{"id":"https://openalex.org/W4416347671","doi":"https://doi.org/10.36227/techrxiv.176342124.45949049/v1","title":"Adaptive Graph Neural Network Framework for Real-Time Threat Detection in Critical Infrastructure Networks","display_name":"Adaptive Graph Neural Network Framework for Real-Time Threat Detection in Critical Infrastructure Networks","publication_year":2025,"publication_date":"2025-11-17","ids":{"openalex":"https://openalex.org/W4416347671","doi":"https://doi.org/10.36227/techrxiv.176342124.45949049/v1"},"language":"en","primary_location":{"id":"doi:10.36227/techrxiv.176342124.45949049/v1","doi":"https://doi.org/10.36227/techrxiv.176342124.45949049/v1","is_oa":true,"landing_page_url":"https://doi.org/10.36227/techrxiv.176342124.45949049/v1","pdf_url":"https://www.techrxiv.org/doi/pdf/10.36227/techrxiv.176342124.45949049","source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"posted-content"},"volume":null,"type":"preprint","is_traditional":true,"indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://www.techrxiv.org/doi/pdf/10.36227/techrxiv.176342124.45949049","any_repository_has_fulltext":null},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5109673336","display_name":"Kherarba Mohammed","orcid":"https://orcid.org/0009-0006-8009-2938","observed_orcids":["https://orcid.org/0009-0006-8009-2938"]},"institutions":[],"countries":[],"is_corresponding":true,"raw_author_name":"Kazeem Mohammed","raw_affiliation_strings":["Independent Researcher"],"raw_orcid":"https://orcid.org/0009-0006-8009-2938","affiliations":[{"raw_affiliation_string":"Independent Researcher","institution_ids":[]}]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":["https://openalex.org/A5109673336"],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9976000189781189,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9976000189781189,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.00039999998989515007,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12326","display_name":"Network Packet Processing and Optimization","score":0.0003000000142492354,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/cyberattack-detection","display_name":"cyberattack detection","score":0.7519999742507935},{"id":"https://openalex.org/keywords/critical-infrastructure-networks","display_name":"critical infrastructure networks","score":0.9900000095367432},{"id":"https://openalex.org/keywords/graph-neural-networks","display_name":"graph neural networks","score":0.8730000257492065},{"id":"https://openalex.org/keywords/dynamic-graphs","display_name":"dynamic graphs","score":0.8410000205039978},{"id":"https://openalex.org/keywords/attention-mechanism","display_name":"attention mechanism","score":0.6359999775886536},{"id":"https://openalex.org/keywords/multiscale-attention","display_name":"multi-scale attention","score":0.9470000267028809},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"anomaly detection","score":0.8759999871253967},{"id":"https://openalex.org/keywords/zero-day-attacks","display_name":"zero-day attacks","score":0.7350000143051147},{"id":"https://openalex.org/keywords/real-time-threat-detection","display_name":"real-time threat detection","score":0.7049999833106995},{"id":"https://openalex.org/keywords/hybrid-supervised-and-unsupervised-learning","display_name":"hybrid supervised and unsupervised learning","score":0.7910000085830688},{"id":"https://openalex.org/keywords/network-topology","display_name":"network topology","score":0.3109999895095825},{"id":"https://openalex.org/keywords/detection-latency","display_name":"detection delay","score":0.5619999766349792},{"id":"https://openalex.org/keywords/convergence-analysis","display_name":"convergence analysis","score":0.6650000214576721}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7950000166893005},{"id":"https://openalex.org/C31395832","wikidata":"https://www.wikidata.org/wiki/Q1318674","display_name":"Testbed","level":2,"score":0.715499997138977},{"id":"https://openalex.org/C29852176","wikidata":"https://www.wikidata.org/wiki/Q373338","display_name":"Critical infrastructure","level":2,"score":0.6317999958992004},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.5461999773979187},{"id":"https://openalex.org/C132525143","wikidata":"https://www.wikidata.org/wiki/Q141488","display_name":"Graph","level":2,"score":0.4819999933242798},{"id":"https://openalex.org/C50644808","wikidata":"https://www.wikidata.org/wiki/Q192776","display_name":"Artificial neural network","level":2,"score":0.45080000162124634},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.4291999936103821},{"id":"https://openalex.org/C2779033394","wikidata":"https://www.wikidata.org/wiki/Q5186733","display_name":"Critical infrastructure protection","level":3,"score":0.4027999937534332},{"id":"https://openalex.org/C199845137","wikidata":"https://www.wikidata.org/wiki/Q145490","display_name":"Network topology","level":2,"score":0.3977999985218048},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.3917999863624573},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.37450000643730164},{"id":"https://openalex.org/C120314980","wikidata":"https://www.wikidata.org/wiki/Q180634","display_name":"Distributed computing","level":1,"score":0.3418999910354614},{"id":"https://openalex.org/C2777303404","wikidata":"https://www.wikidata.org/wiki/Q759757","display_name":"Convergence (economics)","level":2,"score":0.3264999985694885},{"id":"https://openalex.org/C13540734","wikidata":"https://www.wikidata.org/wiki/Q5318996","display_name":"Dynamic network analysis","level":2,"score":0.3192000091075897},{"id":"https://openalex.org/C75564084","wikidata":"https://www.wikidata.org/wiki/Q5597085","display_name":"Graph embedding","level":3,"score":0.31470000743865967},{"id":"https://openalex.org/C82876162","wikidata":"https://www.wikidata.org/wiki/Q17096504","display_name":"Latency (audio)","level":2,"score":0.3140999972820282},{"id":"https://openalex.org/C14036430","wikidata":"https://www.wikidata.org/wiki/Q3736076","display_name":"Function (biology)","level":2,"score":0.3043999969959259},{"id":"https://openalex.org/C41608201","wikidata":"https://www.wikidata.org/wiki/Q980509","display_name":"Embedding","level":2,"score":0.2962000072002411},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.29580000042915344},{"id":"https://openalex.org/C88230418","wikidata":"https://www.wikidata.org/wiki/Q131476","display_name":"Graph theory","level":2,"score":0.2847999930381775},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.27790001034736633},{"id":"https://openalex.org/C136389625","wikidata":"https://www.wikidata.org/wiki/Q334384","display_name":"Supervised learning","level":3,"score":0.27730000019073486},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.2727000117301941},{"id":"https://openalex.org/C24590314","wikidata":"https://www.wikidata.org/wiki/Q336038","display_name":"Wireless sensor network","level":2,"score":0.25859999656677246}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.36227/techrxiv.176342124.45949049/v1","doi":"https://doi.org/10.36227/techrxiv.176342124.45949049/v1","is_oa":true,"landing_page_url":"https://doi.org/10.36227/techrxiv.176342124.45949049/v1","pdf_url":"https://www.techrxiv.org/doi/pdf/10.36227/techrxiv.176342124.45949049","source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"posted-content"}],"best_oa_location":{"id":"doi:10.36227/techrxiv.176342124.45949049/v1","doi":"https://doi.org/10.36227/techrxiv.176342124.45949049/v1","is_oa":true,"landing_page_url":"https://doi.org/10.36227/techrxiv.176342124.45949049/v1","pdf_url":"https://www.techrxiv.org/doi/pdf/10.36227/techrxiv.176342124.45949049","source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"posted-content"},"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/9","score":0.7197999954223633,"display_name":"Industry, innovation and infrastructure"}],"study_designs":[],"awards":[],"funders":[],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4416347671.pdf","grobid_xml":"https://content.openalex.org/works/W4416347671.grobid-xml"},"referenced_works_count":1,"referenced_works":["https://openalex.org/W2805516822"],"related_works":["https://openalex.org/W7117888383","https://openalex.org/W7118178847","https://openalex.org/W7117154667","https://openalex.org/W7162489195","https://openalex.org/W7217247634","https://openalex.org/W7117989680","https://openalex.org/W7220757814","https://openalex.org/W7128230156","https://openalex.org/W7163406970","https://openalex.org/W4287730659"],"abstract_inverted_index":{"Critical":[0],"infrastructure":[1,35,67,86,129,165],"networks":[2,46],"face":[3],"increasingly":[4],"sophisticated":[5],"cyber":[6],"threats":[7],"that":[8,33,57,83,132,167],"traditional":[9],"detection":[10,136,151,187],"methods":[11,144],"struggle":[12],"to":[13,47,85,153,197],"identify":[14],"in":[15,147,163],"real-time.":[16],"This":[17],"paper":[18],"presents":[19],"AGNN-TID":[20,62,133],"(Adaptive":[21],"Graph":[22],"Neural":[23],"Network":[24],"for":[25],"Threat":[26],"Intelligence":[27],"and":[28,41,69,89,123,182,191,200],"Detection),":[29],"a":[30,78,97,124],"novel":[31,98],"framework":[32,95,157],"models":[34],"systems":[36,169],"as":[37],"dynamic":[38],"temporal":[39,70],"graphs":[40],"employs":[42],"attention-based":[43],"graph":[44],"neural":[45],"detect":[48],"anomalous":[49],"patterns":[50,74,162],"indicative":[51],"of":[52,72,178],"cyberattacks.":[53],"Unlike":[54],"existing":[55],"approaches":[56],"treat":[58],"network":[59],"elements":[60],"independently,":[61],"captures":[63],"spatial":[64],"relationships":[65],"between":[66],"components":[68],"evolution":[71],"attack":[73,115,161],"simultaneously.":[75],"We":[76],"introduce":[77],"new":[79],"multi-scale":[80],"attention":[81],"mechanism":[82],"adapts":[84],"topology":[87],"changes":[88],"learns":[90],"hierarchical":[91],"threat":[92],"representations.":[93],"The":[94,156],"incorporates":[96],"loss":[99],"function":[100],"combining":[101],"supervised":[102],"classification":[103],"with":[104,112],"unsupervised":[105],"anomaly":[106],"detection,":[107],"enabling":[108],"effective":[109],"learning":[110],"even":[111],"limited":[113],"labeled":[114],"data.":[116],"Extensive":[117],"evaluation":[118],"on":[119,186],"three":[120],"datasets-NSL-KDD,":[121],"CICIDS2017,":[122],"newly":[125],"collected":[126],"Australian":[127],"critical":[128],"dataset":[130,193],"(AUS-CII-2024)-demonstrates":[131],"achieves":[134],"96.8%":[135],"accuracy":[137],"with2.3%":[138],"false":[139],"positive":[140],"rate,":[141],"outperforming":[142],"state-of-the-art":[143],"by":[145],"8.4%":[146],"F1-score":[148],"while":[149],"reducing":[150],"latency":[152],"under":[154],"180ms.":[155],"successfully":[158],"detected":[159],"zero-day":[160],"our":[164,179],"testbed":[166],"signature-based":[168],"missed":[170],"entirely.":[171],"Mathematical":[172],"analysis":[173],"proves":[174],"the":[175],"convergence":[176],"properties":[177],"training":[180],"algorithm":[181],"establishes":[183],"theoretical":[184],"bounds":[185],"performance.":[188],"Our":[189],"code":[190],"AUS-CII-2024":[192],"are":[194],"publicly":[195],"available":[196],"enable":[198],"reproducibility":[199],"future":[201],"research.":[202]},"counts_by_year":[],"updated_date":"2026-11-09T13:22:03.289127","created_date":"2025-11-18T00:00:00"}