GRAPH CONVOLUTIONAL NETWORK UNTUK DETEKSI DAN MITIGASI ANCAMAN SIBER : HONEYPOT, BOTNET C2 DAN NSL-KDD

Abstract

Conventional intrusion detection approaches typically evaluate each network record independently, causing relational attack patterns such as lateral movement, command-and-control beaconing, and coordinated botnet flooding to remain undetected, since these patterns only become apparent when the topological relationships among entities are considered. This study proposes and evaluates a Graph Convolutional Network, implemented from first principles, for threat detection and adaptive mitigation recommendation across three data conditions: honeypot network logs represented as an explicit IP-relation graph, botnet command-and-control and distributed denial-of-service traffic exhibiting many-to-few and many-to-one topologies, and the NSL-KDD benchmark, using a k-nearest-neighbor similarity graph since tabular records lack explicit host identity. Node-level features are propagated through a two-layer Graph Convolutional Network following a spectral propagation rule, optimized with Adam, and each predicted threat category is mapped to mitigation actions referencing the NIST Cybersecurity Framework Profile for Artificial Intelligence and ISO/IEC 27001:2022. Testing yielded 100% accuracy on the honeypot and botnet graphs and 96.3% accuracy (macro F1 = 0.955) on the five-class NSL-KDD condition, with the lowest per-class performance on the Remote-to-Local category (F1 = 0.875). Rather than relying on aggregate accuracy alone, this study reports per-class F1 and precision-recall AUC to avoid misleading conclusions under severe class imbalance. Graph structure analysis revealed that threat nodes exhibit markedly lower connectivity than infrastructure nodes, offering an interpretable structural signature. The complete pipeline executes in under five seconds per condition. The findings indicate that a graph-based representation combined with a standards-mapped mitigation engine offers a viable, interpretable pathway toward adaptive cybersecurity decision support.