A new hybrid approach combining GCN and LSTM for real-time anomaly detection from network data

Abstract

The rapidly changing nature of cyber threats is becoming difficult to deal with, and this requires developing innovative solutions. This study presents an innovative AI-based approach for anomaly detection in real-time network traffic. Wireshark, a widely used tool in network traffic analysis, was used in the data collection phase of the proposed model and as a testbed for live anomaly detection. A high-performance hybrid model was developed by combining Long Short-Term Memory (LSTM) and Graph Convolutional Networks (GCN), which perform well on time series data. A comprehensive dataset consisting of packets containing many attacks and harmless network packets was created and made available for open access. The proposed hybrid model achieved 97% accuracy on a large and comprehensive dataset. In addition, it was proven that live anomaly detection in network traffic could be achieved by using the developed test code and the Wireshark tool in an integrated manner. It is anticipated that in the future, artificial intelligence and deep learning-based methods will find more place in critical tasks such as anomaly detection and threat analysis in the field of cybersecurity and that these technologies will provide more effective and dynamic solutions against constantly evolving threats.