Automatic generation of industrial internet attack graphs with graph neural networks and Bayesian models

Abstract

Industrial Internet is increasingly exposed to highly complex, heterogeneous, and multi-stage security threats, posing long-term potential risks to system security. Efficient and intelligent attack graph generation techniques are essential for accurately modeling potential attack paths and enabling visual analysis, thereby supporting proactive defense and attack attribution. However, existing methods primarily rely on static rules or expert knowledge, making them inadequate in capturing the dynamic nature, uncertainty, and complex dependencies of attack paths, and thus ineffective against emerging and sophisticated attack scenarios. To address these challenges, this paper proposes a novel automatic attack graph generation method for the Industrial Internet, termed IndustGNN-AG, which integrates Graph Neural Networks (GNNs) with Bayesian inference. The proposed method leverages the deep feature learning capability of GNNs to automatically extract network behavior features and employs Bayesian techniques to model the uncertainty of attack paths. A multi-layer graph attention mechanism is introduced to capture inter-node dependencies, and a probabilistic path estimation framework is developed by combining node-level and edge-level uncertainties, enabling a more comprehensive analysis of potential attack paths. Experimental results on three representative Industrial Internet attack datasets, namely Mirai_Botnet, SSDP Flood, and SYN DoS, demonstrate that IndustGNN-AG achieves accuracy rates of 99.40%, 100%, and 96.33%, respectively, in attack graph generation tasks. Compared with existing approaches, IndustGNN-AG exhibits significant improvements on accuracy and scalability.