Euler: Efficiently Detecting Sneaky Malware Spreading Through Large Networks

What is it about?

A graph is a way of representing data as a collection of objects, called “nodes”, and the relations between them, called “edges”; a temporal graph is a graph that changes its nodes or edges over time. In this work, we present Euler: a framework to efficiently predict when edges are likely to appear on large temporal graphs. We applied this technique to temporal graphs representing computer networks and found it could identify network traffic produced by malware attempting to spread.

Featured Image

Photo by Max Bender on Unsplash

Photo by Max Bender on Unsplash

Why is it important?

We found that feeding the output of a graph neural network (GNN) into a recurrent neural network (RNN) produced embeddings that held information about both the topology and temporal relations present in dynamic graphs. Further, this modular structure allowed us to distribute the more memory-intensive work of the GNN across multiple machines, speeding up the model considerably. This framework is not only the fastest, but as of this writing the most precise method for link prediction currently in the literature. This allows for rapid and reliable training on the large sets of network data it would encounter in a real-world setting as an anomaly-based intrusion detector.