{"id":"https://openalex.org/W7141607625","doi":"https://doi.org/10.1016/j.jisa.2026.104447","title":"Graph-based detection of multi-step attacks using graph convolutional networks","display_name":"Graph-based detection of multi-step attacks using graph convolutional networks","publication_year":2026,"publication_date":"2026-03-27","ids":{"openalex":"https://openalex.org/W7141607625","doi":"https://doi.org/10.1016/j.jisa.2026.104447"},"language":"en","primary_location":{"id":"doi:10.1016/j.jisa.2026.104447","is_oa":true,"landing_page_url":"https://doi.org/10.1016/j.jisa.2026.104447","pdf_url":null,"source":{"id":"https://openalex.org/S4210191536","display_name":"Journal of Information Security and Applications","issn_l":"2214-2126","issn":["2214-2126","2214-2134"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320990","host_organization_name":"Elsevier BV","host_organization_lineage":["https://openalex.org/P4310320990"],"host_organization_lineage_names":["Elsevier BV"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Information Security and Applications","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"hybrid","oa_url":"https://doi.org/10.1016/j.jisa.2026.104447","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5086601162","display_name":"SU Shaukat","orcid":null},"institutions":[{"id":"https://openalex.org/I133837150","display_name":"University of Huddersfield","ror":"https://ror.org/05t1h8f27","country_code":"GB","type":"education","lineage":["https://openalex.org/I133837150"]}],"countries":["GB"],"is_corresponding":true,"raw_author_name":"S.U. Shaukat","raw_affiliation_strings":["School of Computing and Engineering, University of Huddersfield, Queensgate Huddersfield, HD1 3DH, United Kingdom"],"raw_orcid":"https://orcid.org/0009-0000-5674-5499","affiliations":[{"raw_affiliation_string":"School of Computing and Engineering, University of Huddersfield, Queensgate Huddersfield, HD1 3DH, United Kingdom","institution_ids":["https://openalex.org/I133837150"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5053811883","display_name":"Saad Khan","orcid":"https://orcid.org/0000-0001-8613-8200"},"institutions":[{"id":"https://openalex.org/I133837150","display_name":"University of Huddersfield","ror":"https://ror.org/05t1h8f27","country_code":"GB","type":"education","lineage":["https://openalex.org/I133837150"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Saad Khan","raw_affiliation_strings":["School of Computing and Engineering, University of Huddersfield, Queensgate Huddersfield, HD1 3DH, United Kingdom"],"raw_orcid":"https://orcid.org/0000-0001-8613-8200","affiliations":[{"raw_affiliation_string":"School of Computing and Engineering, University of Huddersfield, Queensgate Huddersfield, HD1 3DH, United Kingdom","institution_ids":["https://openalex.org/I133837150"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5037686924","display_name":"Simon Parkinson","orcid":"https://orcid.org/0000-0002-1747-9914"},"institutions":[{"id":"https://openalex.org/I133837150","display_name":"University of Huddersfield","ror":"https://ror.org/05t1h8f27","country_code":"GB","type":"education","lineage":["https://openalex.org/I133837150"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Simon Parkinson","raw_affiliation_strings":["School of Computing and Engineering, University of Huddersfield, Queensgate Huddersfield, HD1 3DH, United Kingdom"],"raw_orcid":"https://orcid.org/0000-0002-1747-9914","affiliations":[{"raw_affiliation_string":"School of Computing and Engineering, University of Huddersfield, Queensgate Huddersfield, HD1 3DH, United Kingdom","institution_ids":["https://openalex.org/I133837150"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":["https://openalex.org/A5086601162"],"corresponding_institution_ids":["https://openalex.org/I133837150"],"apc_list":{"value":2860,"currency":"USD","value_usd":2860},"apc_paid":{"value":2860,"currency":"USD","value_usd":2860},"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.3616157,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"99","issue":null,"first_page":"104447","last_page":"104447"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.6057000160217285,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.6057000160217285,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.22699999809265137,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10714","display_name":"Software-Defined Networks and 5G","score":0.027499999850988388,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/denial-of-service-attack","display_name":"Denial-of-service attack","score":0.6607999801635742},{"id":"https://openalex.org/keywords/graph","display_name":"Graph","score":0.44600000977516174},{"id":"https://openalex.org/keywords/neighbourhood","display_name":"Neighbourhood (mathematics)","score":0.40700000524520874},{"id":"https://openalex.org/keywords/botnet","display_name":"Botnet","score":0.37549999356269836},{"id":"https://openalex.org/keywords/class","display_name":"Class (philosophy)","score":0.3537999987602234},{"id":"https://openalex.org/keywords/inference","display_name":"Inference","score":0.33079999685287476},{"id":"https://openalex.org/keywords/replication","display_name":"Replication (statistics)","score":0.323199987411499}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7860999703407288},{"id":"https://openalex.org/C38822068","wikidata":"https://www.wikidata.org/wiki/Q131406","display_name":"Denial-of-service attack","level":3,"score":0.6607999801635742},{"id":"https://openalex.org/C132525143","wikidata":"https://www.wikidata.org/wiki/Q141488","display_name":"Graph","level":2,"score":0.44600000977516174},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.43389999866485596},{"id":"https://openalex.org/C161677786","wikidata":"https://www.wikidata.org/wiki/Q2478475","display_name":"Neighbourhood (mathematics)","level":2,"score":0.40700000524520874},{"id":"https://openalex.org/C22735295","wikidata":"https://www.wikidata.org/wiki/Q317671","display_name":"Botnet","level":3,"score":0.37549999356269836},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.36320000886917114},{"id":"https://openalex.org/C2777212361","wikidata":"https://www.wikidata.org/wiki/Q5127848","display_name":"Class (philosophy)","level":2,"score":0.3537999987602234},{"id":"https://openalex.org/C120314980","wikidata":"https://www.wikidata.org/wiki/Q180634","display_name":"Distributed computing","level":1,"score":0.3384000062942505},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.3319999873638153},{"id":"https://openalex.org/C2776214188","wikidata":"https://www.wikidata.org/wiki/Q408386","display_name":"Inference","level":2,"score":0.33079999685287476},{"id":"https://openalex.org/C12590798","wikidata":"https://www.wikidata.org/wiki/Q3933199","display_name":"Replication (statistics)","level":2,"score":0.323199987411499},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.3158000111579895},{"id":"https://openalex.org/C116537","wikidata":"https://www.wikidata.org/wiki/Q2169973","display_name":"Service provider","level":3,"score":0.29089999198913574},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.2766000032424927},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.273499995470047},{"id":"https://openalex.org/C175154964","wikidata":"https://www.wikidata.org/wiki/Q380077","display_name":"Task analysis","level":3,"score":0.262800008058548},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.2599000036716461},{"id":"https://openalex.org/C88230418","wikidata":"https://www.wikidata.org/wiki/Q131476","display_name":"Graph theory","level":2,"score":0.2547000050544739},{"id":"https://openalex.org/C140547941","wikidata":"https://www.wikidata.org/wiki/Q7797194","display_name":"Threat model","level":2,"score":0.2526000142097473},{"id":"https://openalex.org/C93996380","wikidata":"https://www.wikidata.org/wiki/Q44127","display_name":"Server","level":2,"score":0.25130000710487366}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1016/j.jisa.2026.104447","is_oa":true,"landing_page_url":"https://doi.org/10.1016/j.jisa.2026.104447","pdf_url":null,"source":{"id":"https://openalex.org/S4210191536","display_name":"Journal of Information Security and Applications","issn_l":"2214-2126","issn":["2214-2126","2214-2134"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320990","host_organization_name":"Elsevier BV","host_organization_lineage":["https://openalex.org/P4310320990"],"host_organization_lineage_names":["Elsevier BV"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Information Security and Applications","raw_type":"journal-article"},{"id":"pmh:oai:pure.atira.dk:publications/152073b0-9444-4ccb-8627-5e06b0ee0c10","is_oa":true,"landing_page_url":"https://pure.hud.ac.uk/en/publications/152073b0-9444-4ccb-8627-5e06b0ee0c10","pdf_url":null,"source":{"id":"https://openalex.org/S4306402508","display_name":"Huddersfield Research Portal (University of Huddersfield)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I133837150","host_organization_name":"University of Huddersfield","host_organization_lineage":["https://openalex.org/I133837150"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Shaukat, S U, Khan, S & Parkinson, S 2026, 'Graph-based detection of multi-step attacks using graph convolutional networks', Journal of Information Security and Applications, vol. 99, 104447. https://doi.org/10.1016/j.jisa.2026.104447","raw_type":"info:eu-repo/semantics/publishedVersion"}],"best_oa_location":{"id":"doi:10.1016/j.jisa.2026.104447","is_oa":true,"landing_page_url":"https://doi.org/10.1016/j.jisa.2026.104447","pdf_url":null,"source":{"id":"https://openalex.org/S4210191536","display_name":"Journal of Information Security and Applications","issn_l":"2214-2126","issn":["2214-2126","2214-2134"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320990","host_organization_name":"Elsevier BV","host_organization_lineage":["https://openalex.org/P4310320990"],"host_organization_lineage_names":["Elsevier BV"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Information Security and Applications","raw_type":"journal-article"},"sustainable_development_goals":[{"display_name":"Industry, innovation and infrastructure","score":0.40117716789245605,"id":"https://metadata.un.org/sdg/9"}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":20,"referenced_works":["https://openalex.org/W2161225422","https://openalex.org/W2735837047","https://openalex.org/W2792591096","https://openalex.org/W2818789173","https://openalex.org/W2913909795","https://openalex.org/W2990225485","https://openalex.org/W2997677709","https://openalex.org/W3002573977","https://openalex.org/W3010844922","https://openalex.org/W3190895447","https://openalex.org/W3217253123","https://openalex.org/W4225596160","https://openalex.org/W4384563661","https://openalex.org/W4386318712","https://openalex.org/W4395020987","https://openalex.org/W4396654042","https://openalex.org/W4396733298","https://openalex.org/W4404629056","https://openalex.org/W4408322696","https://openalex.org/W4414079790"],"related_works":[],"abstract_inverted_index":{"Multi-step":[0,56],"attacks,":[1],"including":[2],"advanced":[3],"persistent":[4],"threats":[5,20,33],"(APT),":[6],"distributed":[7],"denial":[8],"of":[9,30,39,96,170,185,190],"service":[10],"(DDoS)":[11,101],"and":[12,78,110,124,182],"botnets,":[13],"are":[14,24],"still":[15],"among":[16],"the":[17,99,114,153,174,183],"most":[18],"sophisticated":[19],"that":[21,138],"modern":[22],"organisations":[23],"experiencing":[25],"today.":[26],"Most":[27],"traditional":[28],"methods":[29],"detecting":[31],"these":[32],"have":[34],"difficulties":[35],"identifying":[36],"unknown":[37,42],"types":[38],"events":[40],"from":[41,132],"sources.":[43],"In":[44,59],"this":[45,60,171],"study,":[46],"we":[47,62,151],"introduce":[48],"a":[49,83],"reproducible":[50],"GCN-based":[51],"event-log":[52],"correlation":[53],"framework":[54],"for":[55,65,76,163,196],"attack":[57],"detection.":[58],"work,":[61],"replicated":[63],"GC-PTransE":[64,71],"APT":[66],"reasoning":[67],"(Phase-1),":[68],"then":[69],"extended":[70],"into":[72],"practical":[73],"lightweight":[74],"variants":[75],"DDoS":[77],"Botnet":[79],"detection":[80],"(Phase-3)":[81],"using":[82,148],"common":[84],"PyG":[85],"graph":[86],"interface.":[87],"Our":[88],"models":[89],"demonstrated":[90],"significant":[91],"improvements":[92],"over":[93],"all":[94],"categories":[95],"attacks.":[97],"Using":[98],"CICIDS2017":[100],"dataset,":[102,117],"our":[103,133],"model":[104],"achieved":[105,119],"98%":[106,120],"accuracy,":[107,121],"100%":[108,122],"precision,":[109,123],"94%":[111],"recall.":[112,126],"With":[113],"CTU-13":[115],"(Botnet)":[116],"GETrans++":[118],"47%":[125],"The":[127],"72%":[128],"APT-relevance":[129],"hit":[130],"rate":[131],"Phase":[134],"1":[135],"replication":[136],"demonstrates":[137],"GCN":[139],"can":[140],"be":[141],"deployed,":[142],"providing":[143],"good":[144],"efficiency.":[145],"Finally,":[146],"by":[147],"neighbourhood":[149],"batching,":[150],"avoided":[152],"need":[154],"to":[155],"store":[156],"entire":[157],"graphs":[158],"in":[159,177],"memory,":[160],"thereby":[161],"allowing":[162],"deployments":[164],"on":[165],"commodity":[166],"CPU/GPU":[167],"architectures.":[168],"Limitations":[169],"study":[172],"included":[173],"class":[175],"imbalance":[176],"enterprise":[178],"logs":[179],"(Phase":[180],"2)":[181],"lack":[184],"heterogeneous":[186],"operational":[187],"datasets,":[188],"both":[189],"which":[191],"were":[192],"identified":[193],"as":[194],"areas":[195],"future":[197],"study.":[198]},"counts_by_year":[],"updated_date":"2026-07-23T08:03:31.855105","created_date":"2026-03-28T00:00:00"}