{"id":"https://openalex.org/W3127247702","doi":"https://doi.org/10.1109/cloudnet51028.2020.9335789","title":"A Graph Neural Network Approach for Scalable and Dynamic IP Similarity in Enterprise Networks","display_name":"A Graph Neural Network Approach for Scalable and Dynamic IP Similarity in Enterprise Networks","publication_year":2020,"publication_date":"2020-11-09","ids":{"openalex":"https://openalex.org/W3127247702","doi":"https://doi.org/10.1109/cloudnet51028.2020.9335789","mag":"3127247702"},"language":"en","primary_location":{"id":"doi:10.1109/cloudnet51028.2020.9335789","is_oa":false,"landing_page_url":"https://doi.org/10.1109/cloudnet51028.2020.9335789","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2020 IEEE 9th International Conference on Cloud Networking (CloudNet)","raw_type":"proceedings-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5061675896","display_name":"Hazem M. Soliman","orcid":"https://orcid.org/0000-0001-9377-3528"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Hazem M. Soliman","raw_affiliation_strings":["RANK Software Inc., Toronto, Canada"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"RANK Software Inc., Toronto, Canada","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5073296709","display_name":"Geoff Salmon","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Geoff Salmon","raw_affiliation_strings":["RANK Software Inc., Toronto, Canada"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"RANK Software Inc., Toronto, Canada","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5050678141","display_name":"Du\u0161an Sovilj","orcid":"https://orcid.org/0009-0004-8205-7306"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Dusan Sovilj","raw_affiliation_strings":["RANK Software Inc., Toronto, Canada"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"RANK Software Inc., Toronto, Canada","institution_ids":[]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5103763484","display_name":"Mohan Rao","orcid":"https://orcid.org/0009-0004-5655-3015"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Mohan Rao","raw_affiliation_strings":["RANK Software Inc., Toronto, Canada"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"RANK Software Inc., Toronto, Canada","institution_ids":[]}]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":4,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.3241,"has_fulltext":false,"cited_by_count":2,"citation_normalized_percentile":{"value":0.65079517,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":89,"max":94},"biblio":{"volume":"521","issue":null,"first_page":"1","last_page":"6"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9995999932289124,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9995999932289124,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12326","display_name":"Network Packet Processing and Optimization","score":0.9988999962806702,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.9860000014305115,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8248589634895325},{"id":"https://openalex.org/keywords/server","display_name":"Server","score":0.7111760973930359},{"id":"https://openalex.org/keywords/scalability","display_name":"Scalability","score":0.6764113903045654},{"id":"https://openalex.org/keywords/similarity-measure","display_name":"Similarity measure","score":0.5746644735336304},{"id":"https://openalex.org/keywords/similarity","display_name":"Similarity (geometry)","score":0.5689746141433716},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.5481330752372742},{"id":"https://openalex.org/keywords/debugging","display_name":"Debugging","score":0.5477877259254456},{"id":"https://openalex.org/keywords/embedding","display_name":"Embedding","score":0.5270179510116577},{"id":"https://openalex.org/keywords/artificial-neural-network","display_name":"Artificial neural network","score":0.4523783326148987},{"id":"https://openalex.org/keywords/machine-learning","display_name":"Machine learning","score":0.44026079773902893},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.4276985228061676},{"id":"https://openalex.org/keywords/graph-embedding","display_name":"Graph embedding","score":0.42596501111984253},{"id":"https://openalex.org/keywords/computer-network","display_name":"Computer network","score":0.22493305802345276},{"id":"https://openalex.org/keywords/database","display_name":"Database","score":0.13803935050964355}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8248589634895325},{"id":"https://openalex.org/C93996380","wikidata":"https://www.wikidata.org/wiki/Q44127","display_name":"Server","level":2,"score":0.7111760973930359},{"id":"https://openalex.org/C48044578","wikidata":"https://www.wikidata.org/wiki/Q727490","display_name":"Scalability","level":2,"score":0.6764113903045654},{"id":"https://openalex.org/C2776517306","wikidata":"https://www.wikidata.org/wiki/Q29017317","display_name":"Similarity measure","level":2,"score":0.5746644735336304},{"id":"https://openalex.org/C103278499","wikidata":"https://www.wikidata.org/wiki/Q254465","display_name":"Similarity (geometry)","level":3,"score":0.5689746141433716},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.5481330752372742},{"id":"https://openalex.org/C168065819","wikidata":"https://www.wikidata.org/wiki/Q845566","display_name":"Debugging","level":2,"score":0.5477877259254456},{"id":"https://openalex.org/C41608201","wikidata":"https://www.wikidata.org/wiki/Q980509","display_name":"Embedding","level":2,"score":0.5270179510116577},{"id":"https://openalex.org/C50644808","wikidata":"https://www.wikidata.org/wiki/Q192776","display_name":"Artificial neural network","level":2,"score":0.4523783326148987},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.44026079773902893},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.4276985228061676},{"id":"https://openalex.org/C75564084","wikidata":"https://www.wikidata.org/wiki/Q5597085","display_name":"Graph embedding","level":3,"score":0.42596501111984253},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.22493305802345276},{"id":"https://openalex.org/C77088390","wikidata":"https://www.wikidata.org/wiki/Q8513","display_name":"Database","level":1,"score":0.13803935050964355},{"id":"https://openalex.org/C115961682","wikidata":"https://www.wikidata.org/wiki/Q860623","display_name":"Image (mathematics)","level":2,"score":0.0},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/cloudnet51028.2020.9335789","is_oa":false,"landing_page_url":"https://doi.org/10.1109/cloudnet51028.2020.9335789","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2020 IEEE 9th International Conference on Cloud Networking (CloudNet)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[{"display_name":"Quality Education","score":0.5699999928474426,"id":"https://metadata.un.org/sdg/4"}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":32,"referenced_works":["https://openalex.org/W1501139663","https://openalex.org/W1938755728","https://openalex.org/W1985987493","https://openalex.org/W2090934172","https://openalex.org/W2131571251","https://openalex.org/W2161830378","https://openalex.org/W2182819203","https://openalex.org/W2187089797","https://openalex.org/W2346737915","https://openalex.org/W2402299331","https://openalex.org/W2466206609","https://openalex.org/W2583862887","https://openalex.org/W2768242641","https://openalex.org/W2771641736","https://openalex.org/W2907492528","https://openalex.org/W2919115771","https://openalex.org/W2946121727","https://openalex.org/W2951559648","https://openalex.org/W2962767366","https://openalex.org/W2963460103","https://openalex.org/W3007332492","https://openalex.org/W3035166524","https://openalex.org/W3117762922","https://openalex.org/W4210257598","https://openalex.org/W4287829537","https://openalex.org/W4293651439","https://openalex.org/W4294558607","https://openalex.org/W6640598943","https://openalex.org/W6686096946","https://openalex.org/W6713265772","https://openalex.org/W6738964360","https://openalex.org/W6780045724"],"related_works":["https://openalex.org/W3036264823","https://openalex.org/W3206528106","https://openalex.org/W2123605750","https://openalex.org/W2912814903","https://openalex.org/W2088740331","https://openalex.org/W2950907416","https://openalex.org/W3038102983","https://openalex.org/W2082479932","https://openalex.org/W2932872266","https://openalex.org/W4281484020"],"abstract_inverted_index":{"Measuring":[0],"similarity":[1,23,50,155],"between":[2,28,156,174],"IP":[3,22,97,124],"addresses":[4],"is":[5,168],"an":[6,21,127,163],"important":[7],"task":[8],"in":[9],"the":[10,83,137,142,151,192],"daily":[11],"operations":[12],"of":[13,139,185],"any":[14],"enterprise":[15,164],"network.":[16],"Applications":[17],"that":[18],"depend":[19],"on":[20,82,141],"measure":[24,51,154],"include":[25],"measuring":[26],"correlation":[27],"security":[29],"alerts,":[30],"building":[31],"baselines":[32],"for":[33,70,95,123],"behavioral":[34],"modelling,":[35],"debugging":[36],"network":[37,131],"failures":[38],"and":[39,178],"tracking":[40],"persistent":[41],"attacks.":[42],"However,":[43,99],"IPs":[44,71,110],"do":[45],"not":[46,111],"have":[47,88,102],"a":[48,58,120],"natural":[49],"by":[52],"definition.":[53],"Deep":[54],"Learning":[55],"architectures":[56],"are":[57,64,188],"promising":[59],"solution":[60],"here":[61],"since":[62],"they":[63],"able":[65,169],"to":[66,79,106,153,170],"learn":[67],"numerical":[68],"representations":[69],"directly":[72],"from":[73,162],"data,":[74,144],"allowing":[75],"various":[76],"distance":[77],"measures":[78],"be":[80],"applied":[81],"calculated":[84],"representations.":[85],"Current":[86],"works":[87],"utilized":[89],"Natural":[90],"Language":[91],"Processing":[92],"(NLP)":[93],"techniques":[94],"learning":[96],"embeddings.":[98],"these":[100,186],"approaches":[101],"no":[103],"systematic":[104],"way":[105],"handle":[107],"out-of-vocabulary":[108],"(OOV)":[109],"seen":[112],"during":[113,191],"training.":[114],"In":[115],"this":[116],"paper,":[117],"we":[118],"propose":[119],"novel":[121],"approach":[122,135,167],"embedding":[125],"using":[126],"adapted":[128],"graph":[129],"neural":[130],"(GNN)":[132],"architecture.":[133],"This":[134],"has":[136],"advantages":[138],"working":[140],"raw":[143],"scalability":[145],"and,":[146],"most":[147],"importantly,":[148],"induction,":[149],"i.e.":[150],"ability":[152],"previously":[157],"unseen":[158],"IPs.":[159],"Using":[160],"data":[161],"network,":[165],"our":[166],"identify":[171],"high":[172],"similarities":[173],"local":[175],"DNS":[176,180],"servers":[177,181],"root":[179],"even":[182],"though":[183],"some":[184],"machines":[187],"never":[189],"encountered":[190],"training":[193],"phase.":[194]},"counts_by_year":[{"year":2023,"cited_by_count":1},{"year":2021,"cited_by_count":1}],"updated_date":"2026-06-11T09:08:48.828518","created_date":"2025-10-10T00:00:00"}