Behavior-Based Zero-Day Attack Detection Using Graph Theory

This paper presented a behavior-based zero-day attack detection framework using graph-theoretic analysis, aimed at overcoming the limitations of traditional signature-based and learning-heavy intrusion detection systems. By modeling system runtime behavior as graphs and focusing on anomalous local subgraph patterns, the proposed approach enables effective detection of previously unseen attacks without relying on predefined attack signatures or black-box machine learning models. The experimental results demonstrate that the proposed method achieves improved detection capability, computational efficiency, and interpretability when compared to conventional signature-based techniques. The graph-based representation provides valuable insight into system behavior and supports explainable security analysis, making the approach suitable for practical deployment in real-world cybersecurity environments. Overall, the findings suggest that graph-theoretic behavior modeling represents a promising and robust direction for zero-day attack detection. Future work will focus on enhancing scalability, incorporating adaptive learning mechanisms, and validating the approach on large-scale real-world datasets to further strengthen its applicability in modern cyber defense systems.

[1]  Cyber Security S. Axelsson, “Intrusion Detection Systems: A Survey and Taxonomy,” Technical Report, Chalmers University of Technology, 2000. [2]  IEEE V. Chandola, A. Banerjee, and V. Kumar, “Anomaly Detection: A Survey,” ACM Computing Surveys, vol. 41, no. 3, pp. 1–58, 2009. [3]  IEEE D. E. Denning, “An Intrusion Detection Model,” IEEE Transactions on Software Engineering, vol. SE-13, no. 2, pp. 222–232, 1987. [4]  IEEE W. Lee and S. Stolfo, “A Framework for Constructing Features and Models for Intrusion Detection Systems,” ACM Transactions on Information Systems Security, vol. 3, no. 4, pp. 227–261, 2000. [5]   M. Roesch, “Snort: Lightweight Intrusion Detection for Networks,” Proceedings of LISA, pp. 229–238, 1999. [6]  R. Sommer and V. Paxson, “Outside the Closed World: On Using Machine Learning for Network Intrusion Detection,” IEEE Symposium on Security and Privacy, pp. 305–316, 2010. [7]  L. Akoglu, H. Tong, and D. Koutra, “Graph Based Anomaly Detection and Description: A Survey,” Data Mining and Knowledge Discovery, vol. 29, no. 3, pp. 626–688, 2015. [8]  C. C. Noble and D. J. Cook, “Graph-Based Anomaly Detection,” Proceedings of ACM SIGKDD, pp. 631–636, 2003. [10] M. Eberle and L. Holder, “Discovering Structural Anomalies in Graph-Based Data,” IEEE ICDM Workshops, pp. 393–398, 2007.