@inproceedings{merzoukiGraphNeuralNetwork2025,

title = {Graph Neural Network Framework for Advanced Persistent Threat Detection in IIoT Environments},

author = {K. Merzouki and Y. Hadi and H. Elghazi and H. Moudoud and Z. A. El Houda},

editor = {El Bouanani F. and Ayoub F.},

url = {https://www.scopus.com/pages/publications/105032074689?origin=resultslist},

doi = {10.1109/CommNet68224.2025.11288886},

isbn = {979-833155781-2 (ISBN)},

year  = {2025},

date = {2025-01-01},

booktitle = {Int. Conf. Adv. Commun. Technol. Netw., CommNet - Proc.},

publisher = {Institute of Electrical and Electronics Engineers Inc.},

abstract = {The increasing reliance of industrial infrastructures on the Industrial Internet of Things (IIoT) has made them more vulnerable to complex cyberattacks, especially Advanced Persistent Threats (APTs). To recognize and analyze these multi-stage incursions, we require computational models that can capture both structural and temporal connections in IIoT network architectures. This paper presents a framework based on Graph Neural Networks (GNNs) for detecting and classifying APTs in IIoT settings. We use the CICAPT-IIoT2024 dataset, which provides realistic multi-phase APT attack scenarios. The approach models system components, network communications, and process interactions as nodes and edges in a dynamic graph, allowing for relational learning and context-aware feature extraction. The GNN architecture leverages graph connectivity patterns and message-passing techniques to identify attack phases with greater accuracy and robustness. Experimental results show that this method outperforms traditional deep learning techniques and ensemble methods, particularly in early-stage anomaly detection. This paper highlights the potential of graph-based learning as an effective way to enhance IIoT infrastructure security against the changing behaviors of advanced persistent threats. © 2025 IEEE.},

note = {Journal Abbreviation: Int. Conf. Adv. Commun. Technol. Netw., CommNet - Proc.},

keywords = {Advanced persistent threat, Advanced Persistent Threats, Anomaly detection, CICAPT-IIoT2024, Deep learning, extraction, Feature extraction, Features extraction, Graph Neural Networks, Graphic methods, IIoT, Industrial infrastructure, Industrial internet of thing, Learning systems, Message passing, Network architecture, Network frameworks, Network security, Relational learning, Threat detection},

pubstate = {published},

tppubtype = {inproceedings}

}

@inproceedings{murtaza_trace_2015,

title = {A trace abstraction approach for host-based anomaly detection},

author = {S. S. Murtaza and W. Khreich and A. Hamou-Lhadj and S. Gagnon},

url = {https://www.scopus.com/inward/record.uri?eid=2-s2.0-84953310135&doi=10.1109%2fCISDA.2015.7208644&partnerID=40&md5=30e47f711b04bc6c44be9f6daea5ebf1},

doi = {10.1109/CISDA.2015.7208644},

isbn = {978-146737557-3 (ISBN)},

year  = {2015},

date = {2015-01-01},

booktitle = {2015 IEEE Symposium on Computational Intelligence for Security and Defense Applications, CISDA 2015 - Proceedings},

pages = {170–177},

publisher = {Institute of Electrical and Electronics Engineers Inc.},

abstract = {High false alarm rates and execution times are among the key issues in host-based anomaly detection systems. In this paper, we investigate the use of trace abstraction techniques for reducing the execution time of anomaly detectors while keeping the same accuracy. The key idea is to represent system call traces as traces of kernel module interactions and use the resulting abstract traces as input to known anomaly detection techniques, such as STIDE (the Sequence Time-Delay Embedding) and HMM (Hidden Markov Models). We performed experiments on three datasets, namely, the traditional UNM dataset as well as two modern datasets, Firefox and ADFA-LD. The results show that kernel module traces can lead to similar or fewer false alarms and considerably smaller execution times compared to raw system call traces for host-based anomaly detection systems. © 2015 IEEE.},

note = {Journal Abbreviation: IEEE Symp. Comput. Intell. Secur. Def. Appl., CISDA - Proc.},

keywords = {Abstracting, Abstraction techniques, Alarm systems, Anomaly detection, Anomaly detection systems, Anomaly detector, Artificial intelligence, Chemical detection, Computer programming languages, Distributed computer systems, Errors, Hidden Markov models, Host-based Anomaly Detection System, Markov processes, Signal detection, Software dependability, Software security, System call traces, Time delay, Time delay embedding, Trace analysis, Trace Analysis and Abstraction},

pubstate = {published},

tppubtype = {inproceedings}

}

@inproceedings{murtazaTraceAbstractionApproach2015,

title = {A trace abstraction approach for host-based anomaly detection},

author = {S. S. Murtaza and W. Khreich and A. Hamou-Lhadj and S. Gagnon},

url = {https://www.scopus.com/inward/record.uri?eid=2-s2.0-84953310135&doi=10.1109%2fCISDA.2015.7208644&partnerID=40&md5=30e47f711b04bc6c44be9f6daea5ebf1},

doi = {10.1109/CISDA.2015.7208644},

isbn = {978-146737557-3 (ISBN)},

year  = {2015},

date = {2015-01-01},

booktitle = {2015 IEEE Symposium on Computational Intelligence for Security and Defense Applications, CISDA 2015 - Proceedings},

pages = {170–177},

publisher = {Institute of Electrical and Electronics Engineers Inc.},

abstract = {High false alarm rates and execution times are among the key issues in host-based anomaly detection systems. In this paper, we investigate the use of trace abstraction techniques for reducing the execution time of anomaly detectors while keeping the same accuracy. The key idea is to represent system call traces as traces of kernel module interactions and use the resulting abstract traces as input to known anomaly detection techniques, such as STIDE (the Sequence Time-Delay Embedding) and HMM (Hidden Markov Models). We performed experiments on three datasets, namely, the traditional UNM dataset as well as two modern datasets, Firefox and ADFA-LD. The results show that kernel module traces can lead to similar or fewer false alarms and considerably smaller execution times compared to raw system call traces for host-based anomaly detection systems. © 2015 IEEE.},

note = {Journal Abbreviation: IEEE Symp. Comput. Intell. Secur. Def. Appl., CISDA - Proc.},

keywords = {Abstracting, Abstraction techniques, Alarm systems, Anomaly detection, Anomaly detection systems, Anomaly detector, Artificial intelligence, Chemical detection, Computer programming languages, Distributed computer systems, Errors, Hidden Markov models, Host-based Anomaly Detection System, Markov processes, Signal detection, Software dependability, Software security, System call traces, Time delay, Time delay embedding, Trace analysis, Trace Analysis and Abstraction},

pubstate = {published},

tppubtype = {inproceedings}

}