Graph-Based Anomaly Intelligence for Detecting Coordinated Cyber Attacks in Distributed Smart Computing Environments
Main Article Content
Abstract
The rapid integration of cloud platforms, edge nodes, Internet of Things devices, industrial controllers, intelligent gateways, autonomous systems, and enterprise services has created distributed computing environments in which security events are increasingly interdependent. Conventional intrusion detection systems frequently process network flows, authentication events, process activities, and device alerts as individual observations. Such an approach can overlook coordinated attacks in which each individual event appears relatively benign while the collective sequence reveals lateral movement, privilege escalation, command-and-control activity, or multi-stage compromise. This study proposes a graph-based anomaly intelligence framework for identifying coordinated cyber attacks in distributed smart computing environments. The proposed framework represents devices, users, services, processes, communication endpoints, and security events as interconnected graph entities, while temporal, behavioral, and contextual information is associated with graph relationships. A dynamic graph construction mechanism continuously updates the security representation as communication patterns and system states evolve. Graph-based representation learning is subsequently employed to capture structural dependencies and behavioral deviations that may not be visible through independent event analysis. The framework combines node-level, edge-level, and subgraph-level anomaly evidence to generate an integrated anomaly intelligence score. Temporally related suspicious entities are then correlated to construct candidate attack paths and coordinated attack groups. The resulting approach is intended to distinguish isolated abnormalities from multi-entity attack campaigns. The framework accommodates heterogeneous security telemetry and changing network topologies while reducing dependence on manually defined signatures. Particular emphasis is placed on temporal consistency, false-positive control, scalability, explainability, and attack-path reconstruction. The proposed architecture is applicable to smart IoT infrastructures, edge computing environments, industrial networks, intelligent transportation systems, cloud platforms, and distributed enterprise systems. The study establishes a methodological foundation for adaptive cyber-defense systems that use structural and behavioral relationships to identify coordinated and multi-stage threats.
Article Details
Section
This work is licensed under a Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International License.
How to Cite
References
[1]. T. N. Kipf and M. Welling, “Semi-Supervised Classification with Graph Convolutional Networks,” International Conference on Learning Representations (ICLR), 2017. The paper established the widely used GCN architecture for learning representations from graph structure and node attributes.
[2]. P. Veličković, G. Cucurull, A. Casanova, A. Romero, P. Liò, and Y. Bengio, “Graph Attention Networks,” International Conference on Learning Representations (ICLR), 2018. GAT introduced attention-based neighborhood aggregation, allowing different neighboring nodes to receive different learned weights.
[3]. W. L. Hamilton, R. Ying, and J. Leskovec, “Inductive Representation Learning on Large Graphs,” Advances in Neural Information Processing Systems, vol. 30, pp. 1024–1034, 2017. The work introduced GraphSAGE for inductive representation learning and generalization to previously unseen nodes.
[4]. P. Veličković, W. Fedus, W. L. Hamilton, P. Liò, Y. Bengio, and R. D. Hjelm, “Deep Graph Infomax,” International Conference on Learning Representations (ICLR), 2019. The method provides an unsupervised mechanism for learning informative node representations from graph structure.
[5]. W. Zhao, G. Xu, Z. Cui, S. Luo, C. Long, and T. Zhang, “Deep Graph Structural Infomax,” Proceedings of the AAAI Conference on Artificial Intelligence, vol. 37, no. 4, 2023, doi: 10.1609/aaai.v37i4.25618.
[6]. L. Akoglu, M. McGlohon, and C. Faloutsos, “OddBall: Spotting Anomalies in Weighted Graphs,” Pacific-Asia Conference on Knowledge Discovery and Data Mining, 2010.
[7]. B. Perozzi, R. Al-Rfou, and S. Skiena, “DeepWalk: Online Learning of Social Representations,” Proceedings of the 20th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, pp. 701–710, 2014.
[8]. A. Eswaran, S. Faloutsos, S. Madden, and R. C. Stonebraker, “SpotLight: Detecting Anomalies in Streaming Graphs,” Proceedings of the 24th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, pp. 1037–1045, 2018.
[9]. L. Manzoor, S. Milajerdi, and C. Akoglu, “Fast Memory-Efficient Anomaly Detection in Streaming Heterogeneous Graphs,” Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, pp. 1035–1044, 2016. StreamSpot was designed for heterogeneous streaming graphs and real-time anomaly scoring.
[10]. K. Ding, J. Li, N. Agarwal, and H. Liu, “Inductive Anomaly Detection on Attributed Networks,” Proceedings of the 29th International Joint Conference on Artificial Intelligence, 2020.
[11]. Z. Ding, Y. Huang, Q. Wang, and Y. Tang, “Deep Anomaly Detection on Attributed Networks,” Proceedings of the 2019 SIAM International Conference on Data Mining, pp. 594–602, 2019. The approach uses graph convolutional autoencoding to jointly model graph structure and node attributes for anomaly detection.
[12]. W. W. Lo, S. Layeghy, M. Sarhan, M. Gallagher, and M. Portmann, “E-GraphSAGE: A Graph Neural Network Based Intrusion Detection System for IoT,” IEEE/IFIP Network Operations and Management Symposium (NOMS), 2022, doi: 10.1109/NOMS54207.2022.9789878. The method incorporates edge features and graph topology for network intrusion detection using flow-based IoT data.
[13]. S. Saidane, F. Telch, K. Shahin, and F. Granelli, “Deep GraphSAGE Enhancements for Intrusion Detection: Analyzing Attention Mechanisms and GCN Integration,” Journal of Information Security and Applications, vol. 90, Art. 104013, 2025, doi: 10.1016/j.jisa.2025.104013.
[14]. R. Xu, G. Wu, W. Wang, X. Gao, A. He, and Z. Zhang, “Applying Self-Supervised Learning to Network Intrusion Detection for Network Flows with Graph Neural Network,” Computer Networks, vol. 248, Art. 110495, 2024, doi: 10.1016/j.comnet.2024.110495. The study investigates self-supervised graph representation learning for network-flow intrusion detection.
[15]. A. S. Ahanger et al., “Advanced Intrusion Detection in Internet of Things Using Graph Attention Networks,” Scientific Reports, vol. 15, Art. 9831, 2025, doi: 10.1038/s41598-025-94624-8. The research constructs graph representations of IoT traffic and applies GAT-based intrusion detection.
[16]. “Edge-Featured Multi-Hop Attention Graph Neural Network for Intrusion Detection System,” Computers & Security, vol. 148, Art. 104132, 2025, doi: 10.1016/j.cose.2024.104132. The approach combines edge information and multi-hop attention to represent network traffic relationships.
[17]. “BS-GAT: A Network Intrusion Detection System Based on Graph Neural Network for Edge Computing,” Cybersecurity, 2024. The work investigates behavior-similarity graph construction and graph attention for intrusion detection in edge environments.
[18]. “A Survey on Graph Neural Networks for Intrusion Detection Systems: Methods, Trends and Challenges,” Computers & Security, vol. 141, Art. 103821, 2024, doi: 10.1016/j.cose.2024.103821. The survey categorizes GNN-based IDS research according to graph construction, network design, and deployment approaches.
[19]. E. Yagmur, C. Kocak, and A. Keles, “Graph Neural Networks and Graph Autoencoders for Intrusion Detection Systems: A Systematic Review, Taxonomy and Comparative Analysis,” Computer Networks, vol. 288, Art. 112598, 2026, doi: 10.1016/j.comnet.2026.112598.
[20]. M. R. Ismaeli Taba, H. Zare, and S. Rakhshani, “Graph Neural Networks for Network Intrusion Detection Systems: A Comprehensive Survey, Taxonomy, and Empirical Evaluation,” Artificial Intelligence Review, 2026. The study examines graph construction, node/edge detection, static and dynamic graphs, and GNN learning paradigms for IDS.
[21]. Koneni, C., S. Lokula, and L. Panjiyar. "A Cloud-Native Approach to Statistical Anomaly Detection and Automated Data Quality Validation." International Journal of Data Science and IoT Management System 4.4 (2025): 533-543
[22]. W. Ren, X. Song, Y. Hong, Y. Lei, J. Yao, Y. Du, and W. Li et al., “APT Attack Detection Based on Graph Convolutional Neural Networks,” International Journal of Computational Intelligence Systems, vol. 16, Art. 184, 2023. The authors construct an APT behavior knowledge graph from vulnerability and attack-related information and apply GCN-based detection.
[23]. J. Zhou, Z. Xu, A. M. Rush, and M. Yu, “Automating Botnet Detection with Graph Neural Networks,” arXiv preprint arXiv:2003.06344, 2020. The work models communication structures to distinguish centralized and decentralized botnet patterns.
[24]. S. K. Nalluri, V. T. Bathini and V. K. B. Parasaram, "AI-Augmented Manufacturing Execution Systems for Precision Healthcare: A Scalable Framework for Smart Genomic and Proteomic Production," 2026 IEEE 2nd International Conference on Secure IoT, Assured and Trusted Computing (SATC), Houston, TX, USA, 2026, pp. 1-6, doi: 10.1109/SATC69565.2026.11542384.
[25]. X. Meng, B. Lang, Y. Yan, and Y. Liu, “Deeply Fused Flow and Topology Features for Botnet Detection Based on a Pretrained GCN,” Computer Communications, vol. 233, Art. 108084, 2025, doi: 10.1016/j.comcom.2025.108084. The approach combines traffic-flow characteristics with network topology for botnet detection.
[26]. C. Koneni and S. Lokula, "Evidence-Quality Telemetry for Cloud Incident Response: Detecting Gaps, Drift, and Integrity Failures in Large-Scale Observability Pipelines," 2026 14th International Symposium on Digital Forensics and Security (ISDFS), Boston, MA, USA, 2026, pp. 1-6, doi: 10.1109/ISDFS69419.2026.11459097.
[27]. M. Pérez-Gomariz, F. Cerdán-Cartagena, and J. García, “LM-Hunter: An NLP-Powered Graph Method for Detecting Adversary Lateral Movements in APT Cyber-Attacks at Scale,” Computer Networks, 2025, Art. 111181, doi: 10.1016/j.comnet.2025.111181. The work addresses graph-based identification of lateral movement within APT campaigns.
[28]. H. B. Ahmad, H. Gao, and N. Latif, “Graph Intelligence for IoT and CPS Security: From Connectivity Patterns to Cyber-Physical Reasoning,” Computer Science Review, vol. 61, Art. 100978, 2026, doi: 10.1016/j.cosrev.2026.100978. The paper examines graph intelligence for interconnected IoT and cyber-physical environments in which localized compromises can propagate through system dependencies.