Abstract:Deep neural networks (DNNs) have been found vulnerable to backdoor attacks, raising security concerns about their deployment in mission-critical applications. There are various approaches to detect backdoor attacks, however they all make certain assumptions about the target attack to be detected and require equal and huge numbers of clean and backdoor samples for training, which renders these detection methods quite limiting in real-world circumstances. This study proposes a novel one-class classification framework called One-class Graph Embedding Classification (OCGEC) that uses GNNs for model-level backdoor detection with only a little amount of clean data. First, we train thousands of tiny models as raw datasets from a small number of clean datasets. Following that, we design a ingenious model-to-graph method for converting the model's structural details and weight features into graph data. We then pre-train a generative self-supervised graph autoencoder (GAE) to better learn the features of benign models in order to detect backdoor models without knowing the attack strategy. After that, we dynamically combine the GAE and one-class classifier optimization goals to form classification boundaries that distinguish backdoor models from benign models. Our OCGEC combines the powerful representation capabilities of graph neural networks with the utility of one-class classification techniques in the field of anomaly detection. In comparison to other baselines, it achieves AUC scores of more than 98% on a number of tasks, which far exceeds existing methods for detection even when they rely on a huge number of positive and negative samples. Our pioneering application of graphic scenarios for generic backdoor detection can provide new insights that can be used to improve other backdoor defense tasks. Code is available at <a class="link-external link-https" href="https://github.com/jhy549/OCGEC" rel="external noopener nofollow">this https URL</a>.

A Graph Convolution Neural Network Based Method for Insider Threat Detection

Log2Graph: A graph convolution neural network based method for insider threat detection

Discovering Attack Scenarios Via Intrusion Alert Correlation Using Graph Convolutional Networks

Devil in Disguise: Breaching Graph Neural Networks Privacy through Infiltration

A High Accuracy and Adaptive Anomaly Detection Model With Dual-Domain Graph Convolutional Network for Insider Threat Detection

ASA: Adversary Situation Awareness Via Heterogeneous Graph Convolutional Networks.

Detect Insider Threat with Associated Session Graph

Interpretable Spatial–Temporal Graph Convolutional Network for System Log Anomaly Detection

Detecting Anomalous Network Communication Patterns Using Graph Convolutional Networks

Log2graphs: An Unsupervised Framework for Log Anomaly Detection with Efficient Feature Extraction

An Automated Alert Cross-Verification System with Graph Neural Networks for IDS Events

Identifying Backdoored Graphs in Graph Neural Network Training: An Explanation-Based Approach with Novel Metrics

Identifying Linked Fraudulent Activities Using GraphConvolution Network

Graph Neural Networks based Log Anomaly Detection and Explanation

Insider Threat Identification Using the Simultaneous Neural Learning of Multi-Source Logs

Log2vec: A Heterogeneous Graph Embedding Based Approach for Detecting Cyber Threats within Enterprise

LogGD: Detecting Anomalies from System Logs with Graph Neural Networks.

OCGEC: One-class Graph Embedding Classification for DNN Backdoor Detection

Network Intrusion Detection Based on Graph Neural Network and Ensemble Learning

LogGD:Detecting Anomalies from System Logs by Graph Neural Networks

Neighboring Backdoor Attacks on Graph Convolutional Network