论文标题
XG机器人：可解释的深图神经网络，用于僵尸网络检测和取证
XG-BoT: An Explainable Deep Graph Neural Network for Botnet Detection and Forensics
论文作者
论文摘要
在本文中，我们提出了XG-Bot，这是一种可解释的深层图神经网络模型，用于僵尸网络淋巴结检测。提出的模型包括僵尸网络检测器和自动取证的解释器。 XG机器人检测器可以有效地检测大型网络中的恶意僵尸网络节点。具体而言，它利用与图同构网络的分组可逆残差连接从僵尸网络通信图中学习表达性节点表示。基于XG-Bot中Gnnexplainer和显着性图的解释器可以通过突出可疑网络流和相关的僵尸网络节点来执行自动网络取证。我们使用现实世界中的大规模僵尸网络网络图数据集评估了XG-BOT。总体而言，就关键评估指标而言，XG-Bot的表现优于最先进的方法。此外，我们证明XG-Bot解释器可以为自动网络取证生成有用的解释。
In this paper, we propose XG-BoT, an explainable deep graph neural network model for botnet node detection. The proposed model comprises a botnet detector and an explainer for automatic forensics. The XG-BoT detector can effectively detect malicious botnet nodes in large-scale networks. Specifically, it utilizes a grouped reversible residual connection with a graph isomorphism network to learn expressive node representations from botnet communication graphs. The explainer, based on the GNNExplainer and saliency map in XG-BoT, can perform automatic network forensics by highlighting suspicious network flows and related botnet nodes. We evaluated XG-BoT using real-world, large-scale botnet network graph datasets. Overall, XG-BoT outperforms state-of-the-art approaches in terms of key evaluation metrics. Additionally, we demonstrate that the XG-BoT explainers can generate useful explanations for automatic network forensics.
