In this paper, we propose XG-BoT, an explainable deep graph neural network model for botnet node detection. The proposed model comprises a botnet detector and an explainer for automatic forensics. The XG-BoT detector can effectively detect malicious botnet nodes in large-scale networks. Specifically, it utilizes a grouped reversible residual connection with a graph isomorphism network to learn expressive node representations from botnet communication graphs. The explainer, based on the GNNExplainer and saliency map in XG-BoT, can perform automatic network forensics by highlighting suspicious network flows and related botnet nodes. We evaluated XG-BoT using real-world, large-scale botnet network graph datasets. Overall, XG-BoT outperforms state-of-the-art approaches in terms of key evaluation metrics. Additionally, we demonstrate that the XG-BoT explainers can generate useful explanations for automatic network forensics.
翻译:在本文中,我们提出XG-BOT,这是一个用于肉网节点探测的可解释的深图神经网络模型。提议的模型包括一个肉网探测器和一个自动法证解释器。XG-BoT探测器可以有效地探测大型网络中的恶性肉网节点。具体地说,它利用一个图形的可反向剩余连接来从肉网通信图中学习表达式节点表征。该解释器以GNNNExlainer和XG-BoT中突出的地图为基础,能够通过突出可疑网络流和相关肉网节进行自动网络法证。我们用真实世界、大规模肉网图谱数据集对XG-BoT进行了评估。总体来说,XG-BoT在关键评价指标方面超越了最新的最新方法。此外,我们证明XG-BoT解释器可以为自动网络法证提供有用的解释。</s>