# Use of Graph Neural Networks in Aiding Defensive Cyber Operations

Shaswata Mitra<EMAIL_ADDRESS>Mississippi State UniversityMississippi
StateMSUSA39762 ,  Trisha Chakraborty<EMAIL_ADDRESS>Mississippi State
UniversityMississippi StateMSUSA39762 ,  Subash Neupane<EMAIL_ADDRESS>Mississippi State UniversityMississippi StateMSUSA39762 ,  Aritran Piplai
<EMAIL_ADDRESS>University of Texas at El PasoEl PasoTXUSA79968 and  Sudip
Mittal<EMAIL_ADDRESS>Mississippi State UniversityMississippi
StateMSUSA39762

(2024)

###### Abstract.

In an increasingly interconnected world, where information is the lifeblood of
modern society, regular cyber-attacks sabotage the confidentiality, integrity,
and availability of digital systems and information. Additionally, cyber-
attacks differ depending on the objective and evolve rapidly to disguise
defensive systems. However, a typical cyber-attack demonstrates a series of
stages from attack initiation to final resolution, called an attack life
cycle. These diverse characteristics and the relentless evolution of cyber
attacks have led cyber defense to adopt modern approaches like Machine
Learning to bolster defensive measures and break the attack life cycle. Among
the adopted ML approaches, Graph Neural Networks have emerged as a promising
approach for enhancing the effectiveness of defensive measures due to their
ability to process and learn from heterogeneous cyber threat data. In this
paper, we look into the application of GNNs in aiding to break each stage of
one of the most renowned attack life cycles, the Lockheed Martin Cyber Kill
Chain. We address each phase of CKC and discuss how GNNs contribute to
preparing and preventing an attack from a defensive standpoint. Furthermore,
We also discuss open research areas and further improvement scopes.

Machine Learning, Graph Neural Network, Cybersecurity, Cyber Kill Chain

††copyright: acmlicensed††journalyear: 2024††doi: XXXXXXX.XXXXXXX††journal:
TOPS††journalvolume: 0††journalnumber: 0††article: 1††publicationmonth:
1††ccs: General and reference Surveys and overviews††ccs: Computing
methodologies Neural networks††ccs: Security and privacy Domain-specific
security and privacy architectures

##  1\. Introduction

Cybersecurity is an ongoing practice dedicated to safeguarding systems and
networks from cyberattacks that target unauthorized access, data alteration,
information destruction, financial extortion, or disruption of regular
business operations (cisco_2022, ). The significance of cybersecurity becomes
more relevant with increased cyberattacks fueled by rapid digital expansion.
Common avenues for cyberattacks encompass phishing, social engineering,
password-related breaches, information misuse, man-in-the-middle attacks,
denial-of-service (DoS) attacks, ransomware, and more. In response, cyber
defense strategies incorporate a range of domains, network and perimeter
security, endpoint security, application security, data security, identity &
access management, zero trust architecture, and more. These defense measures
collectively aim to prevent attackers from achieving their goal through
cyberspace, referred to as cyber defense operations.

In an era characterized by unprecedented interconnectedness and technological
advancement, the cybersecurity landscape faces an escalating challenge: the
ceaseless barrage of cyber threats that target critical infrastructures,
sensitive information, and even the very fabric of societies. As the digital
landscape expands, so does the complexity of cyber attacks, necessitating a
paradigm shift in defensive strategies. According to Gartner experts, of all
cybersecurity breaches by 2024, 80% will result from failures to prove the
duty of due care (garner_cyber, ). In response to constantly evolving attack
patterns, enormous knowledge space, cost, and consistency, the marriage of
machine learning (ML) and cybersecurity has yielded innovative solutions,
propelling the evolution of defensive cyber operations to tackle unprecedented
scenarios. Therefore, along with keeping the systems secure from possible
threats, cyber defense operations now include getting ahead of the attacker to
predict its possible next move based on the data pattern. However, it is
impossible to effectively utilize ML techniques without a comprehensive, rich,
and complete approach to the underlying data. Among the cutting-edge ML
solutions, Graph Neural Networks (GNNs) (scarselli2008graph, ) have emerged as
a promising contender, harnessing the power of neural networks to navigate and
analyze intricate relationships within complex data structures. The
introduction of GNN in defensive cyber operations introduces a new dimension
of adaptive and intelligent defense mechanisms. Traditional cybersecurity
approaches that rely on signature-based detection and rule-based techniques
often struggle to keep pace with modern cyber threats’ rapid mutation and
polymorphism. In contrast, GNNs excel in capturing nuanced patterns and
dependencies within diverse datasets, enabling them to uncover hidden insights
that evade conventional methods. By viewing cyber threat data through a graph-
based lens, GNNs inherently recognize the interconnectedness of entities,
lending themselves to the intricate nature of cyber threat landscapes.

This survey paper aims to provide a comprehensive overview of the evolving
cyber threat landscape where GNNs intersect with defensive cyber operations.
To identify potential attack areas for a concrete countermeasure— we develop
our taxonomy based on the Lockheed Martin cyber kill chain (CKC)
(cyber_kill_chain, ) attack life cycle. The straightforward and simplistic
approach is the primary reason behind appointing CKC as the skeleton behind
our taxonomy. By exploration of relevant literature, this paper delves into
the fundamental areas of cybersecurity following CKC and underpinning GNNs
applications and the implications with opportunities for their integration
into defensive strategies. By summarizing existing research and highlighting
limitations, this survey aims to equip researchers with the capabilities and
possible future research avenues in concretizing cyber defense operations
through GNN. To the best of our knowledge, this survey is the first attempt
that concentrates on the influence of GNN in overall cyber defense operations.
In the following, we highlight our contributions in specific:

  * •

We demonstrate the application of GNNs in defensive cyber operations to detect
and mitigate attacks by utilizing their knowledge propagation and learning
capabilities.

  * •

A comprehensive summary of the state-of-the-art research articles utilizing
GNNs, grouped according to cover complete defensive cyber operations life-
cycle through each cyber kill chain (CKC) phase.

  * •

We address the persisting challenges and discuss improvement scopes with
future research directions in the employment of GNN in designing defensive
cyber operation models.

The remainder of the paper is as follows: Section 2 offers a foundational
overview of Graph Neural Networks, elucidating their architecture, principles,
and capabilities. Section 3 delves into the intricate landscape of cyber
attack and defensive cyber operations, providing the taxonomy of the
integration of GNN. Section 4 presents a comprehensive summary of existing
literature following our taxonomy, showcasing the diverse applications of GNNs
in cybersecurity contexts. Section 5 critically examines the challenges and
limitations of GNNs, addressing issues and potential improvement research
directions. Finally, Section 6 concludes the survey by summarizing key
findings, highlighting emergent trends, and proposing possible avenues for
future research.

##  2\. Graph Neural Networks

The fundamental definition of graph neural network (GNN) (scarselli2008graph,
) denotes the adaptation of classical neural network (NN) framework on graph
data to perform one or a combination of traditional machine learning tasks,
such as classification, regression, or clustering. Data representation in
graph form provides the means to capture complex relationships between
entities and utilize these relations using two basic components – nodes and
edges. Existing vast literature in GNN has provided evidence for offering
significant benefits to a broad range of domains that rely on artificial
intelligence systems. Recently, systems based on variants of GNN have been
well-explored on many tasks related to graph data, such as, social network
(Khaund2022Social, ) represents the interaction between social actors in the
graph form where the vertices represent the social actors and the edges
represent if there exists a relationship between two actors. In a citation
network (Cummings2022Structured, ), two papers hold a relationship with each
other via citations. In chemical sciences (Fout2017Advances, ), molecules are
modeled as graphs, where the nodes represent protein molecules and edges,
represent if their bio-activity exists in the chemical component and many
more.

###  2.1. Preliminaries

In this section, we define the graph notations and provide intuition to
translate a real-world problem into a classification task.

Notations. We denote a graph as $\mathcal{G}=(\mathcal{V},\mathcal{E})$, where
$\mathcal{V}=\\{v_{1},v_{2},...,v_{n}\\}$ is the set of nodes and
$\mathcal{E}=\\{e_{1},e_{2},\dots,e_{m}\\}\\\
\subseteq\mathcal{V}\times\mathcal{V}$ is set of edges between nodes. The
neighborhood of a node $v$ is denoted by set of nodes
$\mathcal{N}(v)=\\{u\in\mathcal{V}|(v,u)\in\mathcal{E}\\}$. The node feature
embeddings are represented by matrix
$X=[x_{1},\dots,x_{n}]^{\top}\in\mathbb{R}^{n\times d}$, where the
$x_{i}\in\mathbb{R}^{d}$ is the $d$-dimensional feature vector of node
$v_{i}$. Table 1 provides a description of notations used following.

Notation |  Description
---|---
$\mathcal{G}$ |  Graph
$\mathcal{V}$ |  Set of nodes
$\mathcal{E}$ |  Set of edges
$\mathcal{N}$(v) |  Neighborhood of node v
$n$ |  Number of nodes
$m$ |  Number of edges
deg($v$) |  Degree of node $v$
$X=[x_{1},\dots,x_{n}]^{\top}$ |  Feature matrix
$a_{v}^{(L)}$ |  Message vector in $L$-th iteration
$h_{v}^{(L)}$ |  Node representation of node $v$ in $L$-th iteration
${\mbox{AGGREGATE}^{(L)}(\cdot)}$ |  Aggregation function in $L$-th iteration
${\mbox{UPDATE}^{(L)}(\cdot)}$ |  Update function in $L$-th iteration
Table 1. Description of Notation.

Problem Statement. Recent literature has shown that GNNs can perform solve
various challenging tasks on graph-structured data such as partitioning of
graphs into meaningful subgraphs based on their structural properties
(goh2003betweenness, ; bianchi2020spectral, ; muller2023graph, ; he2022sssnet,
) or generate new graphs that possess similar characteristics and properties
from an input graph (wu2021self, ; xian2022generative, ; niu2020permutation,
). In this survey, we begin by exploring classification tasks solved by GNN.
Given a graph with nodes $v_{i}\in\mathcal{V}$ and edges $e_{i}\in\mathcal{E}$
representing entities and relationships, the task is to develop a GNN model
that can effectively classify nodes, edges, or entire graphs into predefined
$y$ classes, where $y\in\\{y_{1},y_{2},\dots,y_{c}\\}$ set of $c$ classes.

  * •

Node-level Classification. In node-level classification, the GNN model assigns
each node to one or more predefined classes or predicts a continuous value
associated with the node based on its node feature embedding from the
neighboring nodes.

  * •

Edge-level Classification. In edge-level classification, the GNN should learn
to classify edges into different categories or predict continuous values
associated with them. The goal is to determine the nature of the relationship
between pairs of connected nodes based on their neighboring node features and
the edge itself.

  * •

Graph-level Classification. In graph-level classification, the GNN should
learn to classify entire graphs into specific categories. The GNN should
effectively capture and aggregate information from all the nodes and edges in
the graph to make predictions about the graph as a whole.

###  2.2. Major GNN Frameworks

The ability of GNN to capture complex relationships originates from two prime
components of the GNN framework: (1) aggregation and (2) update. Over multiple
iterations, each node $v\in\mathcal{V}$ shares information containing the
learned node feature with their neighborhood aggregates the node feature
received from its neighborhood, and updates the node embedding using the
learned/aggregated information (xu2019how, ; Ryoma2020Survey, ). For a
$L$-iteration, the general aggregation and updating function in $k\in L$
iteration is summarized as:

(1) $\displaystyle a_{v}^{(k)}={\mbox{AGGREGATE}}^{(k)}(h_{u}^{(k-1)}|u\in
N(v))$ $\displaystyle(\forall k\in[L],v\in V),$ (2) $\displaystyle
h_{v}^{(k)}={\mbox{UPDATE}}^{(k)}(h_{v}^{(k-1)},a_{v}^{(k)})$
$\displaystyle(\forall k\in[L],v\in V),$

where $a_{v}^{(k)}$ and $h_{v}^{(k)}$ represents message vector and the
representation vector of node $v$ at the $k$-th iteration, respectively. At
the first iteration of GNN, the initial node representation vector
$h^{(0)}=X$. AGGREGATE($\cdot$) and UPDATE($\cdot$) are parameterized
functions. The final node representation $H^{(L)}$ is fed into the classifier
for identification, where $H^{(L)}=[h_{v}^{(L)}]$.

Figure 1. Illustration of GNN aggregate and update functions. The nodes $v$ of
input graph $G$ is aggregates the embeddings $h_{u}^{(k)}$ over $k$ iteration
from the neighbourhood $\mathcal{N}(v)$. Then, the node embedding of node $v$
is updated which is denoted by $a_{v}$. The final updated nodes are passed
through a neural network for prediction. [Icons from (flaticon, )]

With the advent of GNN frameworks in 2009 (Scarselli2009GNN, ), several GNN
frameworks have been proposed, wherein its core, different choices of
AGGREGATE($\cdot$) and UPDATE($\cdot$) functions lead to different variants of
the GNN model. We briefly summarize the major GNN frameworks and showcase
different aggregation and update functions related to the summarized GNN
approaches described in Section 4.

####  2.2.1. Graph Convolutional Network (GCN)

Kipf et al. (kipf2016semi, ) proposed a framework that uses the convolution
function on graph data to perform semi-supervised classification tasks. Each
node in the graph learns the feature information from all its neighbors using
the following aggregation and update function.

(3)
$\mbox{AGGREGATE}^{(k)}(\\{\\{h_{u}^{(k-1}|u\in\mathcal{N}(v)\\}\\})=\sum_{u\in\mathcal{N}(v)}\frac{h_{u}^{(k-1)}}{\sqrt{\mbox{deg}(v)\mbox{deg}(u)}}$
(4)
$\mbox{UPDATE}^{(k)}(h_{v}^{(k-1)},a_{v}^{(k)})=\sigma(W^{(l)}a_{v}^{(k)}).$

The aggregation process (equation 3) for node $v$ is a function of feature
information $h_{v}$ of all neighboring nodes $\mathcal{N}(v)$ from previous
iteration $k-1$ iterations, where a non-parametric weight
$\frac{1}{\sqrt{deg(v)deg(u)}}$ is assigned to any node $u$ and $v$. The
aggregated message $a_{v}$ is used to update node $v$ (equation 4) learned
representation using activation function $\sigma$, where $W(l)$ is a parameter
matrix. While GCN provides a simplistic approach to learning graphical
patterns, a major disadvantage of GCN is the overhead caused by computation
for large graphs.

####  2.2.2. GraphSAGE-mean

Hamilton et al. (hamilton2017inductive, ) proposed a framework called
GraphSAGE (SAmple and aggreGatE) to perform machine learning tasks on large
graph-structured data (e.g. social network). GraphSAGE uses a random sampling
strategy to aggregate information from a node’s neighbors to generate its
embedding, unlike GCN (kipf2016semi, ) where all neighbors are considered.

(5)
$\mbox{AGGREGATE}^{(k)}(\\{\\{h_{u}^{(k-1)}|u\in\mathcal{N}(v)\\}\\})=\frac{1}{\mbox{deg}(v)}\sum_{u\in\mathcal{N}(v)}h_{u}^{(k-1)}$
(6)
$\mbox{UPDATE}^{(k)}(h_{v}^{(k-1)},a_{v}^{(k)})=\sigma(W^{(l)}[h_{v}^{(k-1)},a_{v}^{(k)}]).$

The aggregation process (equation 5) for node $v$ is a function of node
embedding $h_{v}$ of all neighboring nodes $\mathcal{N}(v)$ from previous
iteration $k-1$ iterations, where a non-parametric weight $\frac{1}{deg(v)}$.
The update message $a_{v}$ (equation 6) is used to update node $v$ learned
representation using activation function $\sigma$, where a random sample of
the node from $[h,a]$ is considered. The advantages of GraphSAGE include its
ability to operate on large graphs with large numbers of nodes and edges. Due
to the simplistic sampling technique that selects a subset of neighbors for
each node, for a large graph, the process of aggregating is lightweight.
Additionally, GraphSAGE can handle heterogeneous graphs where the dimensions
of node features may differ.

####  2.2.3. Graph Attention network (GAT)

Veličković et al. (velickovic2018graph, ) proposed a graph attention network
(GAT) that can learn the importance of each node when performing message
passing. More specifically, when aggregating node information from neighboring
nodes for each target node in the graph, the semantic similarity between the
target node and each neighboring node will be considered by the multi-head
attention mechanism, and important neighboring nodes will be assigned higher
attention scores when performing the neighborhood aggregation.

(7)
$\alpha_{uv}^{(l)}=\frac{\mbox{exp}(\mbox{LEAKYRELU}(a^{(l)T[W^{(l)}h_{v}^{(l-1)},W^{(l)}h_{u}^{(l-1)}]}))}{\sum_{u^{\prime}\in\mathcal{N}(v)}{\mbox{exp}(\mbox{LEAKYRELU}(a^{(l)T}[W^{(l)}h_{v}^{(l-1)},W^{(l)}h_{u^{\prime}}^{(l-1)}]))}}$
(8)
$\mbox{AGGREGATE}^{(k)}(\\{\\{h_{u}^{(k-1}|u\in\mathcal{N}(v)\\}\\})=\sum_{u\in\mathcal{N}(v)}\alpha_{vv}^{(l)}h_{u}^{(k-1)}$
(9)
$\mbox{UPDATE}^{(k)}(h_{v}^{(k-1)},a_{v}^{(k)})=\sigma(W^{(l)}a_{v}^{(k)}).$

Unlike GCNs, GATs use attention mechanisms to assign different weights to
different nodes in the graph when aggregating information from neighbors. This
allows GATs to learn more fine-grained representations that capture the
relative importance of different nodes for each node in the graph. Overall,
GATs are a more powerful and flexible approach to node-level representation
learning on graphs, but they can also be more computationally expensive than
GCNs. The choice between GAT and GCN depends on the specific application and
the computational resources available.

####  2.2.4. Gated Graph Neural Network (GGNN)

GGNN is a variant of recurrent GNN, which aims to learn node representations
with recurrent neural architectures. Li et al. (Li2015GGNN, ) assumes that the
node in a graph constantly exchanges information/message with its neighbors
until a stable equilibrium is reached.

(10)
$\mbox{AGGREGATE}^{(k)}(\\{\\{h_{u}^{(k-1}|u\in\mathcal{N}(v)\\}\\})=A_{i}^{T}[h_{1}^{(k-1)},\dots,h_{n}^{(k-1)}]^{T}$
(11)
$\mbox{UPDATE}^{(k)}(h_{v}^{(k-1)},a_{v}^{(k)})=\mbox{GRU}(a_{i}^{(k)},h_{i}^{(k-1)}).$

The aggregation process (equation 10) for node $v$ is a function of node
embedding $h_{v}$ of all neighboring nodes $\mathcal{N}(v)$ from previous
iteration $k-1$ iterations, where $\alpha_{uv}$ is the attention value for
node $u$ and $v$. The update message $a_{v}$ (equation 11) is used to update
node $v$ learned representation using activation function $\sigma$. Unlike
GCNs, GGNNs can handle dynamic graphs where the structure of the graph changes
over time assisted by Gated Recurrent Units (GRU) that change in the graph
structure over time. GGNNs are more interpretable due to gates control the
flow of information into and out of each node, allowing for a more fine-
grained understanding of how information is being processed. GGNNs are a more
powerful and flexible approach to node-level representation learning on
dynamic graphs with longer-range dependencies, but they can also be more
computationally expensive than GCNs. The choice between GGNN and GCN depends
on the specific application and the characteristics of the graph data.

##  3\. Survey Overview and Taxonomy

The general definition of cyber operations refers to the employment of
cyberspace capabilities by an entity or organization towards a specific
objective (nistco, ). For the scope of this survey, we will refer to cyber
operations from a defensive objective. Furthermore, a cyber attack comprises a
series of steps by the attacker, leading from attack inception to the intended
resolution, referred to as attack life-cycle. Researchers have proposed
several attack life-cycles (mitre_attack_navigator, ; cyber_kill_chain, ;
caltagirone2013diamond, ; nist_cybersecurity_framework, ;
ibm_cybersattack_lifecycle, ; logrhythm_threat_lifecycle, ) to analyze the
attack characteristics and design better cyber defense strategy. Among all
these proposed attack life cycles, the diamond model (caltagirone2013diamond,
), MITRE ATT&CK (mitre_attack_navigator, ), and Lockheed Martin cyber kill
chain (CKC) (cyber_kill_chain, ) are most adopted by the industry. The diamond
model analyzes an attack by outlining the correlation between the attacker’s
motivations, victim, and infrastructures in the form of a diamond shape.
Specifically, the model characterizes an attack through four quadrants:
adversary, infrastructure, capabilities, and victim. By examining the
relationships between these quadrants, the diamond model helps understand the
nature of the threat and develop strategies against it. MITRE ATT&CK model
analyzes an attack by identifying detailed tactics, techniques, and procedures
(TTPs) employed by the attacker throughout the entire attack life-cycle. It is
organized as a matrix. Along the top row, it lists twelve tactical stages of
an attack (initial access, execution, persistence, privilege escalation,
defense evasion, credential access, discovery, lateral movement, collection,
command & control, exfiltration, and impact) and possible techniques and
procedures of each tactic in columns. It is comprehensive, covering a wide
range of potential TTPs. Furthermore, the model gets regular updates to
incorporate new attack TTPs as they are discovered. Lastly, Lockheed Martin’s
Cyber kill Chain (CKC) describes the stages of a typical cyber attack as a
linear chain of seven stages, namely: Reconnaissance, Weaponization, Delivery,
Exploitation, Installation, Command & Control, and Actions on Objectives. This
model provides a simplistic high-level view of the attack process, with a
focus on the objective of the attacker in each stage. Due to the
straightforward approach and wide acceptance throughout the industry, we will
follow the CKC to analyze and develop our survey taxonomy.

On the other hand, traditional prevention techniques primarily rely on
signature-based static approaches to disrupt these attack life cycles. Despite
performing well with restricted cost, it fails to detect novel attacks and is
easy to bypass with signature spoofing techniques. One of the leading reasons
for the upward trend of ML in cybersecurity stems from this drawback. The
pattern analysis capability and adaptation to behavioral changes lead to
hybrid analysis that relies on static logic driven by dynamic behavioral data.
To fuel this approach, data must contain complete, relevant, and rich
contextual information to represent all potential outcomes. It should also be
rich enough to cover all the details and relations between various working
components like devices, applications, protocols, and network sensors to
derive the right decision. Graph data structure perfectly fulfills these
requirements. However, due to its heterogeneous nature, traditional ML models
like CNN cannot utilize graph data for learning. Addressing this issue, GNN
has emerged as a promising ML technique that can leverage the valuable threat
information represented as graphical data to disrupt the attack life cycle.

Following this, we will look into adversary activities through the lens of CKC
and how GNN contributes from a defensive standpoint to counter each stage. We
provide a summarized version of our taxonomy in Figure 2.

Figure 2. Overview of our proposed taxonomy. We considered seven phases of the
cyber kill chain (CKC) [Reconnaissance, Weaponization, Delivery, Exploitation,
Installation, Command & Control, Actions on Objectives] with possible attacker
activities. For prevention, we consider seven defensive phases [Privacy
Maintenance, Research, Anomaly Detection, Vulnerability Detection, Intrusion
Detection, Malware Detection, Report] with measures to counter and break the
CKC from culmination.

###  3.1. Reconnaissance

Reconnaissance is the first phase of the CKC, where the attacker identifies a
victim and gathers information to discover vulnerabilities. It is accomplished
by harvesting any information that can be useful to conduct an attack. For
example, login credentials, user IDs, email addresses, system configuration,
location, and others fall under the adversary’s radar. To develop a concrete
defense strategy, the defender should engage in continuous privacy maintenance
activities to prevent the adversary from gathering information. To ensure
privacy, GNN can be used for link prediction, recommendation systems, and
information embedding tasks to thwart adversaries from discovering sensitive
information.

###  3.2. Weaponization

Weaponization is the second stage, where attackers create/modify payload to
take advantage of the discovered vulnerabilities in the target infrastructure
to carry out an attack. This developed payload can be anything from a threat
agent to a piece of malware, packaged to get delivered via any means to cause
damage. From a counter-proactive standpoint, defenders engage in continuous
research by maintaining cyber threat intelligence (CTI) for possible attacks
on the employed GNN models. By conducting such measures, defenders can
maintain an upper hand in the ongoing cyber warfare and prevent significant
damage. For example, simulated attacks on GNN utilizing known vulnerabilities
can help discover and evaluate the effectiveness of existing security
measures.

###  3.3. Delivery

Delivery is the third stage, referring to the transfer of weaponized payload
to the target system. Attackers execute various delivery mechanisms like
phishing, removable media, and social engineering, depending on the objective,
target vulnerability, and desired stealth. From a defensive standpoint,
organizations safeguard themselves against the delivery of malicious payloads
by monitoring network or system anomalies. These measures include anti-spam,
URL or email filtering, and more. Hence, anomaly detection can be considered
as a real-time malicious payload delivery prevention measure, aiming to detect
suspicious items, network traffic, or observations. In such cases, GNNs play a
vital role in detecting operational changes by learning network-system traffic
activity graphs.

###  3.4. Exploitation

Exploitation is the fourth stage that involves the utilization of the
vulnerability in the target system to initiate unauthorized access. During
this, the attacker uses the delivered payload to exploit the vulnerability in
the target system to execute malicious code or commands for initial foothold
establishment. Some standard vulnerabilities arise from software bugs,
misconfigurations, and other areas. As a preventative measure, vulnerability
detection involves identifying persisting loopholes to prevent exploitable
scopes in source code, application patch updates, and security policies &
procedures. To fortify this, GNNs can learn the semantic flow of the
application behavior and determine prevailing vulnerabilities before getting
exploited by the delivered malicious payload.

###  3.5. Installation

Installation is the fifth phase, where the attacker establishes a persistence
channel to solidify their foothold by installing threat actors into the
compromised infrastructure. Attackers may modify registries, execute malicious
files, and perform other actions depending on objectives and infrastructure.
For prevention, defenders conduct intrusion detection by reviewing signed
certificates, application compile-time, analyzing privileges, and other
relevant factors. Therefore, in a robust intrusion detection system, it is
crucial to understand the system’s topological structure. GNNs’ ability to
adapt and handle massive topological information makes them highly effective
in identifying such malicious executions.

###  3.6. Command & Control

Command & control (C2) is the sixth phase, referring to the communication and
coordination infrastructure between attacker and victim’s system or network to
maintain persistent control by the attacker. Installed malware and escalated
privilege allow attackers to issue commands, receive data, and sustain control
within victim’s environment. Hence, detecting and disrupting the C2 channel is
essential in thwarting the ongoing attack. Security measures like malware
detection help intercept the C2 communication channel, thus limiting the
attacker’s control. Such detection requires a classification mechanism to
identify system processes based on the execution pattern. GNN’s innate ability
to learn program flow aids in detecting and eradicating malware.

###  3.7. Actions on Objectives

Actions on objective is the final phase, during which an attacker accomplishes
intended objectives such as data theft, sabotage, disruption, or other
malicious goals. Attackers often erase or alter evidence of their presence and
actions to maintain anonymity after goal accomplishment. Actions may be taken
to impede security analysts from tracing, including deleting logs or
manipulating timestamps. Reporting attack TTPs is critical for analysis and
further prevention. Activity logs, after-action reports, and cybersecurity
knowledge graphs (CKGs) are shared globally to learn and identify attack
patterns. In such scenarios, GNNs play a valuable role in learning from a vast
amount of graphical data to support other security tools with improved
knowledge and contextual understanding.

We define our taxonomy from a defensive cyber operations standpoint, where
each category provides a direct countermeasure to the attack stage described
above. Hence, our taxonomy is also divided into seven categories: privacy
maintenance, research, anomaly detection, vulnerability detection, intrusion
detection, malware detection, and report. As mentioned, GNN has contributed
significantly by utilizing its innate ability to process and learn from a
tremendous amount of relational data in all these scenarios. This constitutes
the rationale of our survey on the implementation of GNN in aiding cyber
defense. Our taxonomy is based on the applications of GNN to break down each
phase of the CKC. In the next section 4, we will address the abilities and
drawbacks of existing research utilizing GNN to counter each phase of the CKC
following the taxonomy. Later in Section 5, we will discuss potential areas of
improvement, covering the identified drawbacks and future research directions.

##  4\. GNN’s use in Cyber

In this section, we will discuss each preventive measure against the cyber
kill chain in detail. First, we will discuss how the measures are beneficial
in countering the attack phase using GNN. Then, we will delve deep into
discussing some major recent developments in the last decade with a summarized
table associated with each phase. We also provide a complete research
information Table 9 containing each article with its respective category,
employed GNN models, classification types, experimental datasets, research
timeline, and accuracy.

###  4.1. Privacy Maintenance

In the context of ML, much like the stages of the CKC, vulnerabilities
threaten the privacy and integrity of models. Recent study (gong2020survey, ;
neupane2023impacts, ) shows that ML models may suffer from the potential risk
of leaking private information, are vulnerable to adversarial attacks
(patterson2022white, ), can inherit and magnify bias from training data, and
lack interpretability (neupane2022explainable, ). In this section, we
primarily emphasize the principle of privacy among other issues listed above.
To safeguard privacy, researchers have developed privacy-preserving GNNs.
These GNNs can be broadly categorized into four types: _adversarial privacy
preserving_ , _federated learning_ , _split learning_ , and _differential
privacy_. Table 2 provides an overview of the various privacy-preserving GNNs
and their respective categorizations including other notable works. In the
following, we will discuss state-of-the-art methods within each category.

Paper Title |  Focus/Objective |  Contributions |  Limitations
---|---|---|---
Adversarial Privacy Preserving
Adversarial privacy-preserving graph embedding against inference attack (li2020adversarial, ) |  Integration of graph embedding and privacy protection into an end-to-end pipeline against inference attack. |  • Graph embedding algorithm against inference attack. • Introduced Privacy-Disentangling and Privacy-Purging. |  • Full access of sensitive attribute might not be possible in real world.
Privacy-preserving representation learning on graphs: A mutual information perspective (wang2021privacy, ) |  To learn node representations to achieve high performance for the primary learning task. |  • Designs tractable algorithms to estimate intractable mutual information. |  • Reduces the leakage of sensitive attributes but increases GNN training cost
Information obfuscation of graph neural networks (liao2021information, ) |  Formulate and address the problem of information obfuscation on graphs with GNNs. |  • Creates a strong defense against information leakage while only suffering a marginal loss in task performance. |  • To some context, use of custom perturbations on node for AT.
Federated Learning , Differential Privacy & Split Learning
Fedgnn: Federated graph neural network for privacy-preserving recommendation (wu2021fedgnn, ) |  Leverages FL and membership inference for privacy assurance. |  • Designed novel federated framework for privacy-preserving GNN-based recommendation. • Introduced mechanism to protect model gradients in model training with local differential privacy. |  • This method fails to solve social recommendations, and the clients models are not personalized
Towards representation identical privacy-preserving graph neural network via split learning (shan2021towards, ) |  To address privacy issue of decentralized graphs using split learning and horizontal FL. |  • Generates the same node embedding as the centralized counterpart. • Proposes a secure pooling mechanism instead of global pooling aggregator. |  • Do not use the formal notion of differential privacy and provide weaker privacy guarantees.
Others
Learning privacy-preserving graph convolutional network with partially observed sensitive attributes (hu2022learning, ) |  Focuses on attribute inference attacks on GNNs. |  • Formulates a model to mitigate the individual privacy leakage using partially observed sensitive attribute. |  • Did not give differential privacy guarantees.
SecGNN: Privacy-preserving graph neural network training and inference as a cloud service (wang2023secgnn, ) |  Focuses on GNN training and inference services on cloud platforms. |  • First system supporting privacy preserving GNN training and inference as a cloud service. |  • Model might be weak for sophisticated adversaries.
Table 2.  A summary of the existing literature on privacy-preserving GNN with
their scope, contribution, and limitations.

Significant efforts have been made in recent studies to enhance privacy
protection and mitigate the risks of sensitive information leakage through
modifications to the training process of GNNs. A notable example is the work
of Li et al. (li2020adversarial, ), where the concept of Adversarial Privacy
Graph Embedding (APGE) to counter attribute inference attacks is introduced.
The approach incorporates disentangling and purging mechanisms aimed at
eliminating users’ private information from the learned node representations.
To achieve this, they integrate privacy-preserving regulation components into
the loss function during the training phase. Experiments on Yale and Rochester
datasets indicated the inclusion of disentangling and purging mechanisms
brought significant gain in performance. Similarly, the authors in
(wang2021privacy, ) present privacy protection utilizing adversarial privacy-
preserving techniques. In the work, they propose a framework for privacy-
preserving representation learning on graphs, adopting a perspective rooted in
mutual information. Specifically, the framework is designed to address the
concerns surrounding centralized training scenarios in GNNs and aims to
prevent the inadvertent leakage of training data. To achieve this, they
introduce bounding mechanisms that limit the exposure of sensitive information
such as node features, node labels, and link status during GNN model training
using three benchmark datasets including Cora (mccallum2000automating, ),
Citeseer (giles1998citeseer, ), and Pubmed (sen2008collective, ). In a
separate study (liao2021information, ), researchers present a solution to
combat attribute inference attacks on GNNs through an adversarial learning
approach. The proposed Graph Adversarial Networks (GAL) framework approach
revolves around a Wasserstein distance-based mini-max game between a desired
graph feature encoder and a worst-case attacker for information obfuscation of
sensitive attributes, empirically evaluated across 6 graph benchmark datasets
including Citeseer (giles1998citeseer, ), Pubmed (sen2008collective, ), M9,
ML-1M (konstan1997grouplens, ), FB15K-237 (toutanova2015representing, ), and
WN18RR.

Another way to ensure privacy preservation is by utilizing Federated Learning
(FL). FedGNN (wu2021fedgnn, ), for instance, combines FL with GNNs in
recommendation systems, aiming to safeguard users’ privacy. This system
captures complex user-item interactions by constructing local user-item
graphs. Additionally, to address privacy concerns, the implementation of local
differential privacy techniques helps mitigate privacy risks at the local
level. The authors used six widely used benchmark datasets for recommendation,
including MovieLens11 (100K,1M, and 10M) (konstan1997grouplens, ), Flixster
(jamali2010matrix, ), Douban (ma2011recommender, ), and YahooMusic
(dror2012yahoo, ). In recent years, Split Learning (SL) has emerged as another
prominent method and has captured the interest of researchers in the field of
privacy maintenance tasks. SL involves partitioning a complete model into
multiple sections. Building upon this concept, (shan2021towards, ) explores
the integration of GNNs with SL to protect model privacy, specifically in
node-level tasks, in scenarios where data is distributed horizontally across
multiple silos and privacy is guaranteed via a secure min-max pooling
aggregation mechanism. Similar to (wang2021privacy, ), the authors also
utilize the three same datasets for evaluation.

In another line of work, the authors in (hu2022learning, ) delve into the
realm of privacy-preserving GNNs, with a specific focus on handling partially
observed sensitive attributes. Their primary objective is to address the issue
of individual privacy leakage among private users. To achieve this, the
authors propose a method that disentangles the node features into distinct
latent representations of sensitive and non-sensitive attributes by imposing
orthogonality within a suitable space. The authors evaluated their model on
five benchmark datasets including two datasets with social networks, i.e.,
(Pokec-z and Pokec-n) (takac2012data, ), and three ethical datasets
constructed in (agarwal2021towards, ), i.e., German credit, Recidivism, and
Credit defaulter. More recently, researchers have been focusing on deploying
GNNs in cloud infrastructure to facilitate scalable and efficient graph
analysis while maintaining privacy. One notable example is SecGNN
(wang2023secgnn, ), which enables privacy-preserving GNN training and
inference services in the cloud. Unlike many existing approaches that rely on
federated learning to protect privacy, with the primary emphasis on target
system models and private training, SecGNN operates in an outsourced scenario.
This means that the owner of the graph data can send its encrypted graph data
to the cloud for secure training. In addition, SecGNN also supports secure GNN
inference on encrypted GNNs and inputs, ensuring end-to-end security in the
process. We further discuss the persisting loopholes and improvement areas in
Section 5.1.

###  4.2. Research

In the weaponization phase, the adversary develops an attack aimed at
exploiting the identified vulnerabilities in the target system. Therefore, to
maintain an effective security posture in an organization, the defender’s job
is to conduct adversarial simulations to determine possible drawbacks in the
existing defensive ML models. One defensive approach is research, which allows
defenders to evaluate and identify loopholes in end-systems or adopted models.
This can be done by performing regular attack simulations using GNN on
security ML models based on the reported threat intelligence. Information
cover from globally documented cybersecurity databases (e.g., CVE) or
scholarly articles. Below we discuss the research landscape and provide a
summary in Table 3.

Paper Title |  Focus/Objective |  Contributions |  Limitations
---|---|---|---
Research on Adversarial Attacks
Adversarial Attack on Graph Structured Data (dai2018adversarial, ) |  Developed adversarial attack on GNN-based graph supervised classification algorithm that can learn attack policy. |  • Considered white box, practical black box, and black box attack settings. • Demonstrated attack with hierarchical reinforcement learning, random sampling, gradient-based, and genetic algorithm. |  • Limited experiments on real-world datasets to prove robustness and transferability. • Do not consider poisoning attacks.
Adversarial Attacks on Graph Neural Networks via Meta Learning (zugner2019adversarial, ) |  Developed a training time meta-learning poisoning attack on GNN for node classification tasks. |  • Developed training time attack on attributed graphs. • Used meta-gradient to solve bilevel training-time attacks. |  • Did not provide the working mechanism of the attack. • No defensive measure is provided against such an attack.
Exploratory Adversarial Attacks on Graph Neural Networks (lin2020:epo, ) |  Developed an exploratory adversarial attack method to boost the gradient-based attacks on GNN. |  • Developed an exploratory approach to boost the gradient-based adversarial attacks. |  • Does not provide any defensive measure against the proposed approach.
Adversarial Attacks on Link Prediction Algorithms Based on Graph Neural Networks (lin2020adversarial, ) |  Developed an adversarial attack framework that generates perturbed graphs while preserving the overall structure to fool GNN-based link prediction tasks. |  • Developed an adversarial attack to fool GNN on link-prediction tasks. • Generate perturbed graphs while preserving the overall structure to influence targeted output errors. |  • Did not provide any defensive measure against the proposed attack.
Backdoor Attacks to Graph Neural Networks (zhang2021backdoor, ) |  Developed a subgraph-based backdoor attack to GNN for graph classification tasks. |  • GNN classifier predicts a targeted label if trained on the backdoor dataset. • The backdoor attack does not impact GNN’s accuracy over clean testing graphs. |  • Explored randomized smoothing-based certified defense but failed to provide a concrete solution.
Semantics-preserving Reinforcement Learning Attack Against Graph Neural Networks for Malware Detection (zhang2022semantics, ) |  Developed reinforcement learning-based semantics preserving adversarial attack against black-box GNNs for malware detection. |  • Used RL to insert Nops to preserve the program CFG semantics and elude GNN-based malware detectors. • The attack is designed considering a black-box scenario and is transferable to similar models that work on sequential data. |  • Did not provide any defensive measure against proposed attack approaches.
Hierarchical Adversarial Attacks Against Graph Neural Network Based IoT Network Intrusion Detection System (zhou2021hierarchical, ) |  Developed a hierarchical adversarial attack generation method targeting state-of-the-art GNN-based black-box NIDS systems in IoT. |  • Developed framework for level-aware black-box attack strategy to generate samples using shadow GNN models. • Used saliency map to identify critical feature elements and RWR mechanism for hierarchical node selection. |  • Do not provide any defensive measure against the proposed attack approach. • The Proposed approach is limited to NIDS in the IoT domain.
Research on Adversarial Defense
Developing graphical detection techniques for maintaining state estimation integrity against FDIA in integrated electric cyber-physical system(li2020developing, ) |  Developed an FDIA detection method using GNN, combined with a capsule network to detect tampered measurements and attack locations. |  • Used GNN to detect tampered measurements without external knowledge. • Used Capsule scheme to detect precise attack location and adapt with frequently evolving network structure. |  • The GN detection model cannot adapt to frequently changing graphs. • More practical experimentation is needed for robust implementation.
Graph Neural Networks Based Detection of Stealth False Data Injection Attacks in Smart Grids (boyaci2021graph, ) |  Developed generic, localized, and stealth FDIA generation methodology and a scalable real-time GNN-based detector model. |  • Developed a stealth FDIA methodology that can bypass BDD systems. • Developed a stochastic gradient descent-based stealth FDIA detection system. |  • Experiment is conducted over a randomly generated synthesized dataset.
Table 3.  Summary of the existing literature on adversarial research on GNN
with scope, contribution, and limitations.

A hierarchical reinforcement learning adversarial attack by modifying the
graph combinatorial structure for graph- and node-level classification tasks
was proposed by Dai et al. (dai2018adversarial, ). The modification is done by
sequentially adding or dropping nodes or edges in the target graph. The attack
is applicable in different adversarial settings with diverse GNN models for
inductive and transductive learning tasks ((scarselli2008graph, ;
dai2016discriminative, ; kipf2016semi, ; hamilton2017inductive, )). The model
achieved a 40% to 60% success rate for graph-level attacks using randomized
synthetic data and node-level attacks using Citeseer (giles1998citeseer, ),
Cora (mccallum2000automating, ), Pubmed (sen2008collective, ), and Finance
datasets. In defense, the authors proposed incorporating adversarial samples
in training, supported by the 1% decrease in attack accuracy. Similarly,
Zügner et al. (zugner2019adversarial, ) investigated training time attacks
using surrogate model meta-gradients on GNN for node classification tasks.
Meta-learning helps the process to be more time and data-efficient by finding
suitable hyperparameters. Evaluation in a black-box setting over Citeseer
(giles1998citeseer, ), Cora-ML (mccallum2000automating, ), and POLBLOGS
datasets (adamic2005political, ) confirmed GNN perform worse than a simple
baseline of up to 48% with a 5% change limit. However, gradient-based attacks
are limited in achieving sub-optimal results. Lin et al. (lin2020:epo, )
proposed an exploratory adversarial attack (EpoAtk) on GNN to boost the
gradient-based perturbations and sidestep the possible misinformation provided
by the maximal gradient. Experiments on semi-supervised node classification
tasks over modified Citeseer (giles1998citeseer, ), Cora
(mccallum2000automating, ), and Cora-ML (bojchevski2017deep, ) datasets
revealed a drop in GCN accuracy with fewer perturb edges, outperforming the
state-of-the-art attacks.

For white-box adversarial attacks against link prediction algorithms, Lin et
al. (lin2020adversarial, ) developed a transferable evasion attack on the
greedy heuristic that exploits incremental computation against a state-of-the-
art link prediction algorithm called SEAL. It uses degree distribution
preservation on the adjacency and the node information matrix to ensure un-
noticeable perturbations in the sub-graph by an un-noticeability threshold.
Evaluations over US Air, NS (newman2006finding, ), Celegans
(watts1998collective, ), and PB (ackland2005mapping, ) datasets justify an
approximated accuracy of 90% with defined constraints. On the other hand, for
the semi-black box graph classification setting, Zhang et al.
(zhang2021backdoor, ) developed a sub-graph-based backdoor attack. It injects
a subset of polluted sub-graphs in the training set to influence GNN to draw a
correlation between the target and the trigger and predict the target label.
Experiments on Bitcoin (weber2019anti, ), Twitter (wang2017sybilscar, ), and
COLLAB (yanardag2015deep, ) datasets concluded its high success rate.
Additionally in defense, the authors demonstrated works on certified defense
using randomized sub-sampling. However, the findings are not generic and have
a minor preventative impact, indicating further research requirements.

To elude black-box malware detectors, Zhang et al. (zhang2022semantics, )
developed a semantic preserving reinforcement learning-based (SRL) attack. To
maintain malware integrity, the model iteratively generates adversarial
samples by sequentially injecting semantic Nops in the control flow graph
(CFG). According to the results over labeled datasets from VXHeavens
(tan2016artificial, ), VirusShare (virusshare, ), and VirusTotal (virustotal,
), SRL was able to achieve 100% evasion accuracy. Again, to attack GNN-based
limited-budget IoT NIDS systems, Zhou et al. (zhou2021hierarchical, )
developed a Hierarchical Adversarial Attack (HAA) generation method. A shadow
GNN model based on the saliency map technique generates adversarial examples
by identifying and modifying critical node features with minimal
perturbations. Random Walk with Restart mechanism (RWR) determines
hierarchical vulnerable nodes based on the structural features and overall
loss. Finally, to alter the classification labels, an adversarial shadow GNN
disguises malicious packets as regular or vice versa. Experiments with UNSW-
SOSR2019 (hamza2019detecting, ) dataset over three baseline approaches proved
degrading accuracy by more than 30% against GCN and JK-Net.

As defensive research, to prevent false data injection attacks (FDIAs) and
identify attack locations in electrical power networks, Li et al.
(li2020developing, ) proposed a capsule scheme with GNN. The capsule scheme
was combined with a dynamic routing mechanism to make GNN flexible to power
topology changes and precisely identify attack locations. Experiments over
different models with a consistent precision of 0.9939 and recall of 0.98231
on IEEE 30 (ieee30, ) and 0.97131, and 0.97643 on IEEE 118-bus systems
(ieee118, ), showcased its robustness. Similarly, Boyaci et al.
(boyaci2021graph, ) proposed another FDIA detector using GNN for early
warnings in smart grid systems. The model was designed to handle dynamic
measurement data by learning the underlying topological structure alongside
data patterns. Additionally, the authors developed a generic, localized, and
stealth FDIA generation methodology and publicly accessible datasets for
additional research. Experiments were conducted over synthetic data using
Pandapower (thurner2018pandapower, ) over ERCOT’s load profiles for IEEE 14,
118, and 300 buses (ieee14, ; ieee118, ; ieee300, ), and the proposed model
outperformed the benchmark CNN models by 3.14%, 4.25%, and 4.41%. In Section
5.2, we further discuss persistent loopholes and areas for improvement.

###  4.3. Anomaly Detection

Anomaly detection refers to identifying suspicious items, events, or
observations that exhibit significantly distinctive characteristics from
standard patterns or behaviors. In cybersecurity, anomalies can occur due to
numerous factors, such as initiation/delivery of malware attacks, network
intrusions, social engineering, or insider threats. Detecting these anomalies
is critical for identifying and preventing the delivery of potential malicious
payloads. Furthermore, anomaly detection can provide early warning signs of an
attack, reduce false positives, and help to improve the overall security
posture. Anomalies are of three types: _point, contextual/conditional_ , and
_collective_ (wu2021graph, ). In the context of GNN, point anomaly refers to
node or edge classification, whereas contextual and collective anomalies are
primarily graph classification. The potential of GNN in anomaly detection
tasks has proven beneficial, which we elaborate on in the following paragraphs
with a summary in Table 4.

Paper Title |  Focus/Objective |  Contributions |  Limitations
---|---|---|---
Point Anomaly
Anomaly Detection using Graph Neural Networks (chaudhary2019anomaly, ) |  Detecting spam, fake reviews, or malicious activities in email (Enron) and social networks (Twitter). |  • Developed a GNN model to detect anomalies in mail and social network graphs. • GNN encoding achieved a classification accuracy of over 98%. |  • Experiment was conducted over a limited data set. • Architecture was designed to cover specific scenarios.
Relevance-Aware Anomalous Users Detection in Social Network via Graph Neural Network (li2021relevance, ) |  Develop RAU-GNN to acquire fine-grained detection results to identify abnormal social users like bots, spammers, etc. |  • Fusion GCN layer is used for anomalous behavior classification. • Incorporated a Multi-head Graph Attention Network (GAT) with GCN to detect camouflaging users. |  • GAT embeddings rely on GCN node representations. • Multiple computation-heavy (GAT, GCN) layers might increase computation.
Contextual Anomalies
An Anomaly Event Detection Method Based on GNN Algorithm for Multi-data Sources (ji2021anomaly, ) |  Detect anomalies in multi-source data in the secure critical infrastructure domain. |  • Developed Deep-GNN model to incorporate heterogeneous data set. • PCA was used in data pre-processing to increase robustness. |  • GNN heavily relies on spectral clustering for feature extraction and data fusion.
Spammer Detection Using Graph-level Classification Model of Graph Neural Network (song2021spammer, ) |  Developed a GNN model to detect spammers in social media. |  • Converted user behavior graph to extract features for model training. • Used Bayesian optimization framework for hyperparameters tuning. • Used 10-fold cross-validation. |  • Experimental setup is limited to a single dataset. • Time variations can be incorporated to allow dynamic graph classification.
Collective Anomaly
One-class graph neural networks for anomaly detection in attributed networks (wang2021one, ) |  Generate normal node embedding close to the center of the hypersphere for precise anomaly detection. |  • OCGNN can generate more accurate embeddings in close proximity. • Hypersphere learning allows the model to be robust from a usability standpoint. |  • The model cannot handle large dynamic graphs.
One-class Temporal Graph Attention Neural Network for Dynamic Graph Anomaly Detection (huang2021one, ) |  Generate natural node embedding close to the center of the hypersphere while incorporating dynamic graphs. |  • TGAT is used to extract large dynamic graph representation. • The approach is capable of edge classification and link prediction. |  • The indirect classification mechanism and requirement of anomaly-free training data might make the model scope limited.
Multi-layer Graph Neural Network-Based Random Anomalous Behavior Detection (shi2021multi, ) |  Developed a random anomalous edges detection model for an abundant edge graph. |  • Combined the GCN and GAT to learn abstract node features from the differentiated local structure influence. • The applicability of the model was tested with a diverse dataset. |  • The model was more inclined towards random anomalous edge detection.
Others
GNN-based Graph Anomaly Detection with Graph Anomaly Loss (zhao2020gnn, ) |  To represent anomaly-detectable nodes for better anomaly and dense block detection using improved GNN loss function. |  • Developed an improved GAL function. • Improves the low-performing outlier detection algorithms for diverse graphs. |  • The algorithm indirectly increases the anomaly detection accuracy by including outliers rather for the regular values.
Graph Neural Network-Based Anomaly Detection in Multivariate Time Series (deng2021graph, ) |  Developed a GDN to put together a structure learning technique with attention weights with GNN to explain anomalies in critical infrastructure systems. |  • Sensor embedding is computed to find deviations from normality. • Graph attention mechanism is used for forecasting, unlike other approaches. |  • Sensor embedding learning plays a crucial role in the overall model learning, making it less robust.
Table 4. Summary of the existing literature on anomaly detection using GNN
with scope, contribution, and limitations.

Chaudhary et al. (chaudhary2019anomaly, ) developed a technique to detect
point anomalies such as spam, fake reviews, or malicious activities within the
social (Twitter (twitter, )) and email (Enron (enron, )) networks utilizing
GNN. Findings conclude that ‘degree’ and ‘between centrality’ work best for
capturing anomalous nodes. A similar social anomalous user (bots, spammers)
detection approach was developed by Li et al. (li2021relevance, ), where they
used a Relevance-Aware Anomalous Users Detection model using GNN (RAU-GNN). A
GCN-based relation fusion layer first generates an unfined multiple user-node
relation graph by extracting from all users and relations. Then, a multi-head
GAT-based embedding layer produces high-level embeddings for GNN to learn and
identify anomalous users. Experimental high accuracy over Twitter (twitter, )
API and YelpChi (yelpchi, ) dataset confirmed the claims.

Ji et al. (ji2021anomaly, ) proposed a contextual anomalous event detection
method considering dynamic multi-source data for secure critical
infrastructure domain. Different feature-space social anomaly data were
extracted and fused into a single feature space based on the abnormal score
obtained through spectral clustering. A deep graph neural network (Deep-GNN)
was trained over the fused data and, was tested using multi-source data from
micro-blog (micro_blog, ) and Sina social platform (nr, ). Test results
compared with CNN and LSTM demonstrated robust and adaptive capabilities with
an average accuracy of 95%. Similarly, to prevent spamming and detect spammers
in social media, Song et al. (song2021spammer, ) proposed a graph
classification approach instead of node classification using GNN. The model is
used to detect spammers from embedded interactive relationship graphs using a
graph classification approach. Experiments were conducted using 10-fold cross-
validation over the tagged.com dataset.

Wang et al.(wang2021one, ) proposed a One Class Graph Neural Network (OCGNN)
for collective graph anomaly detection (GAD). OCGNN maps the nodes and
relationships into a hypersphere to generate node embeddings close to the
center. Hence, the common factors are identified by the GNN layer. GCN, GAT,
or GraphSAGE can act as a GNN layer in this framework. Due to hypersphere
learning, it can also be considered a natural extension of a one-class support
vector machine (OCSVM). Cora (mccallum2000automating, ), Citeseer
(giles1998citeseer, ), and Pubmed (sen2008collective, ) datasets were used for
evaluation against twelve two-stage GAD methods and three SOTA GAE-based GAD
approaches. To extend the previous work for large dynamic graphs, Huang et
al.(huang2021one, ) proposed a one-class temporal graph attention neural
network (OCTGAT) combining Temporal Graph Attention Network
(TGAT)(xu2020inductive, ) with OCGNN. On top of the previous approach, TGAT
was used to extract the dynamic graph representations and aggregate structural
and time-based attributes using Bocher’s theorem with optimized computation.
Anomalous nodes are detected by concatenating embeddings and feeding them to a
feed-forward neural network. For such, the model requires to get trained with
the non-anomalous dataset. According to the experiments over Wikipedia and
Reddit datasets (kumar2019predicting, ), OCTGAT surpassed the baseline
approaches and can also execute edge classification and link prediction tasks.
Shi et al. (shi2021multi, ) proposed another collective anomaly detection
approach that facilitates data analysis by detecting random anomalous
behavior. The model combines GCN and GAT to learn the abstract features with
more attention paid to the differentiated influence of the local structure. A
two-layer GCN learns connected node attributes and GAT identifies the
influence of nodes at different positions from the parameterized probability
distribution. Experiments on six real-world networks (OpenFlights (openflight,
), Political blogs (adamic2005political, ), Email-EU-core (email_eu_core, ),
Usairport, Jazz, and Highschool) alongside three benchmark models revealed its
significant AUC edge over others.

In a parallel research direction, motivated by the low-performing random walk
(RW) based training approaches for diverse graphs, Zhao et al.(zhao2020gnn, )
proposed an improved graph anomaly loss (GAL) function that helps GNN to
represent outlier and unexpected dense blocks with improved accuracy. GAL uses
global group patterns identified by graph mining algorithms to evaluate
similarity and adjust margins for minority classes. Graph outlier loss,
bounded test error, and dense block loss are key attributes for such tasks.
Experiments on BitCoin (kumar2016edge, ) and Weibo (jiang2016catching, )
datasets validated its improvement by around 10%. GAL is also compatible with
different GNN frameworks and has proven to keep the prediction error bounded
by the proposed loss function. On the other hand, to determine the root cause
of the detected anomalies in high dimensional time series graphs, Deng et al.
(deng2021graph, ) proposed a Graph Deviation Network (GDN) that utilizes
structure learning with GNNs, alongside attention weights for critical
infrastructure domain. The main components are sensor embedding, graph
structure learning, graph attention-based forecasting, and graph deviation
scoring. Experiments on real-world sensor dataset SWaT (mathur2016swat, ) &
WADI (ahmed2017wadi, ) justify its improved detection [F1-Score: 0.99 (SWaT) &
0.98 (WADI)] and allow users to comprehend the root cause. We discuss
persisting weaknesses and further research areas in Section 5.3.

###  4.4. Vulnerability Detection

Software vulnerabilities are defects introduced in the source code during
software development. These vulnerabilities left unattended can be exploited
by an attacker to disrupt the client side including halting the crucial
execution, integrating backdoors, remote file execution, and more. During the
pre-ML era, human experts were deployed to perform static, dynamic, or hybrid
analysis on the source code to detect vulnerabilities (zheng2013path, ;
sotirov2005automatic, ). While these approaches were effective, they were
mostly manual, which warranted intense labor and specialized expertise. With
the advent of deep neural networks (DNNs), ML models could be trained on
either expert-labeled patterns of vulnerability or fully automated techniques
to detect vulnerability in source code. Vulnerability identification can be
performed inter-procedural, which means identification of vulnerable code is
analyzed on procedure or function level, whereas, intra-procedural
vulnerability identification means the analysis is performed locally within a
specific method scope. Several surveys summarize automated vulnerability
detection using DNN techniques (shen2020survey, ; kushwaha2022systematic, ;
hanif2021rise, ; rabheru2022hybrid, ). Table 5 captures the focus of our
survey to summarize recent developments using GNNs.

Paper Title |  Focus/Objective |  Contributions |  Limitations
---|---|---|---
Research on Vulnerability Detection in Source Code
Devign: Effective Vulnerability Identification by Learning Comprehensive Program Semantics via Graph Neural Networks (Zhou2019Devign, ) |  Source code vulnerability identification problem. |  • Novel composite code representation with AST, CFG, DFG, and NCS. • Leveraged GGNN using 1-D CNN-based pooling (Conv module) to perform graph-level classification task. |  • Complex Code representation leads to poor performance on large functions. • Difficult to find programming language-specific parsers.
ReGVD: Revisiting Graph Neural Networks for Vulnerability Detection (Nguyen2022ReGVD, ) |  Vulnerability identification as an inductive text classification problem. |  • Flat sequence of token representation allows PL-independent code graph. • Introduced residual connection among GNN layers with sum and max poolings.  |  • Code representation stage doesn’t includes CFG or DFG, missing out on relevant structural information.
Combining Graph-Based Learning With Automated Data Collection for Code Vulnerability Detection (Wang2021combining, ) |  Identifies software vulnerabilities at the function level from program source code. |  • Code representation using extended AST. • Leveraged GGNN with stacked GRU, which is passed to a standard fully-connected network to make a classification using a softmax layer. |  • Pre-processing functions using extended AST adds significant complexity.
BGNN4VD: Constructing Bidirectional Graph Neural-Network for Vulnerability Detection (cao2021bgnn4vd, ) |  Vulnerability detection approach by constructing a Bidirectional Graph Neural-Network (BGNN) |  • Proposed CCG to capture source-code syntax and semantics. • Used BGNN to process information and classify using a CNN. |  • Accuracy is specific to reported vulnerabilities. • Non-reliable for large datasets.
DeepWukong: Statically Detecting Software Vulnerabilities Using Deep Graph Neural Network (Cheng2021DeepWukong, ) |  Precise interprocedural analysis for vulnerability detection in real-world programs. |  • Code representation is performed by generating PDG containing control and data dependency of the program. • Leveraged GCN, GAN, and k-dimensional GNNs with top-k pooling. |  • Datasets are labeled by domain experts, possibility of missing corner cases. • Limited to the top 10 vulnerabilities in C/C++ programs.
CSGVD: A deep learning approach combining sequence and graph embedding for source code vulnerability detection (tang2023csgvd, ) |  Function-level vulnerability detection as a graph binary classification task. |  • Code representation using CFG. • Leveraged PE-BL module, a GNN layers with residual connectivity, and a graph-level mean biaffine attention (M-BFA) pooling to learn graph representation. |  • Information from DFG and AST was not considered. • Lack of interprocedural information to understand the nature of vulnerability.
A hybrid graph neural network approach for detecting PHP vulnerabilities (rabheru2022hybrid, ) |  Vulnerability detection by capturing contextual information to reduce false positives and false negatives. |  • Used intraprocedural CFGs to capture semantic code dependencies. • Leveraged bidirectional GRUs, GCN, and edge pooling. |  • The model works on only PHP source codes. • Experiments are run on simplistic SARD dataset.
Predicting Vulnerability Inducing Function Versions Using Node Embeddings and Graph Neural Networks (sefa2022, ) |  Vulnerability prediction model, that runs after every code change and identifies vulnerability-inducing functions. |  • Code representation using AST • Leveraged GraphSAGE, GCN with average pooling and max pooling.  |  • Tested on only one dataset.
Research on Vulnerability Detection in Smart Contracts
Smart Contract Vulnerability Detection Using Graph Neural Networks (zhuang2020smart, ) |  Fully automated vulnerability analyzer for smart contracts. |  • Code represented using contract graph with the consideration of temporal ordering. Node types include, i.e., major nodes, secondary nodes, and fallback nodes. • Leveraged DR-GCN and novel temporal message propagation network TMP. |  • Source code is considered as a text sequence instead of semantic blocks, failing to highlight critical variables in the data flow.
Table 5.  Summary of the existing literature on vulnerability detection using
GNN with scope, contribution, and limitations.

To automate the process of vulnerability detection, one major decision is to
learn comprehensive program semantics which can capture both data and logical
flow of the source code. Zhou et al. (Zhou2019Devign, ) proposed Devign that
solves vulnerability identification problems as graph-level classification
where the model learns from composite programming representation of the source
code, such as (1) abstract syntax tree (AST), (2) control flow graph (CFG),
(3) data flow graph (DFG), and (4) natural code sequence (NCS). The authors
proposed a novel 1-D CNN-based pooling mechanism to translate node and link
level classification for end-to-end graph level classification. Evaluation
over LinuxKernel, QEMU, Wireshark, and FFmpeg datasets (devign_dataset, )
attains accuracy of 72.26% and F1 score of 73.26%. The results outperform
state-of-the-art (Du2019leopard, ) by a higher average of 10.51% accuracy and
8.68% F1 score. Devign is considered in the literature as one of the first and
strongest baseline models for inter-procedural vulnerability detection. Nguyen
et al. (Nguyen2022ReGVD, ) claim the use of Devign (Zhou2019Devign, ) is
impractical for complex programming languages, source codes, and libraries due
to the difficult pre-processing step to transform source code into a multi-
edged graph. The authors proposed ReGVD, a language-independent vulnerability
identification mechanism, that represents the graph as a flat sequence of
tokens. The represented graph is initialized by embeddings from pre-trained
programming language (PL) models like CodeBERT or GraphCodeBERT. The GNN node-
level embeddings are updated in each iteration by recursive aggregation using
a residual connection. Finally, a graph-level readout layer aggregates node
embeddings globally for each graph. Evaluation results over CodeXGLUE
(lu2021codexglue, ) show ReGVD achieving accuracy improvement of 1.61% over
Devign. To unleash the full potential of DL-based vulnerability detection,
Wang et al (Wang2021combining, ) proposed FUNDED, a mechanism that encodes
multiple code relationships into different relation graphs, to learn relation-
specific functions and their associated vulnerability. The model leverages
GGNN with stacked GRU and a fully connected network to make classification.
Evaluation results over LinuxKernel, FFmpeg, ImageMagick, rdesktop, and OpenSC
datasets (funded, ) show an improvement of 12.4% in accuracy over Devign. Tang
et al (tang2023csgvd, ) proposed CSGVD that uses a PE-BL module which inherits
and enhances the knowledge from the pre-trained language model for node
embedding and a BiLSTM to aggregate the local semantic information within a
node. Additionally, a mean bi-affine attention pooling (M-BFA) for graph
embedding. The evaluation results over the CodeXGLUE (lu2021codexglue, )
dataset were compared with multiple baselines proving an improvement of 4.41%
accuracy over Devign. Cao et al (cao2021bgnn4vd, ) proposed another
bidirectional GNN to perform vulnerability identification using a code
composite graph (CCG) by combining the AST, CFG, and DFG that captures various
source code syntax and semantic information. Evaluation over LinuxKernel,
FFmpeg, Wireshark, and Libav datasets (bgnn4vd, ) reported an accuracy of
74.7% and F1-score of 76.8%.

Cheng et al. (Cheng2021DeepWukong, ) introduced an interprocedural static
vulnerability identification tool tailored for C/C++. This tool calculates
control and data dependencies over CFG and Value-Flow Graphs (VFG),
considering pointer aliases information. Additionally, it constructs the
Program Dependence Graph (PDG). The model achieved an accuracy score of 97.4%
and an F1-score of 95.6% across multiple datasets, including SARD (sard, ),
lua (lua, ), and redis (redis, ). In another context, Rabheru et al.
(rabheru2022hybrid, ) tackled intra-procedural vulnerability detection in PHP.
They employed a token-based approach, parsing linear token sequences to
capture syntactic dependencies in source code using CFGs. Their model
delivered an accuracy of 96.56% and an F1-score of 96.11% on both the SARD
(sard, ) dataset and real-world projects. These results were achieved by
harnessing bidirectional Gated Recurrent Units (GRUs) in conjunction with
Graph Convolutional Networks (GCNs). Şahin et al. (sefa2022, ) proposed a
method for detecting change-level vulnerable code using Abstract Syntax Trees
(AST) and incorporating GCNs. The model achieved an F1-score of 74.4% when
evaluated on the Wireshark dataset (wireshark-dataset, ).

Another avenue of vulnerability detection includes blockchain systems and
other cryptocurrency networks. The rise of online wallets has popularized
decentralized online ledgers for monitoring financial transactions. To ensure
trustworthy and credible online transactions, organizations encode rules and
policies in the form of source code, commonly referred to as smart contracts.
Similar to any code snippet, smart contracts can be susceptible to
vulnerabilities (Cai2023combine, ). Zhuang et al. (zhuang2020smart, )
presented a novel approach involving a degree-free Graph Convolutional Network
(GCN) and a Temporal Message Propagation network (TMP) for detecting
vulnerabilities in smart contracts. Their model achieved remarkable accuracy,
scoring 84.48%, 83.45%, and 74.61% for identifying reentrancy, timestamp
dependence, and infinite loop vulnerabilities. In the context of our survey,
we refrain from an in-depth exploration of the literature on smart contract
vulnerability detection due to the existance of substantial body of work,
including comprehensive surveys (qian2022smart, ; chu2023survey, ;
zhang2021recent, ) that offer profound insights into the landscape of smart
contract vulnerabilities and the application of GNNs for their detection. In
Section 5.4, we delve further into the persisting loopholes and areas for
improvement.

###  4.5. Intrusion Detection

Intrusion detection refers to the process of monitoring and analyzing computer
systems or networks to identify unauthorized or malicious activities. It
involves the use of various TTPs to detect and respond to potential security
breaches, such as unauthorized access, malware infections, or end-point
security. It can be considered as a countermeasure against the installation
phase of the CKC where the attacker tries to establish a backdoor for
persistent communication. Intrusion Detection Systems (IDS) are mainly of two
types, Network-based (NIDS) and Host-based (HIDS). NIDS monitors network
traffic for suspicious patterns or anomalies, while HIDS focuses on individual
systems or endpoints. There have been numerous studies on IDS utilizing GNN
capabilities and is still an active area of research (bilot2023graph, ). Some
notable ones are discussed below with a summarized Table 6.

Paper Title |  Focus/Objective |  Contributions |  Limitations
---|---|---|---
Network Intrusion Detection System (NIDS)
E-GraphSAGE: A Graph Neural Network based Intrusion Detection System for IoT (lo2022graphsage, ) |  Developed GNN-based intrusion detection system for IoT domain by capturing edge features and topological information. |  • Considers flow-based features and topological patterns to account for interconnected patterns of the network flow. • Modified GraphSAGE algorithm with mini-batch allows the model to consider edges with increased efficiency. |  • Neighborhood sampling can be used to improve the run-time of the model. • Investigation on explainable GNN algorithms is needed to get model output insights.
Graph-based Solutions with Residuals for Intrusion Detection: the Modified E-GraphSAGE and E-ResGAT Algorithms (chang2021graph, ) |  Integrated EGraphSAGE and E-ResGAT to incorporate residual connections and attention mechanism to consider class imbalance. |  • Incorporated residual learning with EGraphSAGE to enhance performance. • Applied attention mechanism of GAT while considering residual learning and edge features to improve efficiency further. |  • Optimizing the construction of the batch neighborhood process can speed up the model performance. • More imbalanced data sets need to be tested.
Unveiling the potential of Graph Neural Networks for robust Intrusion Detection (pujol2022unveiling, ) |  Developed a GNN NIDS model that can process and learn from structural relationships and flow patterns to identify attacks. |  • Proposed host-connection graphs, to capture structural flow relationships. • Proposed a GNN model that uses a non-standard message-passing architecture to learn from host-connection graphs. |  • Was only tested on CIC-IDS2017 dataset and synthesized adversarial attack scenarios.
Host Intrusion Detection System (HIDS)
Using Graph Representation in Host-Based Intrusion Detection (hu2021using, ) |  Graph representation learning-based host intrusion detection system (HIDS). |  • Used graph representation learning to develop HIDS. • Developed a sequence embedding method using graph structures to model a finite number of sequence items and represents the structural relationships between them. |  • Cannot generate graphs for sequences with multiple attributes or predefined rules. • Performance improvement of GRSE for larger full graphs needs to be explored.
THREATRACE: Detecting and Tracing Host-Based Threats in Node Level Through Provenance Graph Learning (wang2022threatrace, ) |  An anomaly-based HIDS at the system entity level without prior knowledge of any attack pattern. |  • Used GraphSAGE to learn benign entities’ role in provenance graph. • The model works in a real-time manner and can scale for long-term hosts. |  • Require benign data for training and cannot guarantee robustness. • May fail against poisoning and graph backdoor attacks.
Table 6.  Summary of the existing literature on intrusion detection on GNN
with scope, contribution, and limitations.

Weng et al. (lo2022graphsage, ) presented NIDS using GNN to classify malicious
network flows. The model captures edge and topological information in IoT
networks for classification. The authors enhanced the GraphSAGE
(hamilton2017inductive, ) algorithm to directly exploit the structural
information of the network flow and encode it in a graph. The main changes in
E-GraphSAGE are in the algorithm input, the message passing/aggregator
function, and the output where the network flow edges have been considered
instead of nodes. Experiments over the datasets created in
(koroniotis2019towards, ; alsaedi2020ton_iot, ; sarhan2020netflow, ) achieved
an F-1 score of 0.97 for binary and 0.87 for multi-class classification. Chang
et al. (chang2021graph, ) further enhanced E-GraphSAGE to integrate residual
learning and attention mechanism to increase efficiency. The authors utilized
E-GraphSAGE with residual learning to target minority class imbalance and an
edge-based residual graph attention network (E-ResGAT) to improve efficiency.
They also proposed a fixed neighborhood in edge sampling and selection for
aggregation using attention mechanism. Evaluation over CIC-DarkNet
(cic_daknet, ), ToN-IoT (ton-iot, ), UNSW-NB15 (unsw_nb15, ), and CSE-CIC-IDS
(cse_cic_ids, ; sharafaldin2018toward, ) datasets proved an overall increase
in accuracy. To make the model robust against changing networks and evolving
adversarial attacks, Pujol-Perich et al. (pujol2022unveiling, ) focused on the
structural patterns of the attack by analyzing the flow features independently
with intra-relations. They proposed a host-connection (HC) graph to keep the
flow records and capture meaningful information with a GNN model based on a
non-standard message-passing architecture capable of learning from the HC
graph to recognize the structural flow patterns of attacks. Evaluation over
CIC-IDS2017 (sharafaldin2018toward, ) dataset against two adversarial attacks
that modify packet size and inter-arrival times justified its superiority.
While other traditional ML models degrade their accuracy (F1) up to 50%, the
proposed model maintained its accuracy throughout.

For HIDS from the system calls, Hu et al. (hu2021using, ) proposed a graph-
based model that works by constructing graphs from system call traces for
graph classification to detect intrusion. Graph random state embedding (GRSE)
is another novel approach developed by the authors to generate graph
embeddings, including graph transform, random state walk, subgraph extraction,
and graph pooling. Hence, classification is done based on the embedded graph
topology. Experiments on the ADFA-LD (creech2013semantic, ) dataset justify
the performance improvement with the developed embedding. Wang et al.
(wang2022threatrace, ) developed another real-time HIDS framework based on
system provenance graphs. The model utilized GraphSAGE algorithms for
aggregation and node embedding generation, where each system entity is
considered as nodes, and the system calls as edges. The model requires only
benign data for training and works in the anomaly identification principle.
Experiments over five public datasets (StreamSpot (streamspot, ), Unicorn SC-1
and SC-2 (unicorn, ), DARPA TC #3 and #5 (darpa, )) against seven state-of-
the-art HIDS models proved its potential. Persisting loopholes and improvement
areas are discussed in Section 5.5.

###  4.6. Malware Detection

Malware detection is a crucial countermeasure against the Command and Control
(C2) phase. It phase involves attacker utilizing the persistent communication
channels, set up by installed malware in the compromised systems to execute
remote instruction. Hence, anti-malware solutions employ diverse methods to
detect and block installed malware activities by learning system behavioral
patterns through ML models. To capture behavioral relations, GNN has proven to
be an attractive choice that enables the identification of malware presence by
addressing suspicious behaviors. Additionally, behavior analysis can also
indicate the presence of zero-day malwares.

Paper Title |  Focus/Objective |  Contributions |  Limitations
---|---|---|---
General Malwares
Heterogeneous Graph Matching Networks: Application to Unknown Malware Detection (wang2019heterogeneous, ) |  Developed a heterogeneous graph-matching network model to learn the graph representation and similarity metric simultaneously based on program execution. |  • Developed an invariant graph modeling to capture heterogeneous interactions. • HAGNE was used to learn from heterogeneous invariant graphs. • Siamese network was used to perform similarity scoring. |  • Accuracy needs to be improved further. • Evaluation with more robust attack scenarios is needed for practical deployment.
Classifying malware represented as control flow graphs using deep graph convolutional neural network (yan2019classifying, ) |  Detect malware from CFG using DGCNN to be deployable in a variety of operational environments. |  • Used DGCNN for CFG analysis and classification. • Developed generically to be deployable in the cloud and can be used by a common user. |  • Requires a high training time. • Requires testing with the latest malware samples for robustness.
Classifying Packed Malware Represented as Control Flow Graphs using Deep Graph Convolutional Neural Network (hua2020classifying, ) |  Develop malware classifier using DGCNN while considering the unpacked and local CFG of applications. |  • Developed algorithm to strip from packed CFG to obtain unpacked local CFG. • Used DGCNN to learn and classify malware from unpacked block CFGs. |  • Different adversarial CFG characteristics are required to be tested with the approach for robust applicability.
Intelligent malware detection based on graph convolutional network (li2022intelligent, ) |  Develop a malware classifier using GCN to adapt to the different malware characteristics. |  • Used directed cyclic graph, constructed from API call sequence. • Used Markov chain and PCA for feature analysis. • Used GCN for malware classification. |  • Further research on GCN is required to make the model more adaptive with the development of novel malware. • Cost optimization also needs to be addressed.
Android Malwares
Android Malware Detection via Graph Representation Learning (feng2021android, ) |  Malware detection using graph representation learning, combined with NLP techniques. |  • Lightweight static analysis using graph representation learning. • Word2Vec generates function embedding to represent code characteristics. • Captures semantic information from call graphs without expert knowledge. |  • Cannot extract intra-function Smali instructions against obfuscation. • Cannot create precise approximate call graphs for large-scale malware.
NF-GNN: Network Flow Graph Neural Networks for Malware Detection and Classification (busch2021nf, ) |  Developed a network flow feature-based GNN model for malware detection and classification. |  • Extracted directed edge attribute flow graphs from a set of network flows. • Developed a GNN model to learn from graph topology and edge attributes for malware classification. |  • Additional network architectures such as attention, model temporal dynamics, and explainability need to be considered.
Graph Neural Network-based Android Malware Classification with Jumping Knowledge (weng2022graph, ) |  Android malware detection through FCGs using GNN-JK. |  • Used GNN with JK technique to address GNN over-smoothing problem. • Topological information embedded in FCGs was utilized for malware classification. |  • The developed model is not optimized at all and exploring other GNN architectures might help.
Industrial & IoT Malwares
Cross-Architecture Internet-of-Things Malware Detection Based on Graph Neural Network (li2021cross, ) |  Developed a cross-architecture IoT malware detection method using GNN. |  • Used NLP to extract semantic information and generate function embedding. • Used GraphSAGE to learn the structural information by GNN. • Used MLP with softmax to classify malicious binary files. |  • Pre-processing phase using IDA pro is time-consuming and requires significant acceleration. • Need to consider more features to increase robustness.
Table 7.  Summary of the existing literature on malware detection using GNN
with scope, contribution, and limitations.

Wang et al. (wang2019heterogeneous, ) developed a behavior-based malware
detection approach (MatchGNet) using a heterogeneous graph matching mechanism.
Invariant graph modeling (IGM) captures heterogeneous system interactions,
then a hierarchical attention graph neural encoder (HAGNE) is employed to
learn the representations. Finally, a similarity learning (SL) model via
Siamese Network (zagoruyko2015learning, ) trains the parameters and determines
the similarity between the unknown and a benign program. Experiments revealed
an increased accuracy of up to 97% while outperforming other state-of-the-art
baseline models (LR, SVM, MLP, GCN, GraphSAGE) with 50% less false-positive
(FP) rates at lower training time and cost. Yan et al.(yan2019classifying, )
proposed a malware classification tool that utilizes the graph mining
capabilities of Deep Graph Convolution Network (DGCNN). Since the CFG has a
heterogeneous data structure, it is represented as a tensor of variable size,
requiring a graph machine learning approach. Experiments on MSKCFG
(ronen2018microsoft, ) and YANCFG (yancfg, ; virustotal, ) datasets were
conducted and evaluated with 5-fold cross-validation. According to the
evaluation, the model achieved an average F-1 score of 0.97 in MSKCFG and
around 0.8 in YANCFG dataset. Due to its generic approach, it can also be
deployed in the cloud for real-time classification. To avoid detection during
execution, another technique malware uses is packing, which generates
different CFGs. Hua et al. (hua2020classifying, ) proposed to strip the
unpacked CFG into local CFG for final classification using DGCNN. The unpack
function calls do not relate to any malware local functions and vice-versa.
Hence, the unpacked CFG can be stripped to the local CFG for classification.
Finally, DGCNN learns the malicious local CFG for classification. Experiments
covering six malware families from VirusShare (virusshare, ) with 10-fold
cross-validation yield an overall accuracy of 96.4%. To address the evolving
malware characteristics, Li et al. (li2022intelligent, ) proposed a malware
classifier using GCN. The objective is to learn different characteristics from
directed API call graphs. The notable aspect of this approach is use of Markov
chain and PCA for graph feature extraction. Experiments over VirusTotal
(virustotal, ) and VirusShare (virusshare, ) concluded the highest accuracy of
98.32% with less FPR than other state-of-the-art models.

To detect Android malware, Feng et al. (feng2021android, ) proposed a
lightweight static analysis approach (CGDroid) that analyzes the source code
to extract high-level semantic information. It constructs an approximate call
graph from function invocation relationships and then pulls out intra-function
attributes like permissions, security level, Smali instructions, etc.
Word2Vec-embedded call graphs allow unsupervised training and classification
using GNN. Evaluation over Drebin (arp2014drebin, ) and AndroZoo
(allix2016androzoo, ) datasets suggests promising capabilities with an
accuracy of 97.1% for multi-class (20) classification. To leverage rich
communication patterns and dynamically detect Android malware using network
flow graphs while apprehending endpoint pairs using GNN, Busch et al.
(busch2021nf, ) developed three derived models: graph classifier, graph
autoencoder, and one-class graph neural network (OCGNN). It extracts a
communication graph for each execution of a candidate application and then
classifies them using edge features. Evaluation results over CICAndMal2017
(lashkari2018toward, ) dataset improved recall by 4.12%, 14.41%, and 24.78%
for binary, category, and family classification while obtaining 95% detection
accuracy. Additionally, the ablation study helped evaluate the influence of
feature sets and network layers. Lo et al. (weng2022graph, ) proposed another
network-based approach using GNN with jumping knowledge (JK) by utilizing
Android function call graphs (FCGs) to obtain meaningful intra-procedural call
patterns. GCN, GraphSAGE, and Graph Isomorphism Network (GIN) (xu2019how, )
built a three-phase classification approach. Apart from traditional feature
extraction and classification, JK is used in training concatenation layer to
obtain graph embedding while preventing over-smoothing. Evaluations over 24
malware families from Malnet-Tiny (freitas2020large, ) and Drebin
(arp2014drebin, ) datasets proved to boost accuracy by 8%.

An architecture-independent malware detection approach for IoT devices
focusing on FCG was proposed by Li et al. (li2021cross, ). The model can
consider structural semantics information independent of the underlying
architecture. Experiments covering five different processor architectures
(MIPS, ARM, PowerPC, X86_64, i386) with datasets (virusshare, ) covering
diverse malware families over the years were used for evaluation and achieved
an accuracy of 99.61%. Apart from solo GNN usage, researchers have proposed
several hybrid and ensemble models with GNN for diverse domains. Catal et al.
(catal2021malware, ) proposed a GAT model for the transportation domain, and
Dvorak et al. (dvorak2022gnn, ) for databases. Additionally, Wu et al.
(wu2023deepcatra, ) proposed GNN paired with LSTM to help capture the
structural information. In Section 5.6 we discuss the enduring drawbacks with
enhancement opportunities.

###  4.7. Report

Reporting is a possible countermeasure against the final CKC phase, Action on
Objective (AOO). In AOO phase, the attacker executes its intended goals and
often tries to destroy its footprints. To learn the attack TTPs and prevent
similar future occurrences, the defensive models require rapid learning
updates regarding the attacks. For this, organizations rely on robust
reporting platforms such as CVE (cve, ) to gather and disclose CTI, such as
logs, traffic analysis, preventive measures, and other relevant data, related
to novel security incidents and breaches. Cybersecurity analysts at the
security operations center (SOC) parse these attack footprints to generate
CKG, defensive rules, policies, etc., to update defensive cybersecurity
models. Efficient information storage, propagation, and sharing of these
security updates is crucial to maintain this pipeline. GNN can influence
conducting efficient knowledge propagation, storage, and learning for the ML
models from CKGs. Hence, by prompt reporting and efficient knowledge
processing through GNN, organizations can collaborate and initiate incident
response procedures to equip against novel attacks and prevent similar
occurrences with appropriate countermeasures.

Paper Title |  Focus/Objective |  Contributions |  Limitations
---|---|---|---
Fake-Data Detection in Social Media
Graph Neural Networks with Continual Learning for Fake News Detection from Social Media (han2020graph, ) |  Propagation-based fake news detection using GNN |  • Used GNN to differentiate between propagation patterns of real and fake news. • Used continual learning to deal with catastrophic forgetting problem. |  • Limited to the catastrophic forgetting phenomenon. • GEM and EWC causes increased computation time.
Propagation-Based Fake News Detection Using Graph Neural Networks with Transformer (matsumoto2021propagation, ) |  Fake news detection using graph transformer network (GTN). |  • Developed a weight function to enhance the difference propagation pattern between real and fake news. • Improved accuracy by the use of GTN. |  • Was compared against two GNN models. • Evaluation was done only using Twitter data.
Evidence-aware Fake News Detection with Graph Neural Networks (xu2022evidence, ) |  Veracity and evidence-based fake news detection using GNN. |  • Can learn from complex graph-structured claims and evidence data. • Simple yet effective graph structure learning approach for redundancy mitigation. |  • Including other datasets might increase robustness. • Improved performance is required for deployment.
Cybersecurity Knowledge Graph Improvement
Cybersecurity Knowledge Graph Improvement with Graph Neural Networks (dasgupta2021cybersecurity, ) |  Generate score for semantic triples in CKG for fake or outdated data detection. |  • Fake and outdated semantic triple detection using authenticity score (0-1). • The scoring GCN model can work with other triples-generating ML models. |  • More research is needed to increase the accuracy. • Requires correct dataset for supervised learning.
Table 8.  Summary of the existing literature on reporting using GNN with
scope, contribution, and limitations.

To maintain the authenticity of the data source, Han et al. (han2020graph, )
proposed to identify fake data based on the propagation pattern. The authors
trained GNN to learn the propagation pattern of tweets among users and
classify faked tweets. Due to the vastly differing fake data landscape, ML
models do not work well for unseen data using text-based identification
methods. Hence, to allow continual learning using incremental training, the
authors used Gradient Episodic Memory (GEM) and Elastic Weight Consolidation
(EWC) techniques to achieve high detection accuracy for unseen data.
Experiments utilizing the Twitter dataset from FakeNewsNet
(shu2020fakenewsnet, ) evaluated the model’s ability to detect fake news with
an average accuracy of 75%. To achieve the same objective with a similar
approach, Matsumoto et al. (matsumoto2021propagation, ) proposed a novel
weight function to identify different propagation patterns between real and
fake news in the graph. The authors used a graph transformer network (GTN)
model that works using multi-head attention and message-passing mechanisms to
search for usable connectivity relations for identification. Evaluation using
the previous dataset (shu2020fakenewsnet, ) against two state-of-the-art
propagation-based GNN methods demonstrated an improved accuracy of 93% to 95%.
Contrary to the propagation pattern of data for fake data identification, Xu
et al. (xu2022evidence, ) proposed to train GNN models with textual knowledge
of evidence-based veracious claims. Multiple claims and evidence are modeled
as graphs-structured data to capture the semantic dependency using GNN. Then,
using structure learning, long-distance semantic dependencies are captured and
mitigated. Finally, the learned model predicts using fine-grained semantic
representations. Evaluations using Snopes (popat2017truth, ) and PolitiFact
(vlachos2014fact, ) datasets against baseline state-of-the-art patterns and
evidence-based approaches demonstrated its potential and robustness of being
used as a plug-in-play approach with other models.

Dasgupta et al. (dasgupta2021cybersecurity, ) proposed to improve CKG
consistency by identifying fake or outdated data by computing a score for each
CKG triple using GCN. The authors trained the GNN using manually curated
correct data to identify faked or outdated data with a scoring mechanism.
Experiments covering diverse malware information from numerous CTI sources and
synthetic fake data obtained an F-1 score of 0.975. In Section 5.7, we address
persisting loopholes with improvement areas. Following we provide our complete
research information table 9 with critical research details such as GNN
models, classification type, datasets, research timeline, and performance.

Prevention Phase |  Category |  Classification
node/edge/graph | Paper | Year |  GNN Models /
Algorithm | Dataset | Performance
---|---|---|---|---|---|---|---
|  |  graph |  (li2020adversarial, ) | 2020 |  GAE, GCN, AAE | Rochester | Avg. F1 0.59
|  |  node |  (wang2021privacy, ) | 2021 |  GCN, GAT, HGCN |  (mccallum2000automating, ; giles1998citeseer, ; sen2008collective, ) | AUC 95.18 %
|  Adversarial Privacy Preserving |  graph |  (liao2021information, ) | 2021 |  GCN, GAT, ChebNet |  (giles1998citeseer, ; sen2008collective, ; konstan1997grouplens, ; toutanova2015representing, ) |  0.959 $T_{1}$ Perf.
|  |  graph |  (wu2021fedgnn, ) | 2021 |  FedGNN |  (konstan1997grouplens, ; jamali2010matrix, ; ma2011recommender, ; dror2012yahoo, ) | 0.989 RMSE
|  Federated Learning, Split Learning |  node, graph |  (shan2021towards, ) | 2021 |  GNN with BP |  (mccallum2000automating, ; giles1998citeseer, ; sen2008collective, ) | Avg. Acc. 75.33 %
|  |  node, graph |  (hu2022learning, ) | 2022 |  GCN, DRL, NCL |  (takac2012data, ; agarwal2021towards, ) | Acc. 90.62%
Privacy Maintainence |  Others |  graph |  (wang2023secgnn, ) | 2023 |  GCN |  (mccallum2000automating, ; giles1998citeseer, ; sen2008collective, ) | Acc. 78.6 %
|  |  node, graph |  (dai2018adversarial, ) | 2018 |  RL-S2V, $Q^{*}$ |  (giles1998citeseer, ; mccallum2000automating, ; sen2008collective, ) |  Acc. $\downarrow$: 60%
|  |  node |  (zugner2019adversarial, ) | 2019 |  Meta-learning |  (giles1998citeseer, ; mccallum2000automating, ; adamic2005political, ) |  48% $\downarrow$ — 5% Change
|  |  node |  (lin2020:epo, ) | 2020 |  Exploratory |  (giles1998citeseer, ; mccallum2000automating, ; bojchevski2017deep, ) |  10.7% $\downarrow$ — 3% Change
|  |  edge |  (lin2020adversarial, ) | 2020 |  $\Upsilon$-decaying |  (newman2006finding, ; watts1998collective, ; ackland2005mapping, ) | 76.5% ASR — 25% Cng.
|  |  graph |  (zhang2021backdoor, ) | 2021 |  Backdoor |  (weber2019anti, ; wang2017sybilscar, ; yanardag2015deep, ) | 74% Avg. ASR
|  |  node |  (zhang2022semantics, ) | 2022 |  RL |  (tan2016artificial, ; virusshare, ; virustotal, ) | Avg. ASR: 93%
|  Adversarial Attack |  node |  (zhou2021hierarchical, ) | 2021 |  Saliency Map |  (hamza2019detecting, ) |  Acc. $\downarrow\geq$ 30%
|  |  node, edge |  (li2020developing, ) | 2020 |  Capsule Scheme |  (ieee30, ; ieee118, ) | Recall: 0.98
Adversarial Research |  Adversarial Defense |  node, edge |  (boyaci2021graph, ) | 2021 |  Chebyshev layer |  (ieee14, ; ieee118, ; ieee300, ) |  F1 $\uparrow$ 4% ¿ CNN
|  |  node |  (chaudhary2019anomaly, ) | 2019 |  Traditional GNN |  (enron, ; twitter, ) | Accuracy: 98%
|  Point Anomaly |  node |  (li2021relevance, ) | 2021 |  Fusion GCN, GAT |  (twitter, ; yelpchi, ) | Acc.¿ 79% — 20% train
|  |  node, graph |  (ji2021anomaly, ) | 2021 |  Deep-GNN |  (micro_blog, ; nr, ) | Accuracy: 95%
|  Contextual Anomaly |  graph |  (song2021spammer, ) | 2021 |  Bayesian Optim. | tagged.com | Accuracy ¿ 96%
|  |  graph, node |  (wang2021one, ) | 2021 |  OCGNN |  (mccallum2000automating, ; giles1998citeseer, ; sen2008collective, ) | AUC ¿ 0.82
|  |  graph, node |  (huang2021one, ) | 2021 |  TGAT+OCGNN |  (kumar2019predicting, ) | AUC ¿ 0.86
|  Collective Anomaly |  edge |  (shi2021multi, ) | 2021 |  GCN+GAT |  (openflight, ; adamic2005political, ; email_eu_core, ) |  Avg. AUC $\approx$ 0.86
|  |  node |  (zhao2020gnn, ) | 2020 |  Graph Mining Alg. |  (kumar2016edge, ; jiang2016catching, ) |  Acc. $\uparrow\approx$ 10%
Anomaly Detection |  Others |  node, edge |  (deng2021graph, ) | 2021 |  Attention |  (mathur2016swat, ; ahmed2017wadi, ) |  F1 $\geq$ 0.98
|  |  graph |  (Zhou2019Devign, ) | 2019 |  GGNN |  (devign_dataset, ) | Accuracy: 72.26%
|  |  graph |  (Nguyen2022ReGVD, ) | 2022 |  Residual-GGNN |  (lu2021codexglue, ) | Accuracy: 63.69%
|  |  graph |  (Wang2021combining, ) | 2021 |  GGNN+stacked GRU |  (funded, ) |  Accuracy: $\uparrow$ 12.6%
|  |  graph |  (cao2021bgnn4vd, ) | 2021 |  Bidirectional-GGNN |  (bgnn4vd, ) |  Accuracy: $\uparrow$ 4.9%
|  |  graph |  (Cheng2021DeepWukong, ) | 2021 |  GCN,GAN,k-GNN |  (DeepWukong, ) | Accuracy: 97.4%
|  |  graph |  (tang2023csgvd, ) | 2023 |  GNN with M-BFA |  (lu2021codexglue, ) | Accuracy: 64.46%
|  |  node, graph |  (rabheru2022hybrid, ) | 2022 |  GCN+GRU |  (sard, ) | F1 score: 88.12%
|  Source-code |  graph |  (sefa2022, ) | 2022 |  GraphSAGE+GCN |  (wireshark-dataset, ) | F1 score: 74.4%
Vulnerability Detection |  Smart Contracts |  node, edge |  (zhuang2020smart, ) | 2020 |  DR-GCN+TMP |  (Vntchainwebsite, ) | Accuracy: 84.48%
|  |  edge |  (lo2022graphsage, ) | 2021 |  GraphSAGE |  (koroniotis2019towards, ; alsaedi2020ton_iot, ; sarhan2020netflow, ) |  F1 $\approx$ 0.97
|  |  node, edge |  (chang2021graph, ) | 2021 |  GraphSAGE+GAT |  (cic_daknet, ; ton-iot, ; unsw_nb15, ; cse_cic_ids, ; sharafaldin2018toward, ) |  F1 $\uparrow$ ¿ 0.01
|  Network Based |  edge |  (pujol2022unveiling, ) | 2022 |  Traditional GNN |  (sharafaldin2018toward, ) |  F1 $\approx$ 0.99
|  |  graph |  (hu2021using, ) | 2021 |  Sequence embed. |  (creech2013semantic, ) |  Acc. $\uparrow\approx$ 2%
Intrusion Detection |  Host Based |  node |  (wang2022threatrace, ) | 2022 |  GraphSAGE |  (streamspot, ; unicorn, ; darpa, ) |  F1 $\approx$ 0.85
|  |  graph |  (wang2019heterogeneous, ) | 2019 |  HAGNE+Siamese Net | – | Accuracy: 97%
|  |  graph |  (yan2019classifying, ) | 2019 |  DGCNN |  (ronen2018microsoft, ; yancfg, ; virustotal, ) |  F1 $\approx$ 0.97 & 0.8
|  |  graph |  (hua2020classifying, ) | 2020 |  DGCNN |  (virusshare, ) | Accuracy: 96.4%
|  General Malware |  graph |  (li2022intelligent, ) | 2022 |  GCN+Markov chain |  (virustotal, ; virusshare, ) | Accuracy: 98.3%
|  |  graph |  (feng2021android, ) | 2021 |  GRL |  (arp2014drebin, ; allix2016androzoo, ) | Accuracy: 97.1%
|  |  edge, graph |  (busch2021nf, ) | 2021 |  OCGNN |  (lashkari2018toward, ) | Accuracy: 95%
|  Android Malwares |  graph |  (weng2022graph, ) | 2022 |  GNN+JK |  (freitas2020large, ; arp2014drebin, ) |  Acc. $\uparrow\approx$ 8%
Malware Detection |  IoT |  graph |  (li2021cross, ) | 2021 |  GraphSAGE |  (virusshare, ) | Accuracy: 99.61%
|  |  graph |  (han2020graph, ) | 2020 |  DiffPool |  (shu2020fakenewsnet, ) | Accuracy: 75%
|  |  edge, graph |  (matsumoto2021propagation, ) | 2021 |  GTN |  (shu2020fakenewsnet, ) | Accuracy: 95%
|  Fake Data |  node, graph |  (xu2022evidence, ) | 2022 |  Structure Learning |  (popat2017truth, ; vlachos2014fact, ) |  F1 $\approx$ 0.7 & 0.8
Threat Report |  Knowledge Graph |  node, edge |  (dasgupta2021cybersecurity, ) | 2021 |  GCN | – | F1: 0.975
Table 9. Survey research information summary Table containing all articles
following our taxonomy. Notations are following. [ASR: Attack Success Rate],
[$\uparrow$: Increase], [$\downarrow$: Decrease], [$|$: At], [Acc. :
Accuracy], [Cng. : Change], [Perf. : Performance]

##  5\. Discussion

In this section, we will discuss the ongoing research limitations and
potential future research directions. We address the improvement scopes based
on our summarized research findings in Section 4.

###  5.1. Privacy Maintenance

Privacy indicates how private data, such as activity feed, system data, and
security model parameters, can be protected to prevent it from being leaked.
In an effort to prevent leakage, privacy-preserving GNNs are being developed.
In the body of literature, these GNNs are categorized into various categories,
such as adversarial privacy preservation (li2020adversarial, ;
wang2021privacy, ; liao2021information, ), federated learning (wu2021fedgnn,
), differential privacy & split Learning (shan2021towards, ), and others
(hu2022learning, ; wang2023secgnn, ).

Figure 3. Privacy Maintenance as a security measure against reconnaissance to
obfuscate victim information.

Researchers are currently working on metrics to evaluate the effectiveness of
privacy-preserving GNNs. These models, which are based on adversarial privacy-
preserving techniques, such as those presented in (li2020adversarial, ;
wang2021privacy, ; liao2021information, ), focus on obtaining high accuracy in
predicting link and utility attributes while protecting privacy. Li et al.
(li2020adversarial, ), for example, achieved superior privacy protection and
utility retention, achieving an average Macro-F1 score of 0.549 on private
attributes. On the other hand, despite effectively maintaining a high level of
privacy, some authors observed a drop in link prediction accuracy when
applying node privacy protection (wang2021privacy, ). In a similar vein, Liao
et al. (liao2021information, ) also reported a slight loss in task
performance; nevertheless, their models demonstrated robustness against
inference attacks. These approaches, however, fall short of effectively
addressing how to achieve an ideal compromise between prediction performance
and privacy protection. More research is required to thoroughly investigate
this essential feature. Additionally, when employing privacy-preserving
approaches such as federated learning and differential privacy (wu2021fedgnn,
), it is critical to carefully examine hyperparameters in order to strike the
right balance between model performance and privacy protection. If the privacy
budget is set too low, it can have a negative impact on the accuracy of model
gradients. Conversely, work that emphasizes privacy preservation in a
distributed setting, such as Split Learning (shan2021towards, ), tends to
ignore the formal notion of differential privacy, leading to considerably
weaker privacy guarantees. Addressing these challenges and improving the
overall privacy-performance trade-off is critical for achieving robust and
effective privacy-preserving GNNs. In a separate line of work, Hu et al.
(hu2022learning, ) have made an effort to address the problem of privacy
leakage concerning private user data by disentangling node features and
enforcing orthogonality within a relevant space. Despite the fact that
elements may be orthogonal, it is important to recognize that statistical
correlations might exist that could potentially lead to privacy breaches.
Similarly, Wang et al. (wang2023secgnn, ) have presented a solution for
privacy-preserving GNNs in an outsourced scenario. However, the approach might
not offer sufficient resilience against sophisticated attacks.

###  5.2. Research

GNNs have emerged as powerful tools for analyzing structured data, such as
social networks, CFGs, DFGs, CKGs, etc. However, recent studies have
highlighted the vulnerability of GNNs to adversarial attacks, where subtle
perturbations to the input graph can lead to malicious node, edge, and graph
predictions. Adversarial research has primarily focused on injecting
continuous perturbations in the target graph without breaking the
combinatorial structure (dai2018adversarial, ; zugner2019adversarial, ;
zhang2021backdoor, ; zhou2021hierarchical, ; lin2020:epo, ;
lin2020adversarial, ). To understand the research landscape, we categorized it
into the following:

####  5.2.1. Performance & Transferability

The impact of any developmental research is measured by comparing its
performance matrix, which includes accuracy, robustness, transferability, etc.
From an accuracy point of view, reinforcement learning, genetic algorithm, and
gradient descent-based approaches (dai2018adversarial, ) were able to achieve
40% to 60% misclassification, and 48% misclassification was achieved with 5%
perturbed edges by Zügner et al. (zugner2019adversarial, ). Another similar
performance drop compared to state-of-the-art models was noted in the works of
Lin et al. (lin2020:epo, ). Contrary to black-box scenarios, misclassification
accuracy in white-box settings was relatively higher, around 90%
(lin2020adversarial, ) to 100% (zhang2021backdoor, ). Using such approaches
misclassification accuracy was observed consistent throughout, justifying the
severity. Apart from a consistent misclassification trend, another notable
factor was transferability. Most of the attacks are model-independent and thus
can be transferred and applied to other models. For example, the attack
developed by Zhang et al. (zhang2022semantics, ) can be operated on any GNN
model that utilizes sequential data. Hence, the consistency and robustness of
the adversarial attacks pose a severe threat to the employed GNN models.

Figure 4. Research as a proactive measure against weaponization to prepare
against possible attack.

####  5.2.2. Defence mechanism & mitigation

Compared to the active research on developing adversarial attacks on GNN
models, there are only a few in defense (li2020developing, ; boyaci2021graph,
). Some methods include incorporating adversarial samples in the training data
(dai2018adversarial, ) or randomized smoothing (zhang2021backdoor, ) as a
primary defense strategy. Furthermore, contrary to adversarial attacks,
defensive approaches are not equally transferable and are mostly evaluated
over some synthesized datasets. To address this, researchers attempted to
increase the explainability of GNN models (he2022illuminati, ;
ying2019gnnexplainer, ). However, such models are scope-dependent. From a
defensive standpoint, robust explanations are needed. Therefore, immediate
attention to robust explainability and defensive GNN research is needed.

###  5.3. Anomaly Detection

Anomaly detection is a critical task in cyber defense to prevent the delivery
of malicious payloads and ensure end-to-end security with significant impact
in various domains, such as finance, healthcare, industrial systems, etc.
Traditional anomaly detection methods often struggle to capture complex
network patterns and dependencies present as graph-structured data. GNNs have
shown promise in modeling and analyzing graph data, making them an attractive
candidate for anomaly detection tasks. In a generic approach, by learning the
standard behavioral relation between nodes, GNN is used to classify the
deviant. Apart from generic GNN approaches, researchers have also proposed a
few indirect ones to enhance GNNs’ functionality for anomaly detection
(zhao2020gnn, ; deng2021graph, ). Other than conventional scenarios,
researchers also addressed a few different long-standing ones such as DoS
attacks (chakraborty2023capow, ) through anomaly detection. We evaluate the
research landscape and potential improvement scopes from an implementable
point of view through the following categories.

Figure 5. Anomaly Detection to detect malicious payload against weaponization
to prepare against possible attack.

####  5.3.1. Scalability & Cost

Cyber defense systems often handle large-scale and dynamic graph data, posing
challenges in terms of scalability and efficiency for GNN-based anomaly
detection. Even with achieving impressive accuracy in limited testing data,
models often struggle to handle large chunks of real-time data with
significant accuracy (chaudhary2019anomaly, ; li2021relevance, ;
song2021spammer, ; wang2021one, ). One of the root causes of such occurrences
stems from higher dependency among various interconnected models designed to
handle specific scenarios (ji2021anomaly, ; wu2021graph, ). Hence, developing
scalable algorithms using modular architectures that can process and analyze
large graphs from diverse aspects in real-time is crucial for deployment.
Fortunately, from hardware standpoint, suppliers have started developing chips
to support such extensive computation (gnn_intel_hardware, ). On the other
hand, few models require pre-curated data for training (huang2021one, ),
increasing costs. Therefore, robust yet self-learning aspects during model
development demand significant attention.

####  5.3.2. Interpretability & Explainability

Anomalies in cyber systems can exhibit diverse patterns, including rare
events, stealthy attacks, and evolving behaviors. Additionally, existing
models generate extensive alerts that cybersecurity analysts are not able to
verify on time, known as threat alert fatigue problem (he2022illuminati, ).
Ensuring that GNNs only capture and identify genuine anomalies, requires
careful modeling and innovative techniques. Researchers have tried to improve
the fine-tuning functions (zhao2020gnn, ; deng2021graph, ) to improve
accuracy– instead of direct model improvement. Leveraging GNN explainability
from different aspects (ying2019gnnexplainer, ; yuan2021explainability, ;
he2022illuminati, ) will facilitate model improvement research in a directed
manner. Hence, contextualized and explainability-driven GNN model development
will correctly interpret underlying anomalous patterns and reduce analyst
intervention with low false-positives.

###  5.4. Vulnerability Detection

GNN-driven vulnerability detection complements human expert-based
vulnerability finding and identification of potential weaknesses and security
risks in complex source code. Evidently, GNN has shown effective ways to
capture the relationships among code elements, such as functions, and
variables, enabling them to identify various types of vulnerabilities, such as
buffer overflows, injection attacks, code injections, etc. More specialized
applications of vulnerability detection exist in blockchain-based smart
contract source code where considerable research has been performed
(zhuang2020smart, ; Cai2023combine, ; liu2021combining, ; zeng2022ethergis, ).
Based on recent progress, we will outline the possible directions.

Figure 6. Vulnerability detection to detect vulnerabilities and prevent
exploitation by malicious payload by developing patches.

####  5.4.1. Secure Coding & Development.

The utilization of advanced Integrated Development Environments (IDEs) can
wield a significant influence in thwarting the introduction of vulnerabilities
within the source code. These IDEs offer supportive tools that adeptly steer
developers toward crafting secure code. A variety of static code analysis
tools offer capabilities tailored to identify vulnerabilities specific to
programming languages. This is achieved by systematically considering edge
cases, boundary conditions, etc., preemptively. However, to fully harness the
capabilities of GNN-based techniques, it is crucial to explore their
generalization potential across diverse domains such as software, network, and
IoT. In a similar vein, enhancing the interpretability of GNN-based
vulnerability detection (he2022illuminati, ) systems will provide the means to
explain the reasoning behind the predictions made by these systems, which in
turn, have greater trust impact, especially for human-in-the-loop systems.
Additionally, the practice of efficient graph generation (Nguyen2022ReGVD, ;
Zhou2019Devign, ) and code refactoring proposed by several research
(Desai2021graph, ; suneja2020learning, ; LeClair2020Improved, ) can utilize
modern large language models (LLMs) (jain2023code, ) to alleviate
vulnerability introduction further. Another intriguing avenue for research
involves investigating the seamless integration of GNNs with existing reverse
engineering tools, such as IDA Pro (idapro, ) and GIDRA (ghidra, ), could
potentially be synergized with GNN-based approaches to enhance the overall
efficacy of vulnerability management practices.

####  5.4.2. Dynamic & Heterogenous Benchmarking.

The landscape of source code management is heterogeneous (i.e. includes
various programming languages, libraries, frameworks) and dynamic (i.e.
addition of new code to patch source code or addition of new logic). Since
GNNs trained on one specific codebase might struggle to generalize effectively
to different codebases that possess varying coding styles, languages, or
domain-specific characteristics, the process of adapting GNNs from one project
to another necessitates thorough retraining or fine-tuning. Hence,
vulnerability detection in a heterogeneous and dynamic coding landscape poses
unique challenges as current literature lacks in providing a diverse benchmark
dataset. Many prior research (Nguyen2022ReGVD, ; Cheng2021DeepWukong, ;
liu2021combining, ; tang2023csgvd, ) is conducted on well-known datasets, such
as SARD (sard, ), CodeXGLUE (lu2021codexglue, ), etc. Comparing the results
from one with another may not hold due to the varying specifications of each
of these datasets, hence requiring further investigation.

###  5.5. Intrusion Detection

Intrusion detection plays a critical role in safeguarding our digital systems
by identifying unauthorized or malicious activities within computer networks.
As the complexity and sophistication of attacks continue to evolve,
traditional intrusion detection methods often struggle to capture the complex
and dynamic relationships among processes and network entities, making them
susceptible to sophisticated attacks. For such reasons, GNNs have recently
gained attention as a potential solution for intrusion detection
(bilot2023graph, ). By learning the network and system behavior, GNN models
can identify occurring internal threats. However, there are still challenges
requiring attention. Additionally, there have been very few works on Intrusion
Response Systems (IRS) alongside detection– even when rapid response is
necessary to complement efficient detection. For example, risk assessment,
prioritization, and parallelization are critical areas that need to be
addressed with effective IDS research (anwar2017intrusion, ). Following, we’ll
discuss the research landscape with challenges and future directions.

Figure 7. Intrusion detection to prevent malware installation and initial
foothold establishment.

####  5.5.1. Dynamic Environments & Real-time Detection

Intrusion detection models need to handle dynamic network environments, adapt
to changing network topologies, and efficiently process streaming data for
timely detection and response. Even though GNN models have significantly
improved detection accuracy, they still lack to adapt to dynamic environments
(lo2022graphsage, ; chang2021graph, ). Insufficient open-source authentic data
replicating the dynamic behavior remains a crucial blocker. Furthermore,
intrusion detection requires real-time monitoring and response to rapidly
evolving threats. For such, researchers propose advanced and complex GNN
models that proportionally increase computation time (hu2021using, ). On the
other hand, performance is a critical factor in responding to active threats.
Hence, computationally efficient yet robust hybrid model development remains
open to possibilities.

####  5.5.2. Trust & Explainability

Trust plays a crucial factor in effective IDS deployment, as it needs full
system access to work. Adversaries often target employed IDS systems as a part
of reconnaissance activity (corona2013adversarial, ). Furthermore, advanced
GNN model predictions have limited explainibility by security analysts
(lo2022graphsage, )– few models require either authentic training data
(wang2022threatrace, ) or synthesized data (chang2021graph, ) to train. Some
of the models do address explainability without prior knowledge
(ying2019gnnexplainer, ; yuan2021explainability, ), but fail to consider all
attributes equally. Hence, data poisoning or adversarial attacks remain a
significant threat to ensuring secure deployment and remain an active research
direction. Moreover, multi-facet explainability (neupane2022explainable, ) of
GNN-based intrusion detection models can provide insights into the decision-
making process, enhance trust, and facilitate collaboration between
distributed detection systems.

###  5.6. Malware Detection

Malware detection aims to identify and mitigate malicious software that poses
a threat to computer systems and networks. GNNs have emerged as a promising
technique for malware detection, leveraging the inherent graph structure of
malware to capture intricate process relationships and dependencies. For
example, most research focused on utilizing the malware application CFG
(hua2020classifying, ; feng2021android, ; wu2023deepcatra, ) to map and learn
the application’s behavior. Additionally, a few utilized network flow graphs
(NFG) (busch2021nf, ; zhou2020automating, ) to learn the network communication
pattern. However, there are still improvement scopes utilizing GNNs, discussed
following.

####  5.6.1. Dynamicity & Scalability

Malware detection systems operate on vast collections of malware samples,
requiring efficient processing and analysis. Developing scalable architectures
and algorithms that can handle large-scale system call graphs with real-time
detection is crucial for deployment. To allow GNN process large graphs,
researchers directed to incorporate advanced ML approaches like attention
mechanism, JK, etc., (wang2019heterogeneous, ; yan2019classifying, ;
hua2020classifying, ; weng2022graph, ). However, these often consume high
training time (yan2019classifying, ) and become scenario-specific and less
robust (yan2019classifying, ; li2022intelligent, ; feng2021android, ;
weng2022graph, ; li2021cross, ) to adapt with evolving malwares. Additionally,
low computational devices like mobile or IoT cannot execute such heavy graph
extraction and classifier models (mitra2023survey, ). Hence, to improve
performance with dynamic adaptability, more research is needed for powerful
yet efficient graph extractors and ML classifiers.

Figure 8. Malware detection and removal disrupts two-way communication
channels and prevents persistent control.

####  5.6.2. Relation Modeling & Knowledge Sharing

GNNs’ capability to leverage heterogeneous graphical data to learn
relationships between system-process interactions, such as function calls,
control flow, or data dependencies, allows effective capture of system
behavior information caused by malware samples and spot sophisticated
obfuscation techniques by polymorphic malware variants that would go
undetected with signature-based approaches. However, GNN being a relatively
novel research paradigm, even advanced models often suffer from completely
learning the complex graph obfuscation techniques like NOP insertion,
subroutine reordering, etc, (yan2019classifying, ; feng2021android, ;
mitra2023survey, ). A possible solution to allow different GNN and ML models
learn diverse relationships on the fly, is through knowledge sharing.
Encouraging collaboration and knowledge sharing among the deployed models can
foster the development of standardized cybersecurity knowledge graphs
(mitra2021combating, ), benchmarks, and evaluation metrics. Such efforts will
facilitate addressing diverse behavioral aspects in real-time learning with
collective advancements.

###  5.7. Report

Reporting and knowledge sharing play vital roles in cyber defense, as they
facilitate the dissemination of actionable intelligence, enable collaboration
among cybersecurity professionals, and enhance the collective understanding of
emerging threats. GNNs have demonstrated their effectiveness in modeling and
analyzing graph-structured data, making them a potential tool for processing
knowledge graphs and facilitating learned knowledge for defensive cyber
operations. However, the usage of GNN for knowledge sharing has not been given
much attention for a long time. Recently a few researchers have utilized the
benefit of GNN in fake data detection (dasgupta2021cybersecurity, ) and
knowledge sharing using federated learning (he2021fedgraphnn, ; mei2019sgnn,
). Following, we discuss the benefits, challenges, and future directions.

Figure 9. Reporting to disclose attack information and prevent similar attack
occurrences in future.

####  5.7.1. Data Integration & Collaboration

CTI is often accumulated from various sources, including network logs, threat
intelligence feeds, security incident reports, and vulnerability databases.
Integrating and fusing these heterogeneous data sources into a unified graph
representation while maintaining authenticity presents a significant
challenge. For authenticity, researchers proposed to use GNN for fake-data
identification (han2020graph, ; matsumoto2021propagation, ; xu2022evidence, ).
However, research on data integration from multiple sources is still left
behind. The absence of evenly distributed open-source datasets
(matsumoto2021propagation, ; xu2022evidence, ), the complexity of GNN models
(han2020graph, ), and high computation costs (dasgupta2021cybersecurity, ) act
as blockers and remain an open area of research. To mitigate this, researchers
can leverage transfer learning techniques with GNN to share acquired knowledge
among related domains or datasets (han2021adaptive, ).

####  5.7.2. Privacy & Security

Ensuring confidentiality, integrity, and controlled access to shared knowledge
while preserving individual and organizational privacy is crucial for
successful reporting and knowledge-sharing. Due to the distribution of
sensitive cyber defense knowledge across various sources, adversaries target
such communications to steal information. Transfer of sensitive cybersecurity
data and model gradients adhering to privacy and security concerns remains a
significant challenge. In generic research, Mei et al. proposed to safeguard
transferred knowledge by hiding the graph structure (mei2019sgnn, ). However,