Attack detection in internet traffic networks proves to be a challenge as detection systems aim to detect different and evolving types of attacks in an ever changing environment of detection. In this paper we propose to build dynamic graph representations of the traffic dataset to represent the topology of the network from IP addresses or ports on different time windows. Those graph representations are then partitioned as communities of nodes and graph community metrics are computed from each community. The information contained in those metrics is highly related to the topology of the network in the corresponding time windows which is not accessible from net flow base features. Those communities and graph community metrics are then matched between all the states of the dynamic graphs corresponding to a time window to compute dynamic graph community metrics which add information about the evolution in the topology of the network. The set of our features leads to an increase in the detection performances across all types of attack in the UGR16 dataset while trying to use minimal amount of knowledge an attacker could use to mitigate the detection performance.
- Poster