytical techniques to solve them. However, in certain
cases analytical techniques are not feasible to produce a realistic result,
wherein we use numerical techniques that provide us numerical data from which
we can study the qualitative features of the system.

Dissipative Nicolis ; Brogliato ; France  and dispersive systems Whitham ;
Benjamin  are types of dynamical systems that exhibit complex behavior and
rely on numerical techniques to produce realistic and reliable numerical
solutions for better analysis. These two systems actually show contrasting
features. The most common example of a dissipative system is the Lorenz
strange attractor, which is based on a convection system in fluids with
uniform depth and a linearly approximated temperature gradient between the
layers of the fluid Saltzman ; Lorenz . The solutions of the Lorenz equations
have irregular oscillations but always remain confined to a particular bounded
region, giving a unique trajectory, called as “strange attractor”. For the
case of dispersive system, we can cite the Korteweg de Vries (KdV) equation
KdV  which describes the time evolution of dispersive waves. Its solutions
known as “solitons” belong to the class of solitary waves, that travel along a
direction with a finite amplitude.

The numerical solutions of the above mentioned dynamical systems that show
complex behavior are interpretable and can be derived using conventional
numerical techniques Stuart  like the Runge-Kutta Bala ; Jain ; Shubha ;
Butcher  and multi-step methods Stuart . However, analysis of large scale and
complicated numerical data can be cumbersome. So, dimensionality reduction
Reddy  and phase space reconstruction techniques King ; Broomhead ; Sharma
are also available for easier qualitative interpretation.

In Broomhead , Takens’ theorem Takens  and Singular Spectrum Analysis (SSA)
Bertero ; Pike  were used for phase space reconstruction of the Lorenz system.
This technique was also used in Sharma  for studying the low dimensional
behavior of the global magnetospheric dynamics. In this paper, we try to
replicate the motive used in these past studies with a different technique
called the Principal Component Analysis (PCA) Jolliffe ; Bradde . We also
applied this technique to the dispersive system of the KdV equation and found
that there is a transition to dissipative nature at reduced dimensions of the
system. We solely focused on a data-driven approach by using the numerical
solutions generated through conventional numerical techniques.

The paper is organised as follows. In section II, the general steps and
procedure for implementing the technique that we used are described. Section
III describes the various results that we obtained in two stages; the first
part is to validate the technique by applying to the Lorenz system and
obtaining similar results as done in previous work Broomhead , the second part
is to apply the technique to the dispersive KdV system. A brief discussion of
the results that we obtained about the transition from the dispersive to
dissipative system is also given.

##  IIMethodology

The first preliminary step is to produce the numerical solution of the system
using a conventional numerical technique. While simple analytical technique
like the separation of variables are more suited to linear PDEs, numerical
techniques like the Runge-Kutta 4${}^{\text{th}}$ order (RK4) method are more
commonly used for nonlinear PDEs. Most complex systems have a nonlinear PDE or
a coupled system of nonlinear PDEs associated with them. These PDE(s) can
describe the time evolution of the dynamical variables involved. In some
cases, the solution(s) of the PDE(s) describe a spatio-temporal evolution of
the dynamical variables along space and time. In the two systems that we
consider here, we applied the RK4 method Bala ; Jain ; Butcher  to generate
the numerical solutions. This method is based on the general extrapolation
equation, $Y_{i+1}=Y_{i}+mh$, where $m$ represents the slope and $h$
represents the step size. For a first order differential equation,
$\displaystyle\frac{dY}{dX}=f(X,Y)$, with an initial point $(X_{i},Y_{i})$,
the RK4 method uses the following formula for determining the numerical
solution at a particular point:

$\displaystyle
Y_{i+1}=Y_{i}+\left(\frac{m_{1}+2m_{2}+2m_{3}+m_{4}}{6}\right)h$ (1)

where,

$\displaystyle\begin{split}m_{1}&=f(X_{i},Y_{i})\\\
m_{2}&=f\left(X_{i}+\frac{h}{2},Y_{i}+\frac{m_{1}h}{2}\right)\\\
m_{3}&=f\left(X_{i}+\frac{h}{2},Y_{i}+\frac{m_{2}h}{2}\right)\\\
m_{4}&=f\left(X_{i}+h,Y_{i}+m_{3}h\right)\end{split}$ (2)

However, for cases where there are higher order equations involved, we
generally reduce them to a first order equation. After generating the
numerical solution, we use it to construct the trajectory matrix Hassani ;
Darcy ; Golyan  of the system. This step will depend on the system under
consideration. For the KdV system, we treated the numerical solution directly
as its trajectory matrix as the numerical solution is already a two
dimensional data. Moreover, construction of trajectory matrix is commonly
employed for one dimensional linear data.

After construction of the trajectory matrix, we then obtain the corresponding
covariance matrix, which contains the covariances of all elements in the data
Hui . This is the first step in PCA and the step that differentiates the
technique from other techniques like the SSA. We also use the Singular Value
Decomposition (SVD) to enable us to classify the data according to the
singular values of the covariance matrix, arranged in a decreasing order of
their magnitude. This is followed by the extraction of the principal
components, which we use to project the original data along the eigenvectors
of the principal components. With this, we are able to obtain a dimensionally
reduced data Li  and achieve to have a reconstructed phase space of the
system.

The various steps involved in the technique we used are listed as follows:

  1. 1.

Compute the numerical solution of the system using conventional numerical
techniques. From the numerical data, obtain the corresponding trajectory
matrix of the system, say $\bar{X}$.

  2. 2.

Construct the covariance matrix of the numerical data. For any two variables
$x$ and $y$, their covariance is given by
$\sigma_{xy}^{2}=E[(x-\bar{x})(y-\bar{y})]$. For a single variable, its
covariance is simply called variance, and is given by
$\sigma_{x}^{2}=E[(x-\bar{x})^{2}]$ Hui .

  3. 3.

Apply Singular Value Decomposition (SVD) to the covariance matrix and the
singular matrix so obtained will determine the covariances of the data
arranged in order of their decreasing magnitude. This will enable us to
extract the principal components with larger covariances.

  4. 4.

Extract the principal components from the observations made using SVD. Then,
construct the projection matrix, say $P$, using the eigenvectors corresponding
to the singular values of the principal components Li .

  5. 5.

Use the projection matrix, $P$ to perform matrix dot product to the original
matrix, $\bar{X}$ and obtain the dimensionally reduced matrix, say
$X^{\prime}=\bar{X}P$, whose columns are the eigenvectors that contain the
extracted features Li .

###  II.1 Trajectory Matrix

For the construction of the trajectory matrix, we take a linear time series
$x(t)$ and transform it into a multi-dimensional series $X_{0},...,X_{K}$,
where each vector $X_{i}$ is called the $L$-lagged vector, the $L$ denoting
the window length. $K$ will represent the number of columns of the trajectory
matrix and $L=N-K+1$, where $N$ is simply the total number of data points or
we can call it the number of ‘moments’ in the time series. The window length
$L$ is also such that $\displaystyle 2\leq L\leq\frac{N}{2}$.

Each $L$-lagged vector $X_{i}$ can be represented as
$X_{i}=\left[x^{\prime}_{i},...,x^{\prime}_{N-L+i}\right]$ and so the
trajectory matrix will be given by Hassani ; Darcy ; Golyan ,

$\displaystyle\bar{X}=\begin{bmatrix}x^{\prime}_{0}&x^{\prime}_{1}&...&x^{\prime}_{N-L}\\\
x^{\prime}_{1}&x^{\prime}_{2}&...&x^{\prime}_{N-L+1}\\\ .&.&...&.\\\
x^{\prime}_{L-1}&x^{\prime}_{L}&...&x^{\prime}_{N-1}\\\ \end{bmatrix}$ (3)

All the elements along the anti-diagonal are equal and so the trajectory
matrix is a Hankel matrix Widom .

###  II.2 Principal Component Analysis

PCA reduces the dimension of a data by classifying the various data points
using their correlation or covariance. After the classification or ordering of
the data from the highest variance to the lowest variance, we extract a few of
the highly uncorrelated data points and project the original data along the
dimensionally reduced dataset. This projection will allow us to obtain a new
dataset free from noise and easier to analyse because of the reduced
dimensions Hui ; Li ; Jolliffe ; Bradde .

PCA starts with the construction of the covariance matrix, which contains the
covariances of all elements of a data Hui . Those components with the larger
covariances, which we can choose to use it for dimensionality reduction and
projecting the original data along it, are called the principal components.
The number of components that we choose, depends on the convenience of the
data. For example, if we want to choose those components that captures 99$\%$
of the variance, then, we can use the condition,
$\displaystyle\frac{\sum_{i=1}^{k}\sigma_{i}}{\sum_{i=1}^{r}\sigma_{i}}\geq
0.99$, where $k$ denotes the number of components that we are choosing,
$\sigma_{i}$ denotes the $i^{\text{th}}$ singular value and $r$ denotes the
total number of components Jolliffe . Applying SVD on the covariance matrix
and plotting the singular values will give the idea of how many singular
values do we have to choose as principal components.

After choosing the $k$ principal components, we then construct a projection
matrix $P$, simply by arranging the eigenvectors corresponding to the singular
values of the principal components. Finally, we can use this projection matrix
to perform matrix dot product to the trajectory matrix $\bar{X}$ in (3) to
obtain a dimensionally reduced matrix $X^{\prime}=\bar{X}P$, whose columns are
the eigenvectors of the reduced system that contains features of the entire
system. Upon plotting the corresponding columns of the projected matrix
pairwise, we can get the reconstructed phase space of the system.

###  II.3 Singular Value Decomposition

Singular Value Decomposition (SVD) is a technique to detect the part of a
system with the most variation and use the subsequent part of the system to
approximate the entire system with reduced dimensions by ordering the data
points from the most variation to the least svd ; Stewart .

SVD begins with the fact that an $m\times n$ matrix $\psi$ can be decomposed
into three matrices svd ; Stewart , two orthogonal matrices $L$, $R$ and a
diagonal matrix $S$ such that,

$\displaystyle\psi_{mn}=L_{mm}S_{mn}R^{T}_{nn}$ (4)

where $L$ is the matrix containing the orthonormal eigenvectors of
$\psi\psi^{T}$ and $R$ is the matrix containing the orthonormal eigenvectors
of $\psi^{T}\psi$. The diagonal elements of the diagonal matrix $S$ are called
the singular values, which are the square roots of the eigenvalues of
$\psi^{T}\psi$ arranged in decreasing order. $S$ is called the singular
matrix, $L$ and $R$ are respectively called the left singular and right
singular matrices.

The idea behind SVD is that the singular values in $S$ and the orthonormal
eigenvectors in $L$ and $R$ can be used to represent the original matrix
$\psi$ as a linear combination of the three components. In this way, we can
split a particular system and approximate it into lower dimensions from the
analysis of the singular values so that we get a truncated version of the
system.

##  IIIResults and Discussion

Using the technique and steps described in the previous section, we
implemented the same on two different systems. First, we implemented the
technique on the dissipative Lorenz system. This part was intended to build
the basis and define reference points for the other tasks. Second, we applied
the technique to the dispersive KdV system. This was done to establish the
transition study of dispersive to dissipative systems, purely based on a data
driven approach. Both the systems considered are nonlinear and similar
approach in applying the technique was used, with certain differences based on
their numerical solutions.

###  III.1 Lorenz System

Figure 1: (A)-(C): The phase diagrams of the three variables of Lorenz system,
taken two at a time. We see that the trajectories confine to a bounded region.
The points oscillate in an irregular and non-periodic manner. (D)-(F): These
are the time series plots of each variable.

Edward Lorenz, in 1963, simplified a model of convection system derived by
Saltzman Saltzman . This convection system was studied in a fluid system with
uniform depth and a linearly approximated temperature gradient between the
layers of the fluid. Lorenz derived the following set of equations Lorenz :

$\displaystyle\begin{split}\dot{x}&=\sigma(y-x)\\\ \dot{y}&=rx-y-xz\\\
\dot{z}&=xy-bz\\\ \end{split}$ (5)

Here, the variables $x$ is proportional to the intensity of the convective
motion, $y$ is proportional to the temperature difference between the rising
and declining fluid currents and $z$ is proportional to the deviation of the
temperature gradient from linearity Lorenz . $\sigma$ is called the Prandtl
number, $r$ is called the Rayleigh number and $b$ gives the size of the region
approximated by the system Record . These three parameters are simply obtained
as a result of dimensionless scaling to the convection equations derived by
Saltzman Saltzman . The dot simply denotes the first order derivative with
respect to time.

Lorenz found out that the deterministic system in (5) had a strange dynamics.
The solutions have irregular oscillations but always remain confined to a
particular bounded region, giving a unique trajectory, called as “strange
attractor”. This “strange attractor” was later found out to be a fractal,
having a fractional dimension between 2 and 3 Strogatz .

Using the RK4 technique, the Lorenz equations (5) is solved with the initial
values of the variables, $x_{0}=0$, $y_{0}=1$ and $z_{0}=0$; and the values of
the parameters set at $\sigma=10$, $r=28$ and $\displaystyle b=\frac{8}{3}$.
Consequently, we will get the time series data of the three variables, namely,
$x(t)$, $y(t)$ and $z(t)$.

Figure 2: Normalised singular values of the covariance matrix of the
trajectory matrix of the time series data $x(t)$ of the Lorenz system. For
each $\kappa$, there are two distinct parts, the deterministic part
represented by the declining line and the noise floor represented by the
horizontal and nearly flat part. As we decrease the value of $\kappa$, the
number of singular values in the deterministic part decreases. The noise floor
show the small differences between the smaller but finite singular values.

The phase diagrams for the solutions are shown in Fig. 1(A)-(C). The time
series plots of each variable are also shown in Fig. 1(D)-(F). Some
distinctive properties derived from the figures are discussed as follows:

  1. 1.

Non-periodic - The trajectory of each variable does not approach a periodic or
an equilibrium limit. There is an unstable equilibrium point at the centre of
each loop around which the points rotates and then switches to the other
unstable equilibrium point Record .

  2. 2.

Nonlinearity - The Lorenz system (5) has two quadratic terms $xy$ and $xz$,
which makes the system nonlinear Strogatz .

  3. 3.

Sensitive to Initial Conditions - A characteristic feature of the Lorenz
system is that a slight perturbation in the initial values of the variables
can bring a drastic change to the entire outcome of the system’s dynamics. As
shown in Fig. 1(D)-(F), the trajectories which began with similar conditions,
eventually depicts quite an unrelated behavior after some time. This property
also makes long-term prediction impossible, unlike what classical physics does
Record .

  4. 4.

Symmetry - If we replace $(x,y)$ with $(-x,-y)$, there is no change in the
equations. This shows that the Lorenz system is a symmetric system with
symmetric solutions Strogatz .

  5. 5.

Dissipative - Lorenz system is dissipative, which implies that volumes in the
phase space contracts as time approaches infinity Strogatz .

  6. 6.

Fixed points - For the Lorenz system (5), $(0,0,0)$ is always a fixed point
for all values of the different parameters. However, for $r>1$, there are two
symmetric fixed points, $(\sqrt{b(r-1)},\sqrt{b(r-1)},r-1)$ and
$(-\sqrt{b(r-1)},-\sqrt{b(r-1)},r-1)$. Also, for $r<1$, every trajectory
approaches the origin $(0,0,0)$, as time goes to infinity. So, the origin is a
globally stable fixed point for $r<1$ Strogatz .

The Lorenz system is referred to as “chaotic” Chaos , owing to the fact that
for a certain range of parameters, there are no stable fixed points and no
stable limit cycles, yet the trajectories confine to a bounded region Strogatz
. Among the values of the parameters that we used to solve the Lorenz system
(5), the value of $r$ is just past the Hopf bifurcation Hopf , which implies a
switch in the system’s stability. Starting from the initial values, the
solution sets into an irregular oscillation. The phase plot of $x$ vs $z$
looks like the wings of a butterfly Strogatz ; Lorenz . As we are viewing the
trajectory from a two dimensional perspective, it seems like the trajectories
cross each other. But, it won’t be the case when viewed from three dimensions.
The trajectory starts from the origin and spirals towards the central fixed
point on the left. From there, it spirals outwards, and then jumps towards the
right again after a certain period of time and then towards the left and so on
indefinitely.

Using the time series data $x(t)$, we can construct the corresponding
trajectory matrix $\bar{X}$. The number of samples considered in each window
is varied as, $\kappa=(25,13,9,7,5,3)$ Broomhead .

Next, we construct the covariance matrix of the trajectory matrix $\bar{X}$
and apply SVD to obtain the singular values, for each $\kappa$. The normalised
singular values are plotted as shown in Figure 2. We see that for each
$\kappa$, there are two distinct parts, the deterministic part represented by
the declining line and the noise floor represented by the horizontal and
nearly flat part. As we decrease the value of $\kappa$, the number of singular
values in the deterministic part decreases. The noise floor show the small
differences between the smaller but finite singular values. Practically, they
should be zero but the presence of noise in the data makes them finiteSharma .

Figure 3: Reconstructed phase space of the Lorenz system using three
components of the reduced matrix $X^{\prime}$, namely, $c_{1}$, $c_{2}$ and
$c_{3}$, plotted pairwise.

To begin the reconstruction of the phase space and the subsequent
dimensionality reduction, we shall use only the trajectory matrix
corresponding to $K=25$. Then, we determine the singular values and
eigenvectors of the covariance matrix and arrange the singular values
according to their decreasing order. We select the top 3 singular values and
their corresponding eigenvectors. These are called the principal components of
the data and it captures most of the variance. Using these selected
eigenvectors, we construct the projection matrix $P$. Finally, we can get the
reduced matrix $X^{\prime}$ by performing dot product of the projection matrix
$P$ and the trajectory matrix $\bar{X}$. To obtain the reconstructed phase
space, we extract each column of the reduced matrix $X^{\prime}$ and plot them
pairwise. The three columns or components of the reduced matrix are named as
$c_{1}$, $c_{2}$ and $c_{3}$ Broomhead . The pairwise projections of the
reconstructed phase space are shown in Figure 3.

The reconstructed phase portraits obtained in Figure 3 are similar to that
obtained in Broomhead . This validates our technique and shows that we can
conduct the process by using the covariance matrix, rather than by directly
using the trajectory matrix. Now, after this validation we applied the
technique to the nonlinear dispersive KdV system.

###  III.2 Korteweg de Vries (KdV) System

The Korteweg de Vries (KdV) equation KdV  is a non-linear 3${}^{\text{rd}}$
order partial differential equation that describes the time evolution of
dispersive waves. Its solutions known as “solitons” belong to the class of
solitary waves, that travel along a direction with a finite amplitude. These
solitons can suffer collisions with one another and retain their shape and
speed, showing their elastic nature Brauer ; Zabusky .

The KdV equation Drazin ; Ablowitz  is given as,

$\displaystyle u_{t}+6uu_{x}+u_{xxx}$ $\displaystyle=$ $\displaystyle 0$
$\displaystyle\Longrightarrow u_{t}+3(u^{2})_{x}+u_{xxx}$ $\displaystyle=$
$\displaystyle 0$ (6)

Here,

$\displaystyle u$ $\displaystyle=$ $\displaystyle
u(x,t);~{}~{}u_{t}=\frac{\partial u(x,t)}{\partial t};$ $\displaystyle u_{x}$
$\displaystyle=$ $\displaystyle\frac{\partial u(x,t)}{\partial
x};~{}~{}u_{xxx}=\frac{\partial^{3}u(x,t)}{\partial x^{3}}$
$\displaystyle(u^{2})_{x}$ $\displaystyle=$
$\displaystyle\frac{\partial}{\partial x}[u(x,t)]^{2}$

The KdV equation can be numerically solved by imposing certain periodic
boundary conditions. The Fourier pseudo-spectral method consisting of the
continuous and discrete Fourier Transforms can be applied to such a periodic
boundary problem Jie . The numerical solution is based on the combination of
the RK4 method Butcher ; Bala ; Jain  and Fast Fourier Transform (FFT)
algorithm Jie ; Trefethen ; Dafermos . To apply RK4, we need to convert the
KdV equation to a first order ODE, which can be done after the discretization
of the equation.

We set the initial condition $\displaystyle
u(x,0)=f(x)=\frac{v}{2}\text{sech}^{2}\left[\frac{\sqrt{v}}{2}x\right]$, which
is based on the exact solution of the equation, $\displaystyle
u(x,t)=\frac{v}{2}\text{sech}^{2}\left[\frac{\sqrt{v}}{2}(x-vt)\right]$, where
$v$ is the velocity of the soliton and the periodic boundary condition
$u(-l,t)=u(l,t)$. We, then, change the variable $x$ to $z=\frac{\pi x}{l}+\pi$
so that the domain is changed from $[-l,l]$ to $[0,2\pi]$. This is needed to
use the Discrete Fourier Transform (DFT) and apply the FFT algorithm. Making
this change reduces the equation to,

$\displaystyle u_{t}+\frac{3\pi}{l}(u^{2})_{z}+\frac{\pi^{3}}{l^{3}}u_{zzz}=0$

(a) $N=128=2^{7}$ and $v=324$

(b) $N=64=2^{6}$ and $v=121$

(c) $N=32=2^{5}$ and $v=16$

(d) $N=16=2^{4}$ and $v=9$

Figure 4: Evolution of solitons with time and space for different values of
$N$. We can observe the periodic behavior due to the periodic boundary
conditions and the appearance of inherent noise indicated by the small spikes.

Applying the DFT, we have, $\displaystyle u(x,t)\rightarrow
u(z,t)=\sum_{k}\hat{w}_{k}(t)e^{ikz}$, where $\hat{w}_{k}$ is called the
$k^{\text{th}}$ Fourier transform of $u(z,t)$. Then, using the relation,
$\hat{w}_{k}^{(n)}=(ik)^{n}\hat{w}_{k}$, where the superscript “$(n)$” on
$\hat{w}_{k}$ denotes its $n^{\text{th}}$ order spatial derivative, we have,

$\displaystyle\frac{d\hat{w}_{k}(t)}{dt}+\frac{3i\pi
k}{l}\widehat{(w^{2})}_{k}-\frac{ik^{3}\pi^{3}}{l^{3}}\hat{w}_{k}=0$

Figure 5: Normalised singular values of the covariance matrix of the KdV
trajectory matrix. For smaller values of $N$, we can see the larger covariance
between the larger singular values. The noise floor is almost non-existent for
larger values of $N$.

Now, multiplying the above equation with the integrating factor $\displaystyle
e^{-ik^{3}\pi^{3}t/l^{3}}$, we can reduce the equation as:

$\displaystyle\frac{d}{dt}\left(e^{\frac{-ik^{3}\pi^{3}t}{l^{3}}}\hat{w}_{k}\right)=-\frac{3i\pi
k}{l}e^{\frac{-ik^{3}\pi^{3}t}{l^{3}}}\widehat{(w^{2})}_{k}$
$\displaystyle\Longrightarrow\frac{d\hat{g}_{k}}{dt}=-\frac{3i\pi k}{l}\alpha
F\left[\left\\{F^{-1}\left(\frac{\hat{g}_{k}}{\alpha}\right)\right\\}^{2}\right]$
(7)

where $\alpha=e^{\frac{-ik^{3}\pi^{3}t}{l^{3}}}$,
$\hat{g}_{k}=\alpha\hat{w}_{k}$, $F[~{}~{}]$ denotes the Fourier transform and
$F^{-1}(~{}~{})$ denotes the inverse Fourier transform. Now, the RK4 method
can be applied to (III.2). The corresponding computer code can be run using
any programming language containing in-built modules to determine the FFT and
inverse FFT (IFFT).

The particular FFT algorithm that we used for simulation is the “decimation-
in-time” algorithm for which the total length of the sequence must be a power
of two Saidi . So, the numerical simulation of the evolution of soliton(s) is
made by initially setting up $N=2^{r}$ grids for each particular value of
time, where $r$ is an integer. These grids are known as Fourier collocation
points Jie . The step size for the values of time is set as
$\displaystyle\Delta t=\frac{0.4}{N^{2}}$, so as to remain in the stability
region Trefethen .

For higher values of $N$, the velocity of the soliton is set at higher values
because, if the velocity is small, we can almost never see the evolution with
time and the soliton looks as if they are frozen. Also, the values are made a
perfect square simply for smooth numerical calculation. The velocity of the
soliton is reduced considerably for small number of grids because the results
for FFT is too small for computation, at large velocities for small $N$. The
step size and the upper limit of time is set accordingly so that each grid
point is calculated using nearly 1000 iterations, for every value of $N$,
except for the case of $N=16$, where the number of iterations is reduced to
256 as we observe a very distorted numerical plot at larger time.

We begin with $N=128=2^{7}$ grids, and then continue observing for smaller
values, $N=64=2^{6}$, $N=32=2^{5}$ and $N=16=2^{4}$. We observe the appearance
of the periodic behavior of the wave due to the periodic boundary conditions
and small spikes in the wave which indicates the presence of inherent noise in
the system (Figure 4). From the results, we see a relationship between the
appearance of periodicity and noise in the system for larger or smaller values
of velocity of the soliton.

As the numerical data obtained from the numerical solutions are two
dimensional, we treat it directly as the trajectory matrix of the data. For
each plot corresponding to the values of $N$, we considered a numerical data
consisting of only 26 time steps arranged along the row even though the whole
simulation was run to approximately 1000 iterations. This is done mainly for
two reasons, firstly, the time step was very small $(\approx
10^{-6}~{}\text{to}~{}10^{-3})$ and secondly to avoid complication. Thus the
trajectory matrix will have 26 rows and $N$ number of columns.

Figure 6: Reconstructed phase space of the reduced system of KdV Equations for
$N=16$. We can see the similarity of the phase space with that of a Lorenz
system. Figure 7: Reconstructed phase space of the reduced system of KdV
Equations for $N=32$. Here, a new feature in the form of a smaller closed loop
is observed. Figure 8: Reconstructed phase space of the reduced system of KdV
Equations for $N=64$. Here, we see the convergence of the same pattern.

The covariance matrix is then constructed and SVD is applied. The plot of the
normalised singular values is shown in Figure 5. We find a striking difference
in the partition of the noise floor and the deterministic part for the Lorenz
system as compared to the KdV system. In the Lorenz system, we see a steeper
deterministic part and a flatter noise floor for larger samples while it is
the opposite in the case of the KdV system. The noise floor is flatter and the
deterministic part is steeper for smaller values of $N$ while this separation
is quite non-existent for larger values of $N$.

For the KdV system, we choose four principal components and the original data
can be projected along the eigenvectors of the projection matrix. The reduced
matrix will have four columns or components and they are named as
$(y_{1},y_{2},y_{3},y_{4})$. We stick to the cases of $N=16,32,64$ and the
pairwise plots of these components are made. These are shown in Figures 6, 7
and 8 respectively for each value of $N$ that we considered.

The reconstructed phase space of the KdV system resembles closely to that of a
Lorenz system. The phase portraits also show closed concentric loops as we
increase the values of $N$. Specifically, for $N=16$, there is only one loop,
for $N=32$, there are two loops and for $N=64$, there are three loops. In
making these phase space reconstruction, we decreased the velocities of the
solitons from the previously set values. In doing so, we were able to observe
a similarity in the pattern with that of a Lorenz system and the convergence
of the similar pattern as $N$ is increased. The previous velocities of
solitons used were 9, 16 and 121, respectively for $N=16,32,64$ and they are
now changed to 4, 9 and 16, respectively. The previous values were set so as
to view a distinctive pattern of evolution of the solitons while working on
the numerical solutions. As the amplitudes of the solitons depend directly on
their velocities, decreasing the velocities will obviously decrease the
amplitudes and we would have not seen the evolution that we saw in the plots
of Figure 4.

The decrease in the velocities does not necessarily mean a change in the
behavior of evolution of the solitons. It simply means that the amplitudes of
the solitons are decreased considerably. There won’t be any affect in the
principle of the technique we were applying by the change of this parameter.
This is in fact supported by the fact that the singular values of the
covariance matrix show almost a similar pattern when the velocities are
changed. The only distinctive change that can be recognised is the fact that
the curves for $N=64~{}\text{and}~{}128$ looks more definitive with respect to
the separation of the deterministic part and the noise floor (Figure 9).

Figure 9: Normalised singular values of the covariance matrix of the KdV
trajectory matrix for small velocities and hence small amplitudes of the
solitons. The curves for $N=64~{}\text{and}~{}128$ looks more definitive with
respect to the separation of the deterministic part and the noise floor, as
compared to that of Figure 5.

So, we can conclude that at very small velocities and hence small amplitudes
of the solitons, the dispersive KdV system transitions to a dissipative
system. This is evident from the fact that the reconstructed phase portraits
resembles that of the Lorenz system. Also, for higher values of $N$, we see
concentric closed loops, which signifies the nature of volume contraction of a
dissipative system.

##  IVConclusion

The technique of Principal Component Analysis (PCA) is found to be effective
in studying the reduced dimensional features of dynamical systems. The
reconstruction of phase space of a dissipative system like the Lorenz system
shows a similar result to what researchers have obtained in the past. However,
when we applied the same technique to a dispersive system like the KdV system,
we can observe a transition to a dissipative nature.

The reconstructed phase space of the KdV system using the principal components
show a similar pattern to that of a Lorenz system. The trajectory of the phase
space does not approach a stable equilibrium point, but remains confined to a
specific boundary. As we increase the grid size $(N)$, we also observed that
the pattern shows concentric closed loops, with the trajectory jumping from
one loop to an inner loop, signifying a contraction in volume as the
trajectory evolves. These are the characteristic features mentioned in the
discussion of the Lorenz system.

However, the above observations are made by switching the values of velocities
of the solitons. The values of velocities used for producing the numerical
solutions were set to facilitate smooth numerical computations. These values
could not produce the transitional characteristics of the reconstructed phase
space. So, to display a good view of the concentric and convergent pattern, we
decreased the values of the velocities. Quantitatively, this will only
decrease the amplitudes of the solitons but will have no affect on the
qualitative behavior of the spatio-temporal evolution of the solitons.

Thus, we can conclude that the reduced dimensional features of a dispersive
system shows dissipative behavior. In other words, our study reveals the
dissipative nature of a dispersive system embedded in reduced or lower
dimensions. This transition is also possible only at small amplitudes of the
solitons. We completely emphasised on a data driven approach based on the
numerical solutions provided by the conventional numerical techniques.

Acknowledgements
M.K. Singh is a Junior Research Fellow (JRF) under the National Fellowship for
Scheduled Castes Students (NFSC) scheme of University Grants Commission (UGC),
Delhi, India. The simulations were done through Python 3 programs written
using the Spyder environment of Anaconda distribution. Simulations that
require large computational tasks were done in HPE ProLiant DL380 Gen10 Plus
installed in the Department of Physics, Manipur University.
A.S. Sharma passed away before the completion of this manuscript. His guidance
and motivation throughout the development of this paper is immensely
acknowledged.

Author Contributions:
A.S. Sharma conceptualized the work. M.K. Singh and M.S. Singh did the
analytical, computational work and preparation of the figures. M.K. Singh,
N.N. Singh and M.S. Singh wrote the manuscript, read, analysed the results,
and approved the final manuscript.

Additional Information
Competing interests:
The authors declare no competing interests.

## References

  * (1) Birkhoff, G.D. (1927). Dynamical Systems (Vol. 9). American Mathematical Society. ISBN: 978-0-8218-1009-5.
  * (2) Brin, M. & Stuck, G. (2002). Introduction to Dynamical Systems. Cambridge University Press. ISBN: 0-511-02937-3.
  * (3) Nicolis, G. (1986). Dissipative systems. Reports on Progress in Physics, 49(8), 873.
  * (4) Brogliato, B., Lozano, R., Maschke, B. & Egeland, O. (2007). Dissipative Systems Analysis and Control. Theory and Applications, 2, 2-5.
  * (5) Franceschini, V. (1983). Bifurcations of tori and phase locking in a dissipative system of differential equations. Physica D: Nonlinear Phenomena, 6(3), 285-304. DOI: https://doi.org/10.1016/0167-2789(83)90013-1
  * (6) Whitham, G.B. (2011). Linear and Nonlinear Waves. John Wiley & Sons. ISBN: 0-471-35942-4.
  * (7) Benjamin, T.B., Bona, J.L. & Mahony, J.J. (1972). Model equations for long waves in nonlinear dispersive systems. Philosophical Transactions of the Royal Society of London. Series A, Mathematical and Physical Sciences, 272(1220), 47-78. DOI: https://doi.org/10.1098/rsta.1972.0032
  * (8) Saltzman, B. (1962). Finite Amplitude Free Convection as an Initial Value Problem—I. J. Atmos. Sci., 19(4), 329-341.
  * (9) Lorenz, E.N. (1963). Deterministic Nonperiodic Flow. J. Atmos Sci., 20(2), 130-141.
  * (10) Korteweg, D.J. & de Vries, G. (1895). On the Change of Form of Long Waves Advancing in a Rectangular Canal and a New Type of Long Stationary Waves. Philosophical Magazine Series, 39, 422-443.
  * (11) Stuart, A. & Humphries, A.R. (1998). Dynamical Systems and Numerical Analysis (Vol. 2). Cambridge University Press. ISBN: 0-521-64563-8.
  * (12) Balagurusamy, E. (2006). Numerical Methods. Tata McGraw-Hill. ISBN: 0-07-463311-2.
  * (13) Jain, M.K., Iyengar, S.R.K. & Jain, R.K. (2004). Numerical Methods for Scientific and Engineering Computation. New Age International (P) Limited. ISBN: 81-224-1461-3.
  * (14) Singh, M.S. (2017). Programming with Python: and its applications to Physical Systems. Manakin Press. ISBN: 973-93-84370-49-7.
  * (15) Butcher, J.C. (1996). A history of Runge-Kutta methods. Applied Numerical Mathematics, 20(3), 247-260. DOI: https://doi.org/10.1016/0168-9274(95)00108-5
  * (16) Reddy, G.T., Reddy, M.P.K., Lakshmanna, K., Kaluri, R., Rajput, D.S., Srivastava, G. & Baker, T. (2020). Analysis of dimensionality reduction techniques on big data. IEEE Access, 8, 54776-54788. DOI: https://doi.org/10.1109/ACCESS.2020.2980942
  * (17) King, G.P., & Stewart, I. (1992). Phase space reconstruction for symmetric dynamical systems. Physica D: Nonlinear Phenomena, 58(1-4), 216-228. DOI: https://doi.org/10.1016/0167-2789(92)90110-9
  * (18) Broomhead, D.S. & King, G.P. (1986). Extracting Qualitative Dynamics from Experimental Data. Physica 20D. 217-236.
  * (19) Sharma, A.S. (1993). Reconstruction of phase space from time series data by singular spectrum analysis. Physics of Space Plasmas, 13, 423.
  * (20) Takens, F. (2006). Detecting strange attractors in turbulence. In Dynamical Systems and Turbulence, Warwick 1980: proceedings of a symposium held at the University of Warwick 1979/80 (pp. 366-381). Berlin, Heidelberg: Springer Berlin Heidelberg.
  * (21) Bertero, M. & Pike, E.R. (1982). Resolution in diffraction-limited imaging, a singular value analysis. Optica Acta: Int. J. Opt., 29(6), 727-746.
  * (22) Pike, E.R., McWhirter, J.G., Bertero, M. & De Mol, C. (1984). Generalised information theory for inverse problems in signal processing. In IEE Proceedings F (Communications, Radar and Signal Processing) (Vol. 131, No. 6, pp. 660-667). IET Digital Library.
  * (23) Jolliffe, I.T. (2002). Principal Component Analysis. 2nd Edition. Springer. ISBN: 0-387-95442-2.
  * (24) Bradde, S. & Bialek, W. (2017). PCA meets RG. J. Stat. Phys., 167, 462-475.
  * (25) Hassani, H. (2022). Singular Spectrum Analysis: Methodology and Comparison, J. Data Sci. 5, no. 2, 239-257, DOI 10.6339/JDS.2007.05(2).396.
  * (26) D’Arcy, J.: Introducing SSA for Time Series Decomposition. https://www.kaggle.com/code/jdarcy/introducing-ssa-for-time-series-decomposition/notebook Accessed on 13th October, 2023.
  * (27) Golyandina, N., Nekrutkin, V. & Zhigljavsky, A. (2001). Analysis of Time Series Structure: SSA and related techniques. Chapman & Hall/CRC.
  * (28) Hui, J. Machine Learning - Singular Value Decomposition (SVD) and Principal Component Analysis (PCA). https://jonathan-hui.medium.com/machine-learning-singular-value-decomposition-svd-principal-component-analysis-pca-1d45e885e491 Accessed on 7th July, 2023.
  * (29) Li, L. Principal Component Analysis for Dimensionality Reduction. Towards Data Science. https://towardsdatascience.com/principal-component-analysis-for-dimensionality-reduction-115a3d157bad Accessed on 7th July, 2023.
  * (30) Widom, H. (1966). Hankel Matrices. Trans. Am. Math. Soc., 121(1), 1-35.
  * (31) Baker, K. (2013). Singular Value Decomposition Tutorial. https://datajobs.com/data-science-repo/SVD-Tutorial-[Kirk-Baker].pdf Accessed on 22nd June, 2023.
  * (32) Stewart, G.W. (1993). On the early history of the singular value decomposition. SIAM review, 35(4), 551-566. DOI: https://doi.org/10.1137/1035134
  * (33) Record, N. (2003). Introduction to Lorenz’s system of Equations. https://www.researchgate.net/publication/275891222 Accessed on 13th October, 2023.
  * (34) Strogatz, S.H. (2018). Nonlinear Dynamics and Chaos with Applications to Physics, Biology, Chemistry and Engineering. CRC Press. ISBN: 978-11-383-2945-4.
  * (35) Lorenz, E.N. (1993). The Essence of Chaos. University of Washington Press. ISBN: 0-203-21458-7.
  * (36) Hassard, B.D., Kazarinoff, N.D., & Wan, Y.H. (1981). Theory and applications of Hopf bifurcation (Vol. 41). CUP Archive.
  * (37) Brauer, K. (2000). The Korteweg-de Vries equation: history, exact solutions, and graphical representation. University of Osnabrück/Germany1.
  * (38) Zabusky, N.J. & Kruskal, M.D. (1965). Interaction of “solitons” in a collisionless plasma and the recurrence of initial states. Phys. Rev. Lett., 15(6):240.
  * (39) Drazin, P.G. & Johnson, R.S. (1989). Solitons: An Introduction. Cambridge Univ. Press, Cambridge.
  * (40) Ablowitz, M.J. (2011). Nonlinear Dispersive Waves: Asymptotic Analysis and Solitons. Cambridge University Press.
  * (41) Shen, J., Tang, T. & Wang, L.L. (2011). Spectral methods: Algorithms, Analysis and Applications (Vol. 41). Springer Science & Business Media. ISBN: 978-3-540-71040-0.
  * (42) Trefethen, L.N. (2000). Spectral Methods in MATLAB. Society for Industrial and Applied Mathematics.
  * (43) Dafermos, C.M. & Pokorny, M. (Eds.). (2008). Handbook of Differential Equations: Evolutionary Equations. Elsevier. ISBN: 978-0-44-4530349.
  * (44) Saidi, A. (1994). Decimation-in-time-frequency FFT algorithm. In Proceedings of ICASSP’94. IEEE International Conference on Acoustics, Speech and Signal Processing (Vol. 3, pp. III-453). IEEE.


11institutetext: Cyber Science Lab, Canada Cyber Foundry, University of
Guelph, Canada
11email<EMAIL_ADDRESS><EMAIL_ADDRESS><EMAIL_ADDRESS>22institutetext: Dept. of Engineering, University of Guelph, Canada
22email<EMAIL_ADDRESS>33institutetext: Dept. of Math and Computer
Science, Brandon University, Manitoba, Canada
33email<EMAIL_ADDRESS>44institutetext: Research Centre for
Interneural Computing, China Medical University, Taichung, Taiwan
44email<EMAIL_ADDRESS>
# P3GNN: A Privacy-Preserving Provenance Graph-Based Model for APT Detection
in Software Defined Networking

Hedyeh Nazari 11 Abbas Yazdinejad 11 Ali Dehghantanha 11 Fattane Zarrinkalam
22 Gautam Srivastava 3344

###### Abstract

Software Defined Networking (SDN) has brought significant advancements in
network management and programmability. However, this evolution has also
heightened vulnerability to Advanced Persistent Threats (APTs), sophisticated
and stealthy cyberattacks that traditional detection methods often fail to
counter, especially in the face of zero-day exploits. A prevalent issue is the
inadequacy of existing strategies to detect novel threats while addressing
data privacy concerns in collaborative learning scenarios. This paper presents
P3GNN (privacy-preserving provenance graph-based graph neural network (GNN)
model), a novel model that synergizes Federated Learning (FL) with Graph
Convolutional Networks (GCN) for effective APT detection in SDN environments.
P3GNN utilizes unsupervised learning to analyze operational patterns within
provenance graphs, identifying deviations indicative of security breaches. Its
core feature is the integration of FL with homomorphic encryption, which
fortifies data confidentiality and gradient integrity during collaborative
learning. This approach addresses the critical challenge of data privacy in
shared learning contexts. Key innovations of P3GNN include its ability to
detect anomalies at the node level within provenance graphs, offering a
detailed view of attack trajectories and enhancing security analysis.
Furthermore, the model’s unsupervised learning capability enables it to
identify zero-day attacks by learning standard operational patterns. Empirical
evaluation using the DARPA TCE3 dataset demonstrates P3GNN’s exceptional
performance, achieving an accuracy of 0.93 and a low false positive rate of
0.06.

###### Keywords:

Advanced Persistent Threat, SDN, Graph Neural Network, Federated Learning.

##  1 Introduction

SDN represents a novel approach in network architecture that aims to address
prevailing challenges by separating the control plane from the data plane and
using protocols such as OpenFlow [12, 34] for communication between these
planes [35]. This approach turns network switches into simple packet handlers,
with decision-making centralized in a software controller. The controller
offers a comprehensive overview of the network and programming abstractions,
enabling a centralized management system. This system grants operators
programmatic and real-time control over networks and devices, simplifying
network management and introducing flexibility that was previously lacking
[13, 4]. However, the adoption of SDN introduces new security concerns, such
as APT [26, 36]. APTs pose an immense and formidable threat to cyberspace
security. Characterized by their stealth and slow infiltration, APTs are
typically launched by well-resourced groups, like state actors, and employ
advanced tactics, techniques, and procedures (TTPs) for long-term network
presence, targeting espionage or sabotage [2]. As APTs become more
sophisticated, cybersecurity solutions must become more dynamic and adaptable.

Diverse strategies utilizing log files to counter APTs have evolved due to the
limitations of traditional signature-based detection systems, particularly
against zero-day exploits and advanced polymorphic malware [17]. Among these,
Host-based Intrusion Detection Systems (HIDS) stand out for their efficacy.
Further, integrating HIDS into SDN networks appears promising for enhanced
security [37]. Building on HIDS, the Provenance-based Intrusion Detection
System (PIDS), especially its provenance graph method, utilizes provenance
data’s contextual information to pinpoint APT attacks [31]. In single-host
environments, a system provenance graph, structured as a directed acyclic
graph (DAG), categorizes log file elements like processes, files, and sockets
as vertices and their interactions as edges. This method effectively maps
system processes, illustrating control and data flow between entities[16, 22].
Previous research on log provenance graphs for APT detection faces
limitations, particularly with misuse-based methods’ inability to detect zero-
day attacks. These methods, which compare provenance graphs to known attack
graphs, struggle to identify new threats not captured in existing cyber threat
reports [20]. In response, unsupervised anomaly-based methods offer a
promising alternative by focusing on deviations from normal behavior within
provenance graphs, essential for detecting new and emerging threats, including
zero-day attacks [24].

Previous research on detecting APTs using provenance graphs highlights
significant challenges due to the complexity of these dense networks that
represent system interactions. GNNs, in contrast to standard Deep Neural
Networks (DNNs), are better suited for these tasks due to their ability to
interpret graph-structured data, enabling them to not only detect but also
visualize malicious activities within network contexts [19, 15]. However, the
effectiveness of GNNs is often limited by the availability of extensive log
datasets necessary for training. Despite the potential of centralized training
to mitigate data scarcity by pooling resources from multiple sources,
practical implementation is hindered by privacy and security concerns,
preventing organizations from sharing sensitive log data [7, 23].

Considering these challenges, in this paper, we introduce P3GNN, an
explainable privacy-preserving model specifically designed for APT detection.
P3GNN innovatively combines the principles of FL with GCN, using unsupervised
learning to examine operational patterns in provenance graphs for identifying
deviations that signal security breaches [9]. A key aspect of P3GNN is its
strong focus on privacy and security. By integrating FL with homomorphic
encryption, specifically the Paillier homomorphic cryptosystem (PHC), it
ensures the confidentiality and integrity of data and gradients during
collaborative learning, offering dual-layer protection for sensitive
information [11]. This integration is vital because, while FL allows for
collaborative model training across different organizations without direct
data sharing, it inherently provides limited privacy protection and doesn’t
fully resolve security issues, especially regarding data shared with third-
party servers [27]. The concern of an untrustworthy server exploiting uploaded
parameters to infer feature values from private training datasets is
effectively addressed by the addition of partially homomorphic encryption in
P3GNN. Additionally, P3GNN’s capability to detect APTs at the node level
within provenance graphs, identify anomalous nodes, and trace the full attack
trajectory, is crucial for security analysts. This functionality offers a
comprehensive view of attack paths and enhances the analysis of APT incidents.
The main contributions of this paper can be summarized as follows:

  * •

We propose a novel interpretable, privacy-preserving provenance graph-based FL
model P3GNN for detecting APTs. Our model leverages GCN to adeptly navigate
the intricate interconnections present in log provenance graphs.

  * •

Our model operates in an unsupervised manner, effectively learning the
standard operational patterns within provenance graphs and thereby identifying
any deviations from the system’s typical behavior. This capability enables our
system to detect anomalies that could signify zero-day attacks, which are
particularly challenging to identify due to their novel and previously
unrecorded nature.

  * •

The integration of FL with homomorphic encryption in P3GNN maintains the
confidentiality of data and gradients in collaborative learning, addressing
data sharing challenges and protecting log owners’ privacy. This allows
training on diverse datasets, including attack samples from multiple sources,
without transferring sensitive log data. Training is conducted locally,
leveraging distributed data while ensuring privacy and security.

  * •

P3GNN can pinpoint anomalous nodes within provenance graphs at the node level.
This feature significantly enhances the model’s capability to trace the entire
trajectory of APT attacks, providing valuable insights for security analysis.
This attribute of P3GNN addresses a common issue in the field of artificial
intelligence regarding interpretability.

The following is the specification of the threat model we consider in this
paper.

  * •

High Volume of Log Data with Subtle Anomalies: The main challenge in detecting
APTs within SDNs lies in the sheer volume of log data, where malicious
activity can easily masquerade as normal system behavior. This makes it
challenging to identify threats without examining the interconnections among
various system events. Furthermore, the subtlety of such activities
necessitates deep analysis. Advanced ML techniques are crucial for effectively
identifying these hidden threats.

  * •

Privacy Risk in Data Sharing for GNN Training: In a decentralized
infrastructure for GNN training, sharing sensitive log data with external
entities poses a significant privacy risk, potentially exposing critical
operational details.

  * •

Confidentiality of Gradients in FL setup: The confidentiality of gradients is
a concern, as an honest but curious server could potentially access sensitive
user information through shared gradients and model parameters. An adversary
can gain access to the private logs of an organization through gradient
inversion attacks [14].

By achieving our contributions, we address the following design goals in this
research:

  * •

Enhanced Anomaly Detection in Large Log Data: To tackle the challenge of
detecting APTs within vast log datasets, our solution employs an anomaly-based
detection system using provenance graphs. These graphs help interpret the
relationships and context within system logs, identifying deviations from
normal behavior. We use GNNs to effectively handle and analyze these
complexities, allowing for detailed tracking of anomalies at the node level
and enabling quick investigations.

  * •

Privacy-Preserving Data Handling for GNN Training: In response to the privacy
risks associated with data sharing in a decentralized GNN training
infrastructure, our model leverages FL. This approach allows the training data
to remain within the confines of the organization’s secure environment,
thereby negating the need to transfer sensitive information externally. This
method ensures that privacy is maintained during the GNN training process.

  * •

Secure Gradient Sharing: To mitigate the risk of gradient inversion attacks
and protect user data, the model incorporates PHC for encrypting local
gradients before transmission to the server. This encryption step is crucial
in maintaining the confidentiality of sensitive information throughout the
gradient-sharing phase, ensuring robust protection against potential
adversarial access.

The rest of this paper is organized as follows. Section 2 reviews the related
literature. Section 3 introduces the structure of the P3GNN model. Section 4
evaluates the proposed model, compares the results to related works, and
provides interpretability and complexity analysis for the model. Lastly, we
conclude the paper in section 5.

##  2 Related Work

APT detection has been the subject of numerous studies. In provenance-based
methods, Milajerdi et al. [21] developed Holmes, a real-time APT detection
system that utilizes provenance graphs for correlating suspicious information
flows. It employs expert knowledge of TTPs to match defined exploits within
these graphs. This integration allows Holmes to effectively summarize
attackers’ actions through robust detection signals and high-level graphs,
offering precise detection and low false alarm rates in real-world APT
scenarios. Also, in [33], Xie et al. proposed a model named Pangoda, designed
for large data environments. It analyzes provenance graphs to detect
anomalies, balancing the focus between individual paths and the overall graph
structure. This enables quick identification of intrusions and improves
detection accuracy. In [30], the authors introduce ProvDetector, a malware
detection tool that utilizes provenance graphs. ProvDetector operates by
embedding paths within a provenance graph and applying the Local Outlier
Factor method to identify malware effectively. Poirot, as proposed in [20], is
another provenance-based system designed for threat hunting. It focuses on
correlating indicators identified by other systems and constructs attack
graphs using expert knowledge from existing cyber threat reports. The system
matches the provenance graphs with these attack graphs to detect threats, but
it faces challenges in identifying unknown threats not already included in the
TTPs and cyber threat reports. DeepTaskAPT introduced in [18] is an LSTM-based
deep learning model for detecting APTs by analyzing event sequences in the
provenance graph. This model identifies unusual activities by being trained
solely on benign sequences, which are created using a tree-based method for
task generation. In [8], a system named UNICORN is presented for detecting APT
anomalies using sketch-based, time-weighted provenance encoding and graph
analysis. It focuses on supply-chain attacks, with multi-hop exploration and
evolutionary modeling enhancing accuracy and efficiency.

In the context of APT detection in SDNs, the authors in [25] introduce a
Hidden Markov Model-based APT detection method that effectively detects and
analyzes multi-stage APTs in SDN, offering accurate threat identification with
minimal overhead. In [26], they propose a method that employs an attack tree-
based model for SDN, enabling the detection of APTs by correlating multiple
attack behaviors to establish an attack path. However, these methods fail to
take into account the privacy of log owners. Huynh Thai Thi et al. present an
FL approach for enhancing cyber threat detection in SDN. This method leverages
collaborative intelligence across multiple parties while preserving data
privacy. The technique focuses on proactive APT attack detection, utilizing FL
to improve the performance of detection systems against unknown threats. For
the IDS model, the authors employed three local models, including Gated
Recurrent Unit (GRU), Long Short-Term Memory (LSTM), and Convolutional Neural
Network (CNN) [28]. In [29], the XFedHunter model uses the FedAvg algorithm
for decentralized APT detection in SDNs, enhancing privacy. It integrates CNN,
GRU, and E-GraphSAGE for intrusion detection and employs the SHAP framework
for model explainability. While this approach focuses on privacy by design, it
does not explicitly protect model parameters like gradients and weights during
training.

##  3 Proposed Model

In this section, we present an in-depth view of our model, P3GNN, specifically
designed for detecting APTs in SDNs. The P3GNN model integrates three key
technological paradigms: the APT detection procedure, the SDN infrastructure,
and, the collaborative and privacy-preserving aspects of FL. Each of these
components plays a pivotal role in creating a robust, efficient, and privacy-
preserving APT detection system. Figure 1 shows the architecture of the
different components in P3GNN. The following subsections will explain each
component’s contributions as well as how they work together to enhance our
model’s effectiveness and security.

Figure 1: The architecture of P3GNN

###  3.1 SDN Infrastructure

In the design of our system, we view the SDN network as a potential zone for
detecting malicious activities, which are likely to appear within the
network’s flow data. SDN encompasses three planes: the Control Plane,
responsible for traffic direction decisions, often on a network operating
system; the Data Plane, comprising physical or virtual routers and switches
that forward packets per control plane instructions; and the management plane,
overseeing network administration, monitoring, and policy enforcement. SDN
utilizes northbound APIs for communication between the control plane and
higher-level applications, enabling network programming, and southbound APIs
(like OpenFlow) for connecting the control plane to data plane devices for
management. To effectively monitor and scrutinize this data for any signs of
such activities, it’s essential to first set up the SDN network switches. A
fundamental component of this process involves the data plane functionality of
SDN switching devices, which are pivotal in packet forwarding. The data plane
in an SDN switch operates distinctly compared to traditional networking
devices. While legacy networks primarily rely on forwarding packets based on
IP or MAC addresses, SDN switches introduce a more versatile approach [32].
These switches are tasked with forwarding network flow data for APT detection
analysis via the OpenFlow protocol.

###  3.2 APT Detection Procedure in P3GNN

The APT detection procedure of the P3GNN model as shown in Figure 2 is
structured into four phases: data extraction, contextual data representation,
GNN training, and finally abnormal node identification and analysis. The
subsequent sections will provide an in-depth exploration of each phase,
detailing their functionalities and contributions to the model’s capability in
APT detection.

Figure 2: APT detection procedure

####  3.2.1 Data extraction:

In the initial phase of our model, we focus on the extraction and initial
preprocessing of log data. The primary source of our data comprises system
logs, encompassing a wide range of information such as timestamps, process
names, and execution paths. Utilizing regular expression techniques, we parse
these logs to transform the raw data into a structured format. We define
$\Sigma$ as the set of all unique symbols present in the log data. Using
regular expressions, we create definitions for specific patterns found in log
entries. For example, to identify a UUID, we use a regular expression denoted
as $R_{\text{uuid}}$. This expression is defined as
$\text{"uuid\"{:}\"{"}}\cdot(\Sigma^{*})\cdot\text{"\"{"}}$, where
$\Sigma^{*}$ represents any sequence of characters from our defined symbol
set.

The process of transforming log entries into structured data is encapsulated
by the parsing function ParseLog. Let $L$ represent the collection of all log
entries. Each entry $l$ in $L$ is a tuple containing elements like timestamp,
process name, and execution path. The function ParseLog applies the defined
regular expressions to each log entry $l$ from $L$, converting it into a
structured data format represented by $d$ in the set $D$. This transformation
can be formally expressed as:

$\text{ParseLog}(l):L\rightarrow D$ (1)

This methodical approach allows us to efficiently convert unstructured log
data into a format that is more suitable for analysis and further processing.

####  3.2.2 Contextual data representation:

Our approach to detecting anomalous network nodes thrives in environments
without predefined attack patterns, moving away from traditional supervised
learning that relies on clear labels, which are often unavailable due to the
lack of specific attack knowledge during training. We utilize a GCN designed
to differentiate and comprehend the subtle behaviors of benign nodes. The core
idea is that nodes involved in malicious activities exhibit distinct
behavioral anomalies compared to benign ones, allowing our model to learn and
identify unique patterns of relationships among node types. The feature
extraction process involves an approach wherein each node’s interactions and
connections are translated into feature vectors. Thus, the contextual data
representation phase is as follows. Our primary objective is to construct a
provenance graph and extract features from the preprocessed logs. The
provenance graph, denoted as $G=(V,E)$, is built based on the relationships
identified in the logs. Here, $V$ represents the set of vertices (entities
such as files, processes, sockets), and $E$ represents the set of edges
(interactions like read, write, fork).

We define $N_{v}$ as the total number of unique node types and $N_{e}$ as the
total number of unique edge types present in $G$. To facilitate the mapping of
node and edge types to unique integers, we introduce two mapping functions:
$M_{v}:\text{Types}\rightarrow\\{0,\ldots,N_{v}-1\\}$ for nodes, and
$M_{e}:\text{Types}\rightarrow\\{0,\ldots,N_{e}-1\\}$ for edges.

Each node $v\in V$ is assigned a type label using $M_{v}$, and its feature
vector is determined by a function $F:V\rightarrow\mathbb{N}^{2N_{e}}$. The
feature vector $F(v)$ for a node $v$ comprises the count of incoming and
outgoing edges of each type. Specifically, for $i\in\\{0,\ldots,N_{e}-1\\}$,
the feature vector includes:

$a_{i}=|\\{e\in E_{\text{in}}(v):M_{e}(\text{type}(e))=i\\}|$ (2)
$a_{i+N_{e}}=|\\{e\in E_{\text{out}}(v):M_{e}(\text{type}(e))=i\\}|$ (3)

where $a_{i}$ represents the count of incoming edges of type $i$, and
$a_{i+N_{e}}$ denotes the count of outgoing edges of the same type. The final
feature vector $F(v)$ is represented in Equation 4:

$F(v)=[a_{0},a_{1},\ldots,a_{N_{e}-1},a_{N_{e}},a_{N_{e}+1},\ldots,a_{2N_{e}-1}]$
(4)

####  3.2.3 GNN training:

Our GCN model is engineered to predict complex node relationships within a
graph, using node types and provenance graph structures as inputs. Its primary
goal is to accurately predict feature vectors for each node by leveraging
their connections and positions within the graph. The architecture features
three graph convolutional layers, which aggregate and transform node features
according to their connectivity. Each convolution operation is defined as:

$H^{(l+1)}=\sigma(\tilde{D}^{-\frac{1}{2}}\tilde{A}\tilde{D}^{-\frac{1}{2}}H^{(l)}W^{(l)})$
(5)

In this equation, $H^{(l)}$ represents the node feature matrix at layer $l$,
$\tilde{A}$ is the adjacency matrix of the graph, $\tilde{D}$ is the degree
matrix of $\tilde{A}$, $W^{(l)}$ is the weight matrix for layer $l$, and
$\sigma$ denotes the activation function, ReLU (Rectified Linear Unit). This
convolutional operation effectively captures the local graph topology and
feature information. Following the first two convolutional layers, batch
normalization and ReLU activation functions are applied, with dropout used for
regularization purposes. The model’s predicted feature vector can be
represented in Equation 6:

$\hat{F}(v)=H^{(final)}W^{(final)}$ (6)

Then, the Mean Squared Error (MSE) is used to assess the difference between
the model’s prediction and the actual feature vector $F(v)$ for each node in
the graph. Formally, the MSE loss is defined in Equation 7:

$\text{MSE}=\frac{1}{n}\sum_{v\in V}|F(v)-\hat{F}(v)|^{2}$ (7)

Here, $n$ represents the total number of nodes in the graph G, $F(v)$ denotes
the actual feature vector of node v, and $\hat{F}(v)$ is the feature vector
predicted by the model for node $v$.

####  3.2.4 Abnormal node identification:

In the final phase of our model, we focus on identifying abnormal nodes by
analyzing deviations from expected behavior. The model determines whether a
node is anomalous by calculating the error value based on the absolute
difference between the predicted feature vector ${F}_{p}(v)$ and the actual
feature vector $F(v)$. The error score for node $v$ is computed as follows:

$\text{error}(v)=|\hat{{F}}(v)-F(v)|$ (8)

By setting an appropriate threshold, we distinguish between normal node
behavior and significant deviations indicative of anomalies. This threshold is
determined using a data-driven approach, where we analyze the distribution of
error values in the validation set to select a value that optimally balances
accuracy with the minimization of false positives and negatives in anomaly
detection.

###  3.3 Secure Model Training through FL and PHC

Our model employs a dual-key mechanism, entailing a public key for encryption
and a private key for decryption, specifically used by the PHC. A specialized
entity, referred to as the Key Generation Authority (KGA), undertakes the task
of generating these keys. During the setup phase, this KGA chooses two
distinct large prime numbers, $p$ and $q$, ensuring $p\neq q$ and the greatest
common divisor (gcd) of $pq$ and $(p-1)(q-1)$ is 1. Subsequently, the KGA
defines $N=pq$ and computes Carmichael’s function as
$\lambda(N)=\text{lcm}(p-1,q-1)$. A random integer $g$ is then chosen from
$\mathbb{Z}_{N^{2}}^{*}$ such that $\text{gcd}(L(g^{\lambda}\mod n^{2}),N)=1$.
Here, the function $L(x)$ is formulated as $L(x)=\frac{x-1}{N}$. The
encryption public key is thus represented as $(N,g)$, and the decryption
private key is $(\lambda,\mu)$, where $\mu$ is a distinct integer satisfying
$\mu=L(g^{\lambda}\bmod N^{2})^{-1}\mod N$. These keys are disseminated among
organizations while being kept hidden from the server.

As each federated communication cycle commences, organizations retrieve the
global aggregated updates from the preceding round from the server, and update
their local model parameters according to the Equation 9:

$W_{t+1}^{old}=W_{t}^{old}+U_{t}^{global}$ (9)

In this equation, $W_{t+1}^{old}$ symbolizes the model updated for the round
$t+1$, with $W_{t}^{old}$ and $U_{t}^{global}$ representing the previous
round’s final organization model and aggregated updates, respectively. The
organizations engage in local training on their datasets, developing the GNN
model and calculating the new parameter vector $W_{new}^{t+1}$. The updated
vector for the local model, $U_{t+1}$, intended for subsequent server
transmission, is derived as
$U_{t+1}=W_{t+1}^{\text{new}}-W_{t+1}^{\text{old}}$.

Following the reception of keys from the KGA, each organization, indicated as
organization $k$, executes the PHC algorithm. This involves generating a
random number $r^{k}_{t+1}$ in $Z^{*}_{n^{2}}$ where $0<r_{t+1}^{k}<n$,
converting the update vector of each organization into ciphertext, expressed
as $C_{t+1}^{k}=g^{U_{t+1}^{k}}\cdot r^{k}_{t+1}\mod n^{2}$.

Post-encryption, the organization sends the ciphertext $C_{t+1}^{k}$ to the
server for aggregation and generation of global model updates. Utilizing the
PHC, the product of two ciphertexts results in a decryption equivalent to the
sum of their original messages. The server, upon collecting all organization
ciphertexts, applies the Federated Averaging (FedAvg) algorithm and PHC for
aggregating updates. In the final phase, the server distributes the aggregated
global updates back to the organizations. Each organization then employs the
private keys to execute the decryption algorithm, obtaining the final results
and updating the global model for the training round $t+2$, as shown:

$U_{(t+1)}^{\text{global}}=L\left(\left(C_{(t+1)}^{\text{global}}\right)^{\lambda}\mod
n^{2}\right)\mu\mod n$ (10)

$W_{t+2}^{old}=W_{t+1}^{old}+U_{t+1}^{{global}}$ (11)

Here, $W_{t+2}^{old}$ is the updated global model at the commencement of round
$t+2$. This iterative process continues until the global model achieves
convergence.

##  4 Performance Evaluation

###  4.1 Experimental Setup

We used PyTorch 2.0.1 and CUDA 11.8 with an Intel i7-13700F CPU and NVIDIA
GeForce RTX 4070 GPU. Our dataset’s training set (60%) contains only normal
data, while the validation and test sets (20% each) include both normal and
anomalous data, facilitating effective model evaluation and threshold tuning.
The model, configured with a 0.5 learning rate and an Adam optimizer,
underwent training across three rounds, each involving 100 epochs per
organization. We tested scalability by varying the number of participating
organizations from 2 to 10, observing stable performance with minimal
fluctuations. Data encryption was managed using the python-paillier library
with a 1024-bit key [5]. The architecture of our GNN model is detailed in
Table 1.

Table 1: Parameters of the GNN Model Layer | Input Dimension | Output Dimension
---|---|---
GCNConv1 | 9 | 256
BatchNorm1 | - | 256
GCNConv2 | 256 | 128
BatchNorm2 | - | 128
GCNConv3 (Output Layer) | 128 | 23

###  4.2 Dataset

The dataset for this study came from the DARPA TCE3 program, during red-team
versus blue-team adversarial engagements in April 2018. These engagements,
designed to simulate diverse cyberattack scenarios, involved the red team
conducting attacks and the blue team defending. The setup included multiple
servers such as web, SSH, email, and SMB, replicating a real-world network.
The scenario realism was further enhanced by simulating extensive normal user
activities, including routine system administration, web browsing, and the
installation of various tools. The threat descriptions and ground truth
reports from DARPA provided key insights into the red team’s tactics and
strategies [10]. Despite the dataset’s large volume of events, malicious
events represent only a small fraction, making anomaly and threat detection
challenging due to the significant imbalance between benign and malicious
activities [3].

###  4.3 Evaluation Metrics

To evaluate our model, we use several metrics based on the definitions of true
positives (TP), true negatives (TN), false positives (FP), and false negatives
(FN). Accuracy is the proportion of correct predictions
($\text{Accuracy}=\frac{\text{TP}+\text{TN}}{\text{TP}+\text{TN}+\text{FP}+\text{FN}}$),
Precision is the ratio of correct attack identifications to all labeled
attacks ($\text{Precision}=\frac{\text{TP}}{\text{TP}+\text{FP}}$), and Recall
is the proportion of actual attacks correctly identified
($\text{Recall}=\frac{\text{TP}}{\text{TP}+\text{FN}}$). The F1-score provides
a balance between precision and recall
($\text{F1-score}=2\cdot\frac{\text{Recall}\cdot\text{Precision}}{\text{Recall}+\text{Precision}}$),
and False Positive Rate measures the rate of benign instances incorrectly
marked as attacks ($\text{FPR}=\frac{\text{FP}}{\text{FP}+\text{TN}}$).

###  4.4 Detection Evaluation

The results of our proposed model and the performance comparison with other
anomaly detection models are presented in Table 2. Our approach stands out in
its unsupervised learning methodology, which enables the detection of APT
attacks without prior exposure to malicious data. The model exhibits a high
accuracy of 0.93 and maintains a low false positive rate of 0.06. This
performance is particularly noteworthy as it is achieved in the absence of
supervised learning techniques commonly employed in existing models. Due to
the lack of existing research on unsupervised learning methods applied to this
dataset, this study undertakes a comparative analysis with supervised learning
techniques. Our model’s performance was benchmarked against several state-of-
the-art models, including DeepTaskAPT [18], Deeplog [6], LogShield, and BERT
[1], and conventional baseline models (such as Random Forest and Linear
Regression) [18]. While some of these methods may demonstrate superior
performance metrics in certain aspects, they are predominantly reliant on
supervised learning models. This reliance is a significant limitation,
especially in addressing zero-day challenges where the model has no prior
knowledge of attack patterns. Moreover, these existing models overlook the
critical aspect of privacy in log data. In contrast, our model integrates FL
and homomorphic encryption, addressing privacy concerns more effectively.

Table 2: Comparison of Model Performance Model | Method | Acc | Prec | Rec | F1-score | FPR
---|---|---|---|---|---|---
P3GNN | Unsupervised | 0.93 | 0.73 | 0.91 | 0.81 | 0.06
DeepTaskAPT | Supervised | 0.985 | N/A | N/A | N/A | 0.011
DeepLog | Supervised | 0.83 | N/A | N/A | N/A | 0.16
Random Forest | Supervised | 0.80 | N/A | N/A | N/A | 0.18
Linear Regression | Supervised | 0.08 | N/A | N/A | N/A | 0.93
LogShield | Supervised | 0.98 | 0.99 | 0.99 | 0.984 | N/A
BERT | Supervised | 0.89 | 0.91 | 0.95 | 0.90 | N/A

###  4.5 Computational Complexity Analysis of P3GNN

The complexity of the P3GNN model arises from data extraction, graph
construction, GNN training, and anomaly detection. Incorporating FL and PHC
adds to this complexity by introducing encryption and decryption overheads,
crucial for ensuring data privacy in distributed networks. The base complexity
of the P3GNN model, without FL and PHC, depends on the log data volume, the
graph’s size and structure (vertices $V$ and edges $E$), and the depth of
computational requirements for GNN training. These factors contribute to a
largely linear complexity, scaling with the size of the data and the graph.
However, the model’s efficiency in this configuration benefits from direct,
unencrypted operations on data and parameters. In contrast, when FL and PHC
are integrated into the model, each operation involving model
parameters—especially during the GNN training phase—incurs additional
complexity due to encryption and decryption. This complexity is polynomial,
specifically $O(n_{\text{params}}\cdot k^{3})$, where $n_{\text{params}}$ is
the number of model parameters, and $k$ represents the encryption key size.
This added complexity is a direct consequence of the cryptographic processes
required to secure the model’s distributed learning environment.

Table 3: Comparison of Computational Complexity Component | Without FL and PHC | With FL and PHC
---|---|---
Data Extraction | $O(n_{\text{logs}}\cdot c)$ | $O(n_{\text{logs}}\cdot c)$
Contextual Data Rep. | $O(n_{\text{vertices}}+n_{\text{edges}})$ | $O(n_{\text{vertices}}+n_{\text{edges}})+O(n_{\text{params}}\cdot k^{3})$
GNN Training |  $O(|V|+|E|)$ per layer |  $O(|V|+|E|)$ per layer + $O(n_{\text{params}}\cdot k^{3})$
Abnormal Node Ident. | $O(n_{\text{vertices}})$ | $O(n_{\text{vertices}})+O(n_{\text{params}}\cdot k^{3})$

Table 3 summarizes the computational complexity of P3GNN with and without
privacy preservation techniques. The added computational complexity from
integrating FL and PHC into the P3GNN model is a necessary trade-off for
ensuring robust privacy and security in distributed ML environments. This
complexity enables collaborative training across multiple entities without
exposing sensitive data, aligning with stringent data protection regulations
and safeguarding against unauthorized access, making it indispensable for
securely handling sensitive or confidential information.

###  4.6 Interpretability of P3GNN

This section delves into the interpretability of our model, particularly
focusing on its capability to detect attacks at the node level and trace the
entirety of an anomalous neighborhood involved in an attack. By leveraging
GNNs, P3GNN goes beyond mere identification, enabling the dissection of attack
patterns through node-level analysis.

####  4.6.1 Visualization and Node-Level Analysis:

P3GNN stands out for its ability to precisely identify anomalous nodes within
a network. Figure 3a emphasizes the paths and sequences formed by anomalous
nodes. The flow of malicious activities (red) amidst the benign (blue) nodes
reveals the model’s detection of attack trajectories, which can be critical
for understanding the sequential progression and strategies of the attackers.
This visualization through the capabilities of GNNs enhances interpretability,
and is particularly useful for path analysis, as it enables security analysts
to track potential attack trajectories and comprehend how malicious activities
may propagate. It is an essential tool for formulating effective defensive
strategies.

Additionally, P3GNN highlights clusters of malicious nodes that can indicate
the initial breach points or critical attack vectors. Figure 3b illustrates a
subgraph extracted from the overall network, highlighting the prominent
clusters of malicious and benign nodes. In our network visualizations,
clusters of nodes emerge organically due to the inherent structure and
connectivity patterns within the network data. These clusters, emerging as a
result of the interconnected nature of network activities, are marked by dense
interconnectivity, which is a hallmark of coordinated or related malicious
activities. Such clusters demand urgent investigative action. In this way,
security analysts are empowered to conduct focused investigations and
implement targeted security measures.

(a) Pathways and sequences of activities

(b) Clustering of anomalous nodes

Figure 3: Detailed view of anomalous node interconnectivity

####  4.6.2 Case Study: Nginx Backdoor w/ Drakon In-Memory:

To further illustrate the model’s interpretability, we analyze a specific
attack incident that occurred within the DARPA network infrastructure. In this
incident, the attacker targeted the system (Cadet’s data), initially
exploiting a vulnerability in the Nginx server using a malformed HTTP request.
This led to the execution of a Drakon implant in the Nginx server’s memory,
establishing a shell connection to the attacker’s console through HTTP. The
attacker’s subsequent actions involved multiple attempts to download and
elevate privileges for a micro APT implant. Despite repeated failures in
privilege elevation, the attacker managed to execute the Drakon implant with
root privileges and later conducted a port scan on multiple network targets to
assess vulnerabilities, leaving the console connection open throughout. This
attack sequence highlights several critical steps:

  * •

Initial exploitation of Nginx and Drakon implant execution.

  * •

Repeated attempts to download and elevate the micro APT implant.

  * •

Successful execution of the Drakon implant with elevated privileges.

  * •

Network reconnaissance through port scanning.

The interpretability of our model is rooted in its ability to not just
identify the occurrence of an attack but to unravel the sequence of events
constituting it. When an anomalous activity is identified, the model raises
alarms for these specific nodes, signaling potential security breaches. To
comprehensively map out the attack’s progression, we employ a depth-first
search algorithm on the neighborhood of the identified anomalous nodes. In the
DARPA attack case, the model successfully pinpointed each critical step,
providing a comprehensive view of the attack’s progression. Figure 4 presents
a graphical representation of the attack steps as identified by our model.

Figure 4: Visualization of attack sequence

Our model’s detection ability is further demonstrated by correlating discrete
log entries with corresponding graph interactions. By examining the flow of
UUIDs within the network and mapping them to recorded events, as shown in
table 4, our system constructs a narrative that aligns with known attack
patterns. For instance, during the initial compromise phase, our model
detected the event ‘EVENT_READ‘ and ‘EVENT_EXECUTE‘ in conjunction with
specific UUID interactions, implying unauthorized access and potential
credential compromise. As the attack transitioned to establish a foothold,
modifications in process and principal changes were captured, highlighting the
attacker’s efforts to gain a stronger grip within the system.

Subsequently, an escalation of privileges was inferred from principal changes
logged, suggesting that the attacker was attempting to gain higher-level
access. This was further corroborated by the event ‘EVENT_CHANGE_PRINCIPAL‘
linked to UUIDs accessing sensitive system files. Our model’s depth-first
search illuminated these steps in the context of the larger attack framework,
showcasing the depth of our analysis. In the final phases, internal
reconnaissance and efforts to maintain presence were identified through
repeated ‘EVENT_READ‘ and ‘EVENT_EXECUTE‘ actions. These steps were pivotal in
the attacker’s strategy to gather intelligence and ensure long-term access to
the compromised system. By integrating log analysis with graph theory, our
model transcends traditional detection mechanisms, offering a nuanced and
dynamic approach to cybersecurity. This case study serves as a testament to
the model’s efficacy in recognizing complex attack patterns and the associated
network behaviors.

Table 4: Correlation of Attack Phases and Log Entries with Graph Interactions Attack Phase |  Log Entry Details |  Graph Interaction (UUIDs)
---|---|---
Initial Compromise |  EVENT_READ, EVENT_EXECUTE on /etc/login.conf, /etc/group |  CA352F0F-3E59-11E8-A5CB-3FA3753A265A → 9A717117-65ED-675C-AD65-38102C67C832, CA357EAC-3E59-11E8-A5CB-3FA3753A265A → 308E149F-F225-9859-A5F2-8C9BB9983D48
Establish Foothold |  EVENT_MODIFY_PROCESS, EVENT_CHANGE_PRINCIPAL |  CA353E2C-3E59-11E8-A5CB-3FA3753A265A → 24782D99-5286-465D-8652-63817D46C1BD, CA353E2C-3E59-11E8-A5CB-3FA3753A265A → 76A739B1-A13E-FD50-BEA1-B218A0FD0400
Escalate Privileges |  EVENT_CHANGE_PRINCIPAL indicating privilege escalation |  CA353E2C-3E59-11E8-A5CB-3FA3753A265A → 308E149F-F225-9859-A5F2-8C9BB9983D48
Internal Reconnaissance |  EVENT_READ on various system files |  CA357EAC-3E59-11E8-A5CB-3FA3753A265A → 9A717117-65ED-675C-AD65-38102C67C832
Maintain Presence |  Repeated EVENT_READ, EVENT_EXECUTE |  CA352F0F-3E59-11E8-A5CB-3FA3753A265A → Various UUIDs

##  5 Conclusion

In conclusion, this paper introduced the P3GNN, a provenance graph-based model
for APT detection in SDNs that integrates GCN with FL and homomorphic
encryption for privacy preservation. The model effectively detects APTs
without prior attack knowledge, maintaining data privacy and integrity. Our
tests using the DARPA TC dataset show robust performance, achieving an
accuracy of 0.93 and a false positive rate of 0.06. This indicates a
significant improvement over traditional supervised learning methods, which
often struggle with zero-day attacks and privacy concerns. Furthermore, the
model’s capability to pinpoint anomalous nodes and trace the entire attack
trajectory offers invaluable insights for security analysis, addressing a
critical need in AI for interpretability. In future work, we plan to broaden
our study by exploring our approach’s applicability across different domains
and scenarios, with a focus on empirical validation in these contexts. A key
extension will involve adapting our method to defend against APT attacks
across multiple hosts by shifting from host-level to network-level monitoring,
enabling the detection of lateral movements in APT scenarios. Additionally, we
plan to incorporate real-time data processing into the P3GNN model, enhancing
its effectiveness in dynamic network environments and enabling a faster
response to emerging threats. Additionally, we plan to automate the generation
of Cyber Threat Intelligence reports using our P3GNN model to streamline the
documentation of attack details and mitigation strategies. This automation
will utilize provenance data to improve the efficiency and consistency of
threat reporting and analysis in cybersecurity.

## References

  * [1] Afnan, S., Sadia, M., Iqbal, S., Iqbal, A.: Logshield: A transformer-based apt detection system leveraging self-attention (2023)
  * [2] Alshamrani, A., Myneni, S., Chowdhary, A., Huang, D.: A survey on advanced persistent threats: Techniques, solutions, challenges, and research opportunities. IEEE Communications Surveys & Tutorials 21(2), 1851–1877 (2019). https://doi.org/10.1109/COMST.2019.2891891
  * [3] Anjum, M.M., Iqbal, S., Hamelin, B.: Analyzing the usefulness of the darpa optc dataset in cyber threat detection research. In: Proceedings of the 26th ACM Symposium on Access Control Models and Technologies. p. 27–32. SACMAT ’21, Association for Computing Machinery, New York, NY, USA (2021). https://doi.org/10.1145/3450569.3463573, https://doi.org/10.1145/3450569.3463573
  * [4] Dabbagh, M., Hamdaoui, B., Guizani, M., Rayes, A.: Software-defined networking security: pros and cons. IEEE Communications Magazine 53(6), 73–79 (2015). https://doi.org/10.1109/MCOM.2015.7120048
  * [5] Data61, C.: Python paillier library. https://github.com/data61/python-paillier (2013)
  * [6] Du, M., Li, F., Zheng, G., Srikumar, V.: Deeplog: Anomaly detection and diagnosis from system logs through deep learning. In: Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security. pp. 1285–1298 (2017)
  * [7] Ghiasvand, S., Ciorba, F.M.: Anonymization of system logs for privacy and storage benefits. CoRR abs/1706.04337 (2017), http://arxiv.org/abs/1706.04337
  * [8] Han, X., Pasquier, T., Bates, A., Mickens, J., Seltzer, M.: Unicorn: Runtime provenance-based detector for advanced persistent threats. arXiv preprint arXiv:2001.01525 (2020)
  * [9] Jagarlamudi, G.K., Yazdinejad, A., Parizi, R.M., Pouriyeh, S.: Exploring privacy measurement in federated learning. The Journal of Supercomputing pp. 1–41 (2023)
  * [10] Keromytis, A.D.: Transparent computing engagement 3 data release. README-E3. md (2018)
  * [11] Konečný, J., McMahan, H.B., Yu, F.X., Richtárik, P., Suresh, A.T., Bacon, D.: Federated learning: Strategies for improving communication efficiency (2017)
  * [12] Lara, A., Kolasani, A., Ramamurthy, B.: Network innovation using openflow: A survey. IEEE Communications Surveys & Tutorials 16(1), 493–512 (2014). https://doi.org/10.1109/SURV.2013.081313.00105
  * [13] Latif, Z., Sharif, K., Li, F., Karim, M.M., Biswas, S., Wang, Y.: A comprehensive survey of interface protocols for software defined networks. Journal of Network and Computer Applications 156, 102563 (2020). https://doi.org/https://doi.org/10.1016/j.jnca.2020.102563, https://www.sciencedirect.com/science/article/pii/S1084804520300370
  * [14] Liang, H., Li, Y., Zhang, C., Liu, X., Zhu, L.: Egia: An external gradient inversion attack in federated learning. IEEE Transactions on Information Forensics and Security (2023)
  * [15] Liang, Y., Li, S., Yan, C., Li, M., Jiang, C.: Explaining the black-box model: A survey of local interpretation methods for deep neural networks. Neurocomputing 419, 168–182 (2021). https://doi.org/https://doi.org/10.1016/j.neucom.2020.08.011, https://www.sciencedirect.com/science/article/pii/S0925231220312716
  * [16] Lv, Y., Qin, S., Zhu, Z., Yu, Z., Li, S., Han, W.: A review of provenance graph based apt attack detection:applications and developments. In: 2022 7th IEEE International Conference on Data Science in Cyberspace (DSC). pp. 498–505 (2022). https://doi.org/10.1109/DSC55868.2022.00075
  * [17] Maggi, F., Matteucci, M., Zanero, S.: Detecting intrusions through system call sequence and argument analysis. IEEE Transactions on Dependable and Secure Computing 7(4), 381–395 (2010). https://doi.org/10.1109/TDSC.2008.69
  * [18] Mamun, M., Shi, K.: Deeptaskapt: Insider apt detection using task-tree based deep learning. In: 2021 IEEE 20th International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom). pp. 693–700 (2021). https://doi.org/10.1109/TrustCom53373.2021.00102
  * [19] Manzoor, E., Milajerdi, S.M., Akoglu, L.: Fast memory-efficient anomaly detection in streaming heterogeneous graphs. In: Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining. pp. 1035–1044 (2016)
  * [20] Milajerdi, S.M., Eshete, B., Gjomemo, R., Venkatakrishnan, V.: Poirot: Aligning attack behavior with kernel audit records for cyber threat hunting. In: Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security. p. 1795–1812. CCS ’19, Association for Computing Machinery, New York, NY, USA (2019). https://doi.org/10.1145/3319535.3363217, https://doi.org/10.1145/3319535.3363217
  * [21] Milajerdi, S.M., Gjomemo, R., Eshete, B., Sekar, R., Venkatakrishnan, V.: Holmes: Real-time apt detection through correlation of suspicious information flows. In: 2019 IEEE Symposium on Security and Privacy (SP). pp. 1137–1152 (2019). https://doi.org/10.1109/SP.2019.00026
  * [22] Pasquier, T., Han, X., Goldstein, M., Moyer, T., Eyers, D., Seltzer, M., Bacon, J.: Practical whole-system provenance capture. In: Proceedings of the 2017 Symposium on Cloud Computing. pp. 405–418 (2017)
  * [23] Rabieinejad, E., Yazdinejad, A., Dehghantanha, A., Srivastava, G.: Two-level privacy-preserving framework: Federated learning for attack detection in the consumer internet of things. IEEE Transactions on Consumer Electronics (2024)
  * [24] Sakhnini, J., Karimipour, H., Dehghantanha, A., Yazdinejad, A., Gadekallu, T.R., Victor, N., Islam, A.: A generalizable deep neural network method for detecting attacks in industrial cyber-physical systems. IEEE Systems Journal (2023)
  * [25] Shan-Shan, J., Ya-Bin, X.: The apt detection method in sdn. In: 2017 3rd IEEE International Conference on Computer and Communications (ICCC). pp. 1240–1245. IEEE (2017)
  * [26] Shan-Shan, J., Ya-Bin, X.: The apt detection method based on attack tree for sdn. In: Proceedings of the 2nd International Conference on Cryptography, Security and Privacy. p. 116–121. ICCSP 2018, Association for Computing Machinery, New York, NY, USA (2018). https://doi.org/10.1145/3199478.3199481, https://doi.org/10.1145/3199478.3199481
  * [27] Shokri, R., Shmatikov, V.: Privacy-preserving deep learning. In: Proceedings of the 22nd ACM SIGSAC conference on computer and communications security. pp. 1310–1321 (2015)
  * [28] Thi, H.T., Hoang Son, N.D., Duy, P.T., Pham, V.H.: Federated learning-based cyber threat hunting for apt attack detection in sdn-enabled networks. In: 2022 21st International Symposium on Communications and Information Technologies (ISCIT). pp. 1–6 (2022). https://doi.org/10.1109/ISCIT55906.2022.9931222
  * [29] Thi, H.T., Son, N.D.H., Duy, P.T., Khoa, N.H., Ngo-Khanh, K., Pham, V.H.: Xfedhunter: An explainable federated learning framework for advanced persistent threat detection in sdn (2023)
  * [30] Wang, Q., Hassan, W.U., Li, D., Jee, K., Yu, X., Zou, K., Rhee, J., Chen, Z., Cheng, W., Gunter, C.A., et al.: You are what you do: Hunting stealthy malware via data provenance analysis. In: NDSS (2020)
  * [31] Wu, Y., Xie, Y., Liao, X., Zhou, P., Feng, D., Wu, L., Li, X., Wildani, A., Long, D.: Paradise: real-time, generalized, and distributed provenance-based intrusion detection. IEEE Transactions on Dependable and Secure Computing 20(2), 1624–1640 (2022)
  * [32] Xia, W., Wen, Y., Foh, C.H., Niyato, D., Xie, H.: A survey on software-defined networking. IEEE Communications Surveys & Tutorials 17(1), 27–51 (2014)
  * [33] Xie, Y., Feng, D., Hu, Y., Li, Y., Sample, S., Long, D.: Pagoda: A hybrid approach to enable efficient real-time provenance based intrusion detection in big data environments. IEEE Transactions on Dependable and Secure Computing 17(6), 1283–1296 (2020). https://doi.org/10.1109/TDSC.2018.2867595
  * [34] Yazdinejad, A., Bohlooli, A., Jamshidi, K.: Efficient design and hardware implementation of the openflow v1. 3 switch on the virtex-6 fpga ml605. The Journal of Supercomputing 74, 1299–1320 (2018)
  * [35] Yazdinejad, A., Dehghantanha, A., Karimipour, H., Srivastava, G., Parizi, R.M.: An efficient packet parser architecture for software-defined 5g networks. Physical Communication 53, 101677 (2022)
  * [36] Yazdinejad, A., Parizi, R.M., Dehghantanha, A., Zhang, Q., Choo, K.K.R.: An energy-efficient sdn controller architecture for iot networks with blockchain-based security. IEEE Transactions on Services Computing 13(4), 625–638 (2020)
  * [37] Yazdinejadna, A., Parizi, R.M., Dehghantanha, A., Khan, M.S.: A kangaroo-based intrusion detection system on software-defined networks. Computer Networks 184, 107688 (2021). https://doi.org/https://doi.org/10.1016/j.comnet.2020.107688, https://www.sciencedirect.com/science/article/pii/S1389128620312949