Software Defined Networking (SDN) has brought significant advancements in network management and programmability. However, this evolution has also heightened vulnerability to Advanced Persistent Threats (APTs), sophisticated and stealthy cyberattacks that traditional detection methods often fail to counter, especially in the face of zero-day exploits. A prevalent issue is the inadequacy of existing strategies to detect novel threats while addressing data privacy concerns in collaborative learning scenarios. This paper presents P3GNN (privacy-preserving provenance graph-based graph neural network model), a novel model that synergizes Federated Learning (FL) with Graph Convolutional Networks (GCN) for effective APT detection in SDN environments. P3GNN utilizes unsupervised learning to analyze operational patterns within provenance graphs, identifying deviations indicative of security breaches. Its core feature is the integration of FL with homomorphic encryption, which fortifies data confidentiality and gradient integrity during collaborative learning. This approach addresses the critical challenge of data privacy in shared learning contexts. Key innovations of P3GNN include its ability to detect anomalies at the node level within provenance graphs, offering a detailed view of attack trajectories and enhancing security analysis. Furthermore, the models unsupervised learning capability enables it to identify zero-day attacks by learning standard operational patterns. Empirical evaluation using the DARPA TCE3 dataset demonstrates P3GNNs exceptional performance, achieving an accuracy of 0.93 and a low false positive rate of 0.06.

翻译：软件定义网络（SDN）为网络管理和可编程性带来了显著进步。然而，这种演进也加剧了面对高级持续性威胁（APT）的脆弱性。APT是复杂且隐蔽的网络攻击，传统检测方法往往难以应对，尤其是在零日漏洞利用面前。一个普遍存在的问题是，现有策略在协作学习场景中既需应对数据隐私关切，又难以有效检测新型威胁。本文提出P3NGG（基于隐私保护溯源图的图神经网络模型），这是一种创新模型，它将联邦学习（FL）与图卷积网络（GCN）协同结合，用于SDN环境中的有效APT检测。P3GNN利用无监督学习分析溯源图内的操作模式，识别指示安全违规的偏差。其核心特点是将FL与同态加密相结合，从而在协作学习过程中强化数据机密性和梯度完整性。该方法解决了共享学习环境中数据隐私的关键挑战。P3GNN的主要创新包括其在溯源图内节点层面检测异常的能力，提供了攻击轨迹的详细视图并增强了安全分析。此外，该模型的无监督学习能力使其能够通过学习标准操作模式来识别零日攻击。使用DARPA TCE3数据集进行的实证评估表明，P3GNN具有卓越性能，实现了0.93的准确率和0.06的低误报率。