To protect an organizations' endpoints from sophisticated cyberattacks,
advanced detection methods are required. In this research, we present
GCNetOmaly: a graph convolutional network (GCN)-based variational autoencoder
(VAE) anomaly detector trained on data that include connection events among
internal and external machines. As input, the proposed GCN-based VAE model
receives two matrices: (i) the normalized adjacency matrix, which represents
the connections among the machines, and (ii) the feature matrix, which includes
various features (demographic, statistical, process-related, and Node2vec
structural features) that are used to profile the individual nodes/machines.
After training the model on data collected for a predefined time window, the
model is applied on the same data; the reconstruction score obtained by the
model for a given machine then serves as the machine's anomaly score.
GCNetOmaly was evaluated on real, large-scale data logged by Carbon Black EDR
from a large financial organization's automated teller machines (ATMs) as well
as communication with Active Directory (AD) servers in two setups: unsupervised
and supervised. The results of our evaluation demonstrate GCNetOmaly's
effectiveness in detecting anomalous behavior of machines on unsupervised data.

GCNetOmaly 是一种基于图卷积网络和变分自编码器的异常检测器，用于保护组织的终端设备免受复杂的网络攻击，通过训练模型并应用于连接事件数据，以及机器之间的各种特征数据，该模型能够有效地检测异常行为。

使用图卷积网络检测异常网络通信模式

Detecting Anomalous Network Communication Patterns Using Graph  Convolutional Networks

The cybersecurity threat landscape has lately become overly complex. Threat
actors leverage weaknesses in the network and endpoint security in a very
coordinated manner to perpetuate sophisticated attacks that could bring down
the entire network and many critical hosts in the network. Increasingly
advanced deep and machine learning-based solutions have been used in threat
detection and protection. The application of these techniques has been reviewed
well in the scientific literature. Deep Reinforcement Learning has shown great
promise in developing AI-based solutions for areas that had earlier required
advanced human cognizance. Different techniques and algorithms under deep
reinforcement learning have shown great promise in applications ranging from
games to industrial processes, where it is claimed to augment systems with
general AI capabilities. These algorithms have recently also been used in
cybersecurity, especially in threat detection and endpoint protection, where
these are showing state-of-the-art results. Unlike supervised machines and deep
learning, deep reinforcement learning is used in more diverse ways and is
empowering many innovative applications in the threat defense landscape.
However, there does not exist any comprehensive review of these unique
applications and accomplishments. Therefore, in this paper, we intend to fill
this gap and provide a comprehensive review of the different applications of
deep reinforcement learning in cybersecurity threat detection and protection.

本文综述了深度强化学习在网络安全领域中的多种应用，尤其集中于网络威胁检测和终端保护。

深度强化学习应用于网络安全威胁检测和保护的综述

Deep Reinforcement Learning for Cybersecurity Threat Detection and Protection: A Review

Static malware analysis is well-suited to endpoint anti-virus systems as it
can be conducted quickly by examining the features of an executable piece of
code and matching it to previously observed malicious code. However, static
code analysis can be vulnerable to code obfuscation techniques. Behavioural
data collected during file execution is more difficult to obfuscate, but takes
a relatively long time to capture - typically up to 5 minutes, meaning the
malicious payload has likely already been delivered by the time it is detected.
In this paper we investigate the possibility of predicting whether or not an
executable is malicious based on a short snapshot of behavioural data. We find
that an ensemble of recurrent neural networks are able to predict whether an
executable is malicious or benign within the first 5 seconds of execution with
94% accuracy. This is the first time general types of malicious file have been
predicted to be malicious during execution rather than using a complete
activity log file post-execution, and enables cyber security endpoint
protection to be advanced to use behavioural data for blocking malicious
payloads rather than detecting them post-execution and having to repair the
damage.

本文研究了基于行为数据短快照的预测模型，发现一组递归神经网络能够在文件执行的前 5 秒内以 94% 的准确率预测文件是否为恶意文件。这使得终端安全防护能够使用行为数据阻止恶意负载，而不是检测后进行修复。