{"id":"https://openalex.org/W7160855953","doi":"https://doi.org/10.48550/arxiv.2605.07536","title":"GESR: Graph-Based Edge Semantic Reconstruction for Stealthy Communication Detection with Benign-Only Training","display_name":"GESR: Graph-Based Edge Semantic Reconstruction for Stealthy Communication Detection with Benign-Only Training","publication_year":2026,"publication_date":"2026-05-08","ids":{"openalex":"https://openalex.org/W7160855953","doi":"https://doi.org/10.48550/arxiv.2605.07536"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2605.07536","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.07536","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2605.07536","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5135852120","display_name":"Henghui Xu","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Xu, Henghui","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5135883301","display_name":"Yuchen Zhang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zhang, Yuchen","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5135903974","display_name":"Xiaobo Ma","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Ma, Xiaobo","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.8371999859809875,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.8371999859809875,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.02930000051856041,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.01810000091791153,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.6794999837875366},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.6072999835014343},{"id":"https://openalex.org/keywords/context","display_name":"Context (archaeology)","score":0.5719000101089478},{"id":"https://openalex.org/keywords/camouflage","display_name":"Camouflage","score":0.5687999725341797},{"id":"https://openalex.org/keywords/enhanced-data-rates-for-gsm-evolution","display_name":"Enhanced Data Rates for GSM Evolution","score":0.5651999711990356},{"id":"https://openalex.org/keywords/consistency","display_name":"Consistency (knowledge bases)","score":0.5141000151634216},{"id":"https://openalex.org/keywords/semantics","display_name":"Semantics (computer science)","score":0.41929998993873596},{"id":"https://openalex.org/keywords/anomaly","display_name":"Anomaly (physics)","score":0.4018999934196472}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7461000084877014},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.6794999837875366},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.6072999835014343},{"id":"https://openalex.org/C2779343474","wikidata":"https://www.wikidata.org/wiki/Q3109175","display_name":"Context (archaeology)","level":2,"score":0.5719000101089478},{"id":"https://openalex.org/C2776196576","wikidata":"https://www.wikidata.org/wiki/Q196113","display_name":"Camouflage","level":2,"score":0.5687999725341797},{"id":"https://openalex.org/C162307627","wikidata":"https://www.wikidata.org/wiki/Q204833","display_name":"Enhanced Data Rates for GSM Evolution","level":2,"score":0.5651999711990356},{"id":"https://openalex.org/C2776436953","wikidata":"https://www.wikidata.org/wiki/Q5163215","display_name":"Consistency (knowledge bases)","level":2,"score":0.5141000151634216},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.48820000886917114},{"id":"https://openalex.org/C184337299","wikidata":"https://www.wikidata.org/wiki/Q1437428","display_name":"Semantics (computer science)","level":2,"score":0.41929998993873596},{"id":"https://openalex.org/C12997251","wikidata":"https://www.wikidata.org/wiki/Q567560","display_name":"Anomaly (physics)","level":2,"score":0.4018999934196472},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.39410001039505005},{"id":"https://openalex.org/C94915269","wikidata":"https://www.wikidata.org/wiki/Q1834857","display_name":"Detector","level":2,"score":0.3700999915599823},{"id":"https://openalex.org/C192126672","wikidata":"https://www.wikidata.org/wiki/Q1068715","display_name":"Telecommunications network","level":2,"score":0.36149999499320984},{"id":"https://openalex.org/C165838908","wikidata":"https://www.wikidata.org/wiki/Q736777","display_name":"Calibration","level":2,"score":0.33480000495910645},{"id":"https://openalex.org/C132525143","wikidata":"https://www.wikidata.org/wiki/Q141488","display_name":"Graph","level":2,"score":0.31690001487731934},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.311599999666214},{"id":"https://openalex.org/C51632099","wikidata":"https://www.wikidata.org/wiki/Q3985153","display_name":"Training set","level":2,"score":0.2985000014305115},{"id":"https://openalex.org/C88796919","wikidata":"https://www.wikidata.org/wiki/Q1142907","display_name":"Backbone network","level":2,"score":0.2969000041484833},{"id":"https://openalex.org/C2780009758","wikidata":"https://www.wikidata.org/wiki/Q6804172","display_name":"Measure (data warehouse)","level":2,"score":0.2964000105857849},{"id":"https://openalex.org/C158251709","wikidata":"https://www.wikidata.org/wiki/Q354025","display_name":"Intrusion","level":2,"score":0.29350000619888306},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.290800005197525},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.27570000290870667},{"id":"https://openalex.org/C2777211547","wikidata":"https://www.wikidata.org/wiki/Q17141490","display_name":"Training (meteorology)","level":2,"score":0.2752000093460083},{"id":"https://openalex.org/C137524506","wikidata":"https://www.wikidata.org/wiki/Q2247688","display_name":"Anomaly-based intrusion detection system","level":3,"score":0.2678000032901764},{"id":"https://openalex.org/C120314980","wikidata":"https://www.wikidata.org/wiki/Q180634","display_name":"Distributed computing","level":1,"score":0.25699999928474426}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2605.07536","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.07536","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2605.07536","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.07536","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"display_name":"Peace, Justice and strong institutions","id":"https://metadata.un.org/sdg/16","score":0.6904305815696716}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Detecting":[0],"stealthy":[1],"malicious":[2],"communications":[3,18,99],"from":[4,123,142],"flow":[5],"logs":[6],"under":[7,103],"benign-only":[8,105],"training":[9,106],"remains":[10],"a":[11,92,104,206,212,234],"critical":[12],"challenge":[13],"in":[14],"network":[15,111],"security.":[16],"Malicious":[17],"often":[19],"camouflage":[20],"as":[21,113],"normal":[22],"traffic":[23],"like":[24],"standard":[25],"HTTPS":[26],"flows.":[27],"Conventional":[28],"intrusion":[29,239],"detectors":[30,59],"rely":[31],"strictly":[32,188],"on":[33,181],"known":[34],"labeled":[35],"attacks.":[36],"Alternatively,":[37],"they":[38],"score":[39],"flows":[40],"completely":[41],"independently.":[42],"These":[43,186],"approaches":[44],"fail":[45,74],"against":[46],"sparse":[47],"and":[48,100,183],"context-dependent":[49],"suspicious":[50,98],"activity.":[51],"To":[52,84],"capture":[53],"this":[54,149,174],"essential":[55],"context,":[56],"graph":[57],"anomaly":[58,163],"have":[60],"been":[61],"introduced":[62],"to":[63,68,75,137],"add":[64],"valuable":[65],"relational":[66],"information":[67],"the":[69,77,135,157],"analysis.":[70],"However,":[71],"existing":[72,220],"methods":[73,221],"test":[76],"structural":[78,125,151,159],"consistency":[79],"of":[80,201,209],"specific":[81],"communication":[82,115,140],"edges.":[83],"overcome":[85],"these":[86],"fundamental":[87],"limitations,":[88],"we":[89],"present":[90],"GESR,":[91],"novel":[93],"graph-based":[94],"framework":[95,136],"for":[96,173,237],"detecting":[97],"anomalous":[101],"hosts":[102],"setting.":[107],"GESR":[108,179,196,217],"models":[109],"complex":[110],"activity":[112],"attributed":[114],"graphs.":[116],"It":[117,165,203],"cleverly":[118],"reconstructs":[119],"edge":[120,231],"semantics":[121],"entirely":[122],"local":[124],"context":[126],"rather":[127],"than":[128],"isolated":[129],"features.":[130],"This":[131],"non-intuitive":[132],"design":[133],"forces":[134],"predict":[138],"expected":[139],"patterns":[141],"neighborhood":[143],"topologies.":[144],"Attackers":[145],"cannot":[146],"easily":[147],"manipulate":[148],"deep":[150],"dependency.":[152],"The":[153,226],"model":[154],"then":[155],"converts":[156],"resulting":[158],"inconsistencies":[160],"into":[161],"host-level":[162],"scores.":[164],"utilizes":[166],"robust":[167],"Median":[168],"Absolute":[169],"Deviation":[170],"(MAD)":[171],"calibration":[172],"final":[175],"step.":[176],"We":[177],"evaluate":[178],"extensively":[180],"CTU-13":[182],"CICIDS2017":[184],"datasets.":[185],"evaluations":[187],"impose":[189],"tight":[190],"false-positive":[191],"operating":[192],"constraints.":[193],"On":[194],"CICIDS2017,":[195],"achieves":[197],"an":[198],"outstanding":[199],"ROC-AUC":[200],"0.9753.":[202],"also":[204],"yields":[205],"high":[207],"TPR":[208],"0.8569":[210],"at":[211],"strict":[213],"5%":[214],"FPR":[215],"threshold.":[216],"consistently":[218],"outperforms":[219],"across":[222],"both":[223],"evaluated":[224],"benchmarks.":[225],"results":[227],"prove":[228],"that":[229],"structure-conditioned":[230],"reconstruction":[232],"is":[233],"credible":[235],"direction":[236],"practical":[238],"detection.":[240]},"counts_by_year":[],"updated_date":"2026-07-01T06:00:48.157686","created_date":"2026-05-12T00:00:00"}