Javascript is required
Search
Volume 14, Issue 3, 2026

Abstract

Full Text|PDF|XML
This study suggests a hybrid model of prediction and anomaly detection of dynamic network based on graph density time series. The main issue that is being tackled is that traditional linear models cannot explain non-linear structural shocks and volatility clustering that are facts in cyber network data. The methodology proposed implies turning network flows of the UNSW-NB15 dataset into dynamic graph snapshots, deriving graph density as a scalar measure, and stabilizing the series by converting it to log-returns. The existence of the “fat tails” and non-Gaussian shocks which cannot be detected using traditional statistical tools was verified by the use of advanced diagnostic tests, like Kurtosis and Jarque-Bera test. As a result, a hybrid model that was a combination of the autoregressive moving average (ARMA) and exponential generalized autoregressive conditional heteroscedasticity (EGARCH) was applied. This research used the selection of the ARMA ($p$, $q$)-EGARCH ($u$, $v$) model as the best specification in terms of the Akaike Information Criterion (AIC) and Bayesian Information Criterion (BIC). The result of the hybrid model had an accuracy with running time spent in predictive and anomaly detection. Compared with two different methods, the methodology of ARMA ($p$, $q$)-EGARCH ($u$, $v$) has demonstrated the highest level of anomaly detection with a decrease in time processing in prediction and detection processes. This paper shows that structural graph analysis with modeling can be used to increase the resilience and sensitivity of intrusion detection systems.

Abstract

Full Text|PDF|XML

Zero-day attacks–exploiting unknown vulnerabilities before patches exist–pose a critical threat to modern network infrastructure that signature-based intrusion detection systems cannot address. This paper proposes a hybrid computational framework combining a Convolutional Neural Network (CNN)-Gated Recurrent Unit (GRU)-Attention classifier with a skip-connection convolutional autoencoder (AE) for simultaneous known-attack classification and zero-day anomaly detection. The framework introduces three key computational contributions: (1) deterministic reshaping of 64 Random Forest-selected network flow features into 8 $\times$ 8 spatial images, enabling end-to-end CNN processing without feature engineering; (2) a strict Score-based Label Separation and Ordering (SLSO) data partition enforcing complete information isolation between training, validation, and zero-day evaluation sets; and (3) an OR-fusion hybrid decision rule combining anomaly score and reconstruction error signals. Experimental evaluation on Canadian Institute for Cybersecurity Intrusion Detection System (CICIDS)2017 demonstrates 97.48% zero-day detection rate (Z-DR) (95% confidence interval (CI) [97.1%, 97.9%]) at 4.2% false positive rate (FPR) and Area Under the Receiver Operating Characteristic curve (AUROC) of 0.956 across three held-out zero-day attack families–substantially outperforming all classical baselines (best: Stochastic Gradient Descent-optimized One-Class Support Vector Machine (SGD-OCSVM) at 85.45%). SHapley Additive exPlanations (SHAP) explainability analysis reveals mechanistic complementarity: the CNN captures temporal flow signatures while the AE contributes 1,012 exclusive detections via backward inter-arrival time anomalies. The system operates at 14,201 samples/second on Graphics Processing Unit (GPU), satisfying real-time deployment requirements. These results demonstrate that hybrid supervised-unsupervised fusion with rigorous experimental methodology substantially advances zero-day detection capability for computational network security systems.

- no more data -