Article Per Year (5 Year)
p-Index From 2021 - 2026
0.23
P-Index
This Author published in this journals
All Journal The Eastasouth Journal of Information System and Computer Science
Sujatha Lakshmi Narra
Robinhood Markets, Cumming, GA, USA
Computer Science & IT

Published : 1 Documents Claim Missing Document
Claim Missing Document
Check
Articles

Found 1 Documents
Search

 1 
ThreatWeave-X: A Systematic Review of Graph Neural Learning for Predicting Latent Multi-Stage Cyberattack Paths from Fragmented Enterprise Security Signals Sujatha Lakshmi Narra
The Eastasouth Journal of Information System and Computer Science Vol. 1 No. 01 (2023): The Eastasouth Journal of Information System and Computer Science (ESISCS)
Publisher : Eastasouth Institute

Show Abstract | Download Original | Original Source | Check in Google Scholar | DOI: 10.58812/esiscs.v1i01.1289

Abstract

The telemetry being used by enterprise security operations is increasingly endpoint, network, identity and cloud-based, with each individually exposing only part of an adversary's actions, and multi-stage intrusions, like those stemming from advanced persistent threats, very hard to reconstruct from any single source. We present a systematic review of the methodological heritage from deterministic attack-graph generation to provenance-graph and log-based intrusion analytics, and graph neural network representation learning that spans twenty-six papers published over the past 20 years (2002-2022). It chronicles the journey from the relational and infrastructure-aware formulations of attack graph research to the inductive, attentional and relation-aware formulations of graph neural architectures, that emerged as a direct result of their scalability challenges, and the evolution of provenance-graph analytics from a purely sequence-based treatment of system behavior to a more explicit causal and relational treatment. On the basis of this synthesis, the review suggests a five-stage conceptual framework called ThreatWeave-X, which integrates multi-source signals from various sources into a single heterogeneous provenance graph, relational and attentional graph-neural embedding and a sequence-aware attention mechanism with an analyst feedback loop to rank candidate multi-stage attack paths. The review also outlines four cross-cutting challenges that appear in the reviewed literature that are still not completely addressed: 1) incompleteness of multi-modal heterogeneity handling, 2) scarcity of labels, 3) limited interpretability, and 4) inconsistent evaluation protocols, which all suggest directions for future empirical validation of the graph-neural multi-stage attack-path prediction.
Co-Authors