Slide
Centre Interdisciplinaire
de Recherche et d’Innovation
en Cybersécurité et Société
de Recherche et d’Innovation
en Cybersécurité et Société
1.
Gapski, M. C. B.; Kawai, V. A. S.; Leticio, G. R.; Valem, L. P.; Pedronette, D. C. G.; Allili, M. S.
Graph Neural Networks for Semi-Supervised Image Classification with Multi-Feature Aggregation Article de journal
Dans: Journal of the Brazilian Computer Society, vol. 32, no 1, p. 1731–1754, 2026, ISSN: 01046500 (ISSN).
Résumé | Liens | BibTeX | Étiquettes: Classification accuracy, Convolution, Convolutional neural networks, extraction, Feature extraction, Feature extractor, Feature Fusion, Feature representation, Features fusions, Graph Neural Networks, Graph representation, Graph structures, Graph theory, Graphic methods, Image classification, Labeled data, Rank Aggregation, Semi-supervised, Semi-supervised image classification, Supervised image classifications, Textures
@article{gapskiGraphNeuralNetworks2026,
title = {Graph Neural Networks for Semi-Supervised Image Classification with Multi-Feature Aggregation},
author = {M. C. B. Gapski and V. A. S. Kawai and G. R. Leticio and L. P. Valem and D. C. G. Pedronette and M. S. Allili},
url = {https://www.scopus.com/pages/publications/105045179876?origin=resultslist},
doi = {10.5753/jbcs.2026.5880},
issn = {01046500 (ISSN)},
year = {2026},
date = {2026-01-01},
journal = {Journal of the Brazilian Computer Society},
volume = {32},
number = {1},
pages = {1731–1754},
publisher = {Brazilian Computing Society},
abstract = {Feature extraction involves the identification and extraction of salient characteristics or patterns, including edges, textures, shapes, and color attributes. Contemporary feature extractors predominantly leverage deep learning architectures, such as Convolutional Neural Networks (CNNs) and Vision Transformers (VITs). The availability of diverse feature extractors in the literature provides a wide range of feature representations. Features extracted from an image depend on the specific application, the chosen extractor, and its configuration. Therefore, integrating complementary information by combining distinct extractors offers a promising way to enhance performance. Graph Neural Networks (GNNs), particularly Graph Convolutional Networks (GCNs), have emerged as powerful and widely adopted approaches for semi-supervised image classification, as they effectively leverage both labeled and unlabeled data while exploiting the underlying graph structures that capture relationships among samples. This study proposes a novel approach for GNNs in scenarios where labeled data is scarce, by integrating diverse sets of feature and graph representations derived from various extractors in classification scenarios. Experimental investigations were conducted, encompassing combinations of distinct feature and graph extractors, as well as rank aggregation strategies. The primary contributions of this work are underscored by the experimental findings, which demonstrate that the strategic combination of feature and graph representations, coupled with the application of manifold learning for graph processing, leads to significant improvements in classification accuracy across the majority of experimental conditions. Furthermore, the utilization of rank aggregation techniques to integrate features from different extractors was shown to enhance classification accuracy. © 2026, Brazilian Computing Society. All rights reserved.},
keywords = {Classification accuracy, Convolution, Convolutional neural networks, extraction, Feature extraction, Feature extractor, Feature Fusion, Feature representation, Features fusions, Graph Neural Networks, Graph representation, Graph structures, Graph theory, Graphic methods, Image classification, Labeled data, Rank Aggregation, Semi-supervised, Semi-supervised image classification, Supervised image classifications, Textures},
pubstate = {published},
tppubtype = {article}
}
Feature extraction involves the identification and extraction of salient characteristics or patterns, including edges, textures, shapes, and color attributes. Contemporary feature extractors predominantly leverage deep learning architectures, such as Convolutional Neural Networks (CNNs) and Vision Transformers (VITs). The availability of diverse feature extractors in the literature provides a wide range of feature representations. Features extracted from an image depend on the specific application, the chosen extractor, and its configuration. Therefore, integrating complementary information by combining distinct extractors offers a promising way to enhance performance. Graph Neural Networks (GNNs), particularly Graph Convolutional Networks (GCNs), have emerged as powerful and widely adopted approaches for semi-supervised image classification, as they effectively leverage both labeled and unlabeled data while exploiting the underlying graph structures that capture relationships among samples. This study proposes a novel approach for GNNs in scenarios where labeled data is scarce, by integrating diverse sets of feature and graph representations derived from various extractors in classification scenarios. Experimental investigations were conducted, encompassing combinations of distinct feature and graph extractors, as well as rank aggregation strategies. The primary contributions of this work are underscored by the experimental findings, which demonstrate that the strategic combination of feature and graph representations, coupled with the application of manifold learning for graph processing, leads to significant improvements in classification accuracy across the majority of experimental conditions. Furthermore, the utilization of rank aggregation techniques to integrate features from different extractors was shown to enhance classification accuracy. © 2026, Brazilian Computing Society. All rights reserved.
2.
Attoumi, H.; Tajeuna, E. G.; Allili, M. S.
Causal Graph Modeling of Network Traffic for Early Cyberattack Prediction Article d'actes
Dans: R., Al-Mallah; F., Cuppens; S., Ayed; F., Sailhan; J., Garcia-Alfaro (Ed.): Lect. Notes Comput. Sci., p. 167–183, Springer Science and Business Media Deutschland GmbH, 2026, ISBN: 03029743 (ISSN); 978-303220025-9 (ISBN), (Journal Abbreviation: Lect. Notes Comput. Sci.).
Résumé | Liens | BibTeX | Étiquettes: Attack prediction, Bipartite graphs, Causal graph, Causal network, Co-evolving time series, Cyber-attacks, Forecasting, Graph model, Graph Neural Networks, Graph theory, Network traffic, Prediction models, Time series, Times series
@inproceedings{attoumiCausalGraphModeling2026,
title = {Causal Graph Modeling of Network Traffic for Early Cyberattack Prediction},
author = {H. Attoumi and E. G. Tajeuna and M. S. Allili},
editor = {Al-Mallah R. and Cuppens F. and Ayed S. and Sailhan F. and Garcia-Alfaro J.},
url = {https://www.scopus.com/pages/publications/105040543052?origin=resultslist},
doi = {10.1007/978-3-032-20026-6_10},
isbn = {03029743 (ISSN); 978-303220025-9 (ISBN)},
year = {2026},
date = {2026-01-01},
booktitle = {Lect. Notes Comput. Sci.},
volume = {16403 LNCS},
pages = {167–183},
publisher = {Springer Science and Business Media Deutschland GmbH},
abstract = {We propose a causal-graph forecasting framework for early cyberattack prediction that integrates causal network modeling with dynamic bipartite graph–based time series forecasting. Our method captures both the cause–effect structure of network traffic and the co-evolving, non-stationary dynamics of attack-related signals. Network entities are represented as nodes, while edges encode directional causal influences inferred from traffic flows. To model evolving dependencies, we approximate each traffic series over contiguous intervals with parametric functions and construct temporal bipartite graphs that link these models to time series, revealing shared latent patterns and context-driven relationships. This hybrid representation enables adaptive model selection and accurate forecasting of malicious behavior before it escalates. Experiments on benchmark of network traces show that our approach delivers early, interpretable, and highly accurate cyberattack predictions. © The Author(s), under exclusive license to Springer Nature Switzerland AG 2026.},
note = {Journal Abbreviation: Lect. Notes Comput. Sci.},
keywords = {Attack prediction, Bipartite graphs, Causal graph, Causal network, Co-evolving time series, Cyber-attacks, Forecasting, Graph model, Graph Neural Networks, Graph theory, Network traffic, Prediction models, Time series, Times series},
pubstate = {published},
tppubtype = {inproceedings}
}
We propose a causal-graph forecasting framework for early cyberattack prediction that integrates causal network modeling with dynamic bipartite graph–based time series forecasting. Our method captures both the cause–effect structure of network traffic and the co-evolving, non-stationary dynamics of attack-related signals. Network entities are represented as nodes, while edges encode directional causal influences inferred from traffic flows. To model evolving dependencies, we approximate each traffic series over contiguous intervals with parametric functions and construct temporal bipartite graphs that link these models to time series, revealing shared latent patterns and context-driven relationships. This hybrid representation enables adaptive model selection and accurate forecasting of malicious behavior before it escalates. Experiments on benchmark of network traces show that our approach delivers early, interpretable, and highly accurate cyberattack predictions. © The Author(s), under exclusive license to Springer Nature Switzerland AG 2026.
3.
Merzouki, K.; Hadi, Y.; Elghazi, H.; Moudoud, H.; Houda, Z. A. El
Graph Neural Network Framework for Advanced Persistent Threat Detection in IIoT Environments Article d'actes
Dans: F., El Bouanani; F., Ayoub (Ed.): Int. Conf. Adv. Commun. Technol. Netw., CommNet - Proc., Institute of Electrical and Electronics Engineers Inc., 2025, ISBN: 979-833155781-2 (ISBN), (Journal Abbreviation: Int. Conf. Adv. Commun. Technol. Netw., CommNet - Proc.).
Résumé | Liens | BibTeX | Étiquettes: Advanced persistent threat, Advanced Persistent Threats, Anomaly detection, CICAPT-IIoT2024, Deep learning, extraction, Feature extraction, Features extraction, Graph Neural Networks, Graphic methods, IIoT, Industrial infrastructure, Industrial internet of thing, Learning systems, Message passing, Network architecture, Network frameworks, Network security, Relational learning, Threat detection
@inproceedings{merzoukiGraphNeuralNetwork2025,
title = {Graph Neural Network Framework for Advanced Persistent Threat Detection in IIoT Environments},
author = {K. Merzouki and Y. Hadi and H. Elghazi and H. Moudoud and Z. A. El Houda},
editor = {El Bouanani F. and Ayoub F.},
url = {https://www.scopus.com/pages/publications/105032074689?origin=resultslist},
doi = {10.1109/CommNet68224.2025.11288886},
isbn = {979-833155781-2 (ISBN)},
year = {2025},
date = {2025-01-01},
booktitle = {Int. Conf. Adv. Commun. Technol. Netw., CommNet - Proc.},
publisher = {Institute of Electrical and Electronics Engineers Inc.},
abstract = {The increasing reliance of industrial infrastructures on the Industrial Internet of Things (IIoT) has made them more vulnerable to complex cyberattacks, especially Advanced Persistent Threats (APTs). To recognize and analyze these multi-stage incursions, we require computational models that can capture both structural and temporal connections in IIoT network architectures. This paper presents a framework based on Graph Neural Networks (GNNs) for detecting and classifying APTs in IIoT settings. We use the CICAPT-IIoT2024 dataset, which provides realistic multi-phase APT attack scenarios. The approach models system components, network communications, and process interactions as nodes and edges in a dynamic graph, allowing for relational learning and context-aware feature extraction. The GNN architecture leverages graph connectivity patterns and message-passing techniques to identify attack phases with greater accuracy and robustness. Experimental results show that this method outperforms traditional deep learning techniques and ensemble methods, particularly in early-stage anomaly detection. This paper highlights the potential of graph-based learning as an effective way to enhance IIoT infrastructure security against the changing behaviors of advanced persistent threats. © 2025 IEEE.},
note = {Journal Abbreviation: Int. Conf. Adv. Commun. Technol. Netw., CommNet - Proc.},
keywords = {Advanced persistent threat, Advanced Persistent Threats, Anomaly detection, CICAPT-IIoT2024, Deep learning, extraction, Feature extraction, Features extraction, Graph Neural Networks, Graphic methods, IIoT, Industrial infrastructure, Industrial internet of thing, Learning systems, Message passing, Network architecture, Network frameworks, Network security, Relational learning, Threat detection},
pubstate = {published},
tppubtype = {inproceedings}
}
The increasing reliance of industrial infrastructures on the Industrial Internet of Things (IIoT) has made them more vulnerable to complex cyberattacks, especially Advanced Persistent Threats (APTs). To recognize and analyze these multi-stage incursions, we require computational models that can capture both structural and temporal connections in IIoT network architectures. This paper presents a framework based on Graph Neural Networks (GNNs) for detecting and classifying APTs in IIoT settings. We use the CICAPT-IIoT2024 dataset, which provides realistic multi-phase APT attack scenarios. The approach models system components, network communications, and process interactions as nodes and edges in a dynamic graph, allowing for relational learning and context-aware feature extraction. The GNN architecture leverages graph connectivity patterns and message-passing techniques to identify attack phases with greater accuracy and robustness. Experimental results show that this method outperforms traditional deep learning techniques and ensemble methods, particularly in early-stage anomaly detection. This paper highlights the potential of graph-based learning as an effective way to enhance IIoT infrastructure security against the changing behaviors of advanced persistent threats. © 2025 IEEE.