# 5 Discussion

In the previous chapter, the results of the experiments were presented. This chapter aims to provide an in-depth discussion of those results, as well as to identify the limitations of the experiments and to propose avenues for future research.

## 5.1 Discussion of the results

The following subsections will discuss the results obtained in the experiments, and will provide insights into the performance of the different models, as well as the impact of the different features and embeddings on the performance of the models.

### 5.1.1 Objectives of the experiments

The primary objectives of the experiments conducted in this study are multi-faceted. First and foremost, we aim to demonstrate the feasibility of utilizing machine learning and deep learning models to predict chunks with keys in the OpenSSH program based on a graph-like representation of the heap dump files provided in the original dataset. To achieve this, we employ a range of algorithms to extract features from memory graphs, or 'memgraphs'. These algorithms include not only custom solutions tailored to our specific needs but also well-established, powerful algorithms like Node2Vec. Furthermore, we seek to evaluate the impact of these diverse features on the performance metrics of the predictive models. Lastly, we compare the performances of various models to identify the most effective approaches for our specific use-case.

### 5.1.2 Discussing features and embeddings

In this section, we delve into the intricacies of the features and embeddings used in our experiments, focusing particularly on their interrelationships as revealed by correlation matrices. Correlation matrices provide a quantitative measure of how different features of custom embeddings relate to each other. Each cell in the matrix represents the correlation coefficient between two features, which ranges from -1 to 1. A high positive value indicates a strong positive correlation, meaning that as one feature increases, the other tends to also increase. A negative value would indicate the opposite.

It's worth noting that performing this analysis on Node2Vec embeddings is generally considered irrelevant. Node2Vec embeddings are designed to capture the neighborhood structure of nodes in a way that is optimized for machine learning tasks, and their dimensions do not have an easily interpretable meaning. Therefore, analyzing the correlation between different dimensions of a Node2Vec embedding is unlikely to provide insights that are useful for feature engineering.

To interpret the correlation matrices, we use a color-coded system where red signifies high correlation and blue signifies low or no correlation. In the context of machine learning, understanding feature correlation is crucial for several reasons:

* **Feature Selection:** Highly correlated features carry redundant information, which may not only be unnecessary but can also lead to overfitting and poor generalization.
# 5 Discussion

In the previous chapter, the results of the experiments were presented. This chapter aims to provide an in-depth discussion of those results, as well as to identify the limitations of the experiments and to propose avenues for future research.

## 5.1 Discussion of the results

The following subsections will discuss the results obtained in the experiments, and will provide insights into the performance of the different models, as well as the impact of the different features and embeddings on the performance of the models.

### 5.1.1 Objectives of the experiments

The primary objectives of the experiments conducted in this study are multi-faceted. First and foremost, we aim to demonstrate the feasibility of utilizing machine learning and deep learning models to predict chunks with keys in the OpenSSH program based on a graph-like representation of the heap dump files provided in the original dataset. To achieve this, we employ a range of algorithms to extract features from memory graphs, or 'memgraphs'. These algorithms include not only custom solutions tailored to our specific needs but also well-established, powerful algorithms like Node2Vec. Furthermore, we seek to evaluate the impact of these diverse features on the performance metrics of the predictive models. Lastly, we compare the performances of various models to identify the most effective approaches for our specific use-case.

### 5.1.2 Discussing features and embeddings

In this section, we delve into the intricacies of the features and embeddings used in our experiments, focusing particularly on their interrelationships as revealed by correlation matrices. Correlation matrices provide a quantitative measure of how different features of custom embeddings relate to each other. Each cell in the matrix represents the correlation coefficient between two features, which ranges from -1 to 1. A high positive value indicates a strong positive correlation, meaning that as one feature increases, the other tends to also increase. A negative value would indicate the opposite.

It's worth noting that performing this analysis on Node2Vec embeddings is generally considered irrelevant. Node2Vec embeddings are designed to capture the neighborhood structure of nodes in a way that is optimized for machine learning tasks, and their dimensions do not have an easily interpretable meaning. Therefore, analyzing the correlation between different dimensions of a Node2Vec embedding is unlikely to provide insights that are useful for feature engineering.

To interpret the correlation matrices, we use a color-coded system where red signifies high correlation and blue signifies low or no correlation. In the context of machine learning, understanding feature correlation is crucial for several reasons:

* **Feature Selection:** Highly correlated features carry redundant information, which may not only be unnecessary but can also lead to overfitting and poor generalization.
* **Interpretability:** Understanding how features are correlated can provide insights into the underlying structure of the data and the problem being solved.

* **Computational Efficiency:** Eliminating correlated features can reduce the dimensionality of the problem, making the model simpler and faster to train.

Therefore, the correlation matrices serve as a valuable tool for both feature selection and model interpretation. In that context, and looking at the correlation matrices provided for the different algorithms like Pearson, Spearman, and Kendall correlation, we can see that the correlation between the different features is generally very low, meaning that the features are not correlated to each other. This is a good thing, as it means that the features are not redundant, and that they are all bringing new information to the model. No matter the correlation algorithm used, the matrices look very similar, and the correlation between the features is very low. The only features that stands a bit from the rest are the features corresponding to the filtering and entropy. This is actually just a sign that the entropy was indeed used in the filtering algorithm, since key chunks are generally more entropic than non-key chunks. In practice, that's also why the experiments have been run with and without this filtering feature.

### 5.1.3 Classic ML models performances

In this subsection, we discuss the performance of three tested classical binary classification machine learning models, namely Logistic Regression, Random Forest, and SGD Classifier, in the context of key chunk prediction. The models were evaluated based on four key metrics: Precision, Recall, F1 Score, and AUC (Area Under the Curve).

#### 5.1.3.1 Logistic Regression

The Logistic Regression model excels in precision with a perfect score of 1.0000 but falls short in recall, F1 score, and AUC. The model is highly precise but fails to capture the majority of the positive instances, as indicated by the low recall of 0.0417. This suggests that while the model makes very few false-positive errors, it misses a large number of true positives.

#### 5.1.3.2 Random Forest

Random Forest shows excellent precision at the expense of recall. It has a high precision of 1.0000 but a very low recall of 0.0833, indicating that it is precise but not sensitive. The AUC of 0.5417 suggests that the model's ability to distinguish between the classes is slightly better than random guessing.

#### 5.1.3.3 SGD Classifier

The SGD Classifier stands out in terms of recall and AUC, both scoring close to a perfect score. This indicates that the model is excellent at identifying all the positive instances and distinguishing between the two classes. However, its precision isn't always perfect, suggesting a higher rate of false positives.
* **Interpretability:** Understanding how features are correlated can provide insights into the underlying structure of the data and the problem being solved.

* **Computational Efficiency:** Eliminating correlated features can reduce the dimensionality of the problem, making the model simpler and faster to train.

Therefore, the correlation matrices serve as a valuable tool for both feature selection and model interpretation. In that context, and looking at the correlation matrices provided for the different algorithms like Pearson, Spearman, and Kendall correlation, we can see that the correlation between the different features is generally very low, meaning that the features are not correlated to each other. This is a good thing, as it means that the features are not redundant, and that they are all bringing new information to the model. No matter the correlation algorithm used, the matrices look very similar, and the correlation between the features is very low. The only features that stands a bit from the rest are the features corresponding to the filtering and entropy. This is actually just a sign that the entropy was indeed used in the filtering algorithm, since key chunks are generally more entropic than non-key chunks. In practice, that's also why the experiments have been run with and without this filtering feature.

### 5.1.3 Classic ML models performances

In this subsection, we discuss the performance of three tested classical binary classification machine learning models, namely Logistic Regression, Random Forest, and SGD Classifier, in the context of key chunk prediction. The models were evaluated based on four key metrics: Precision, Recall, F1 Score, and AUC (Area Under the Curve).

#### 5.1.3.1 Logistic Regression

The Logistic Regression model excels in precision with a perfect score of 1.0000 but falls short in recall, F1 score, and AUC. The model is highly precise but fails to capture the majority of the positive instances, as indicated by the low recall of 0.0417. This suggests that while the model makes very few false-positive errors, it misses a large number of true positives.

#### 5.1.3.2 Random Forest

Random Forest shows excellent precision at the expense of recall. It has a high precision of 1.0000 but a very low recall of 0.0833, indicating that it is precise but not sensitive. The AUC of 0.5417 suggests that the model's ability to distinguish between the classes is slightly better than random guessing.

#### 5.1.3.3 SGD Classifier

The SGD Classifier stands out in terms of recall and AUC, both scoring close to a perfect score. This indicates that the model is excellent at identifying all the positive instances and distinguishing between the two classes. However, its precision isn't always perfect, suggesting a higher rate of false positives.
#### 5.1.3.4 Comparison

Upon comparing the three models, it's evident that each has its own strengths and weaknesses. Logistic Regression has a much better overall recall than Random Forest which is very precise but fails to find a lot of cases. However, SGD Classifier is clearly the best overall model here, since it is highly sensitive and excellent in class separation but lacks in precision.

In summary, the SGD Classifier would be more appropriate in the binary classification task of predicting is a chunk is a key chunk or not. Random Forest offers a balanced but mediocre performance and could serve as a baseline model. Those models merely serve as a comparison point for the deep learning models.

### 5.1.4 GCN models performances

In this subsection, we delve into the performance metrics of five different Graph Convolutional Networks (GCN) models: Very Simple GCN, Simple GCN, First GCN, GCN with Dropout, and Advanced GCN. These models were evaluated on the same four key metrics as the classical models: Precision, Recall, F1 Score, and AUC.

#### 5.1.4.1 Very Simple GCN

The Very Simple GCN model shows generally balanced performances. It's worth noting that the best instance of the model reached a perfect recall of 1.0000, indicating excellent sensitivity. However, the precision of the model is at best only of 0.6000, suggesting a higher rate of false positives. Its best instance having an AUC score of 0.9907 suggests excellent class separation capabilities.

#### 5.1.4.2 Simple GCN

This model has similar or slightly lower performance metrics to the Very Simple GCN, with a precision and recall of 0.5000. The AUC score is slightly lower at 0.9891 but still indicates excellent class separation.

#### 5.1.4.3 First GCN

The First GCN model also looks very similar to the two previous models. Its best AUC instance has a high AUC indicating excellent sensitivity and class separation.

#### 5.1.4.4 GCN with Dropout

This model has the lowest precision among the GCN models at 0.3500 but shows a decent AUC score of 0.8810. The model overall seems to be more sensitive, but less precise compare to the simpler models introduced before. This was indeed expected due to the use of dropout, which is known to increase sensitivity at the expense of precision.
#### 5.1.3.4 Comparison

Upon comparing the three models, it's evident that each has its own strengths and weaknesses. Logistic Regression has a much better overall recall than Random Forest which is very precise but fails to find a lot of cases. However, SGD Classifier is clearly the best overall model here, since it is highly sensitive and excellent in class separation but lacks in precision.

In summary, the SGD Classifier would be more appropriate in the binary classification task of predicting is a chunk is a key chunk or not. Random Forest offers a balanced but mediocre performance and could serve as a baseline model. Those models merely serve as a comparison point for the deep learning models.

### 5.1.4 GCN models performances

In this subsection, we delve into the performance metrics of five different Graph Convolutional Networks (GCN) models: Very Simple GCN, Simple GCN, First GCN, GCN with Dropout, and Advanced GCN. These models were evaluated on the same four key metrics as the classical models: Precision, Recall, F1 Score, and AUC.

#### 5.1.4.1 Very Simple GCN

The Very Simple GCN model shows generally balanced performances. It's worth noting that the best instance of the model reached a perfect recall of 1.0000, indicating excellent sensitivity. However, the precision of the model is at best only of 0.6000, suggesting a higher rate of false positives. Its best instance having an AUC score of 0.9907 suggests excellent class separation capabilities.

#### 5.1.4.2 Simple GCN

This model has similar or slightly lower performance metrics to the Very Simple GCN, with a precision and recall of 0.5000. The AUC score is slightly lower at 0.9891 but still indicates excellent class separation.

#### 5.1.4.3 First GCN

The First GCN model also looks very similar to the two previous models. Its best AUC instance has a high AUC indicating excellent sensitivity and class separation.

#### 5.1.4.4 GCN with Dropout

This model has the lowest precision among the GCN models at 0.3500 but shows a decent AUC score of 0.8810. The model overall seems to be more sensitive, but less precise compare to the simpler models introduced before. This was indeed expected due to the use of dropout, which is known to increase sensitivity at the expense of precision.
#### 5.1.4.5 Advanced GCN

The Advanced GCN model, despite its complexity, does not outperform the simpler models in this limited dataset. It displays the worst performances in precision, f1 score and AUC, but has the best recall of all the GCN models, at 0.9000. This suggests that the model is very sensitive but not very precise, which is not surprising considering the complexity of the model, and the limited number of input memgraphs. This trend is likely to change if tested with a larger number of training graphs.

#### 5.1.4.6 Layer Complexity

It's worth noting that the simpler models (Very Simple and Simple GCN) with only 2 layers tend to perform better in this limited training dataset. This could be due to the low number of example graphs, which might not be sufficient to train the more complex, 4-layer Advanced GCN model effectively. Yet, the Advanced GCN model has the best recall of all the GCN models, suggesting that it is more sensitive than the simpler models.

In summary, each GCN model has its own set of strengths and weaknesses. While some excel in precision, others are more sensitive or better at class separation. The choice of model would depend on the specific requirements of the task at hand.

### 5.1.5 Comparing the embeddings impact on the models

Based on the results of the experiments, it's evident that the choice of embedding has a significant impact on the performance of the models. As this can be seen in 4.4, and surprisingly, it seems that the custom embeddings developed specifically for this research are actually not the best performing embeddings. As such, adding the features from those custom embeddings to the Node2Vec embeddings does not improve the performances of the models, but actually degrade them. This is a very surprising result. The Node2Vec embedding is actually the best performing embedding, no matter the model used, which is even more surprising, since the GCN models were actively using the graph structure, which is not the case for the classic ML models. This means that the Node2Vec embedding, which is purely based on the graph structure, is actually the best performing embedding, and that the custom embeddings are not bringing any additional information to the models. Thus, this demonstrates that the memgraph structure is in and on itself sufficiently meaningful to perform the classification task.

It's worth mentioning the master thesis of Clément Lahoche that actually dives deeper in the question of embedding quality and impacts. His work displays significantly different results than the ones obtained in this research about embeddings. It shows that the question of embeddings is indeed a complex topic, and that the results can vary a lot depending on the dataset, the model, and the approach used.

The big difference between this present work and his thesis is that he used a much larger number of input memgraphs, but also that he actually perform a real rebalancing on the dataset before training. This means that whereas the experiments perform in this work have been dealing with a very high imbalance rate, his classifiers have been trained on a much better balanced dataset. This is a huge difference, and it's not surprising that the results are so different. The reason why this thesis did not use active rebalancing is that we wanted to explore the impact of learning on a full memgraph dataset, without alteration of those memgraphs. This is due to the
#### 5.1.4.5 Advanced GCN

The Advanced GCN model, despite its complexity, does not outperform the simpler models in this limited dataset. It displays the worst performances in precision, f1 score and AUC, but has the best recall of all the GCN models, at 0.9000. This suggests that the model is very sensitive but not very precise, which is not surprising considering the complexity of the model, and the limited number of input memgraphs. This trend is likely to change if tested with a larger number of training graphs.

#### 5.1.4.6 Layer Complexity

It's worth noting that the simpler models (Very Simple and Simple GCN) with only 2 layers tend to perform better in this limited training dataset. This could be due to the low number of example graphs, which might not be sufficient to train the more complex, 4-layer Advanced GCN model effectively. Yet, the Advanced GCN model has the best recall of all the GCN models, suggesting that it is more sensitive than the simpler models.

In summary, each GCN model has its own set of strengths and weaknesses. While some excel in precision, others are more sensitive or better at class separation. The choice of model would depend on the specific requirements of the task at hand.

### 5.1.5 Comparing the embeddings impact on the models

Based on the results of the experiments, it's evident that the choice of embedding has a significant impact on the performance of the models. As this can be seen in 4.4, and surprisingly, it seems that the custom embeddings developed specifically for this research are actually not the best performing embeddings. As such, adding the features from those custom embeddings to the Node2Vec embeddings does not improve the performances of the models, but actually degrade them. This is a very surprising result. The Node2Vec embedding is actually the best performing embedding, no matter the model used, which is even more surprising, since the GCN models were actively using the graph structure, which is not the case for the classic ML models. This means that the Node2Vec embedding, which is purely based on the graph structure, is actually the best performing embedding, and that the custom embeddings are not bringing any additional information to the models. Thus, this demonstrates that the memgraph structure is in and on itself sufficiently meaningful to perform the classification task.

It's worth mentioning the master thesis of Clément Lahoche that actually dives deeper in the question of embedding quality and impacts. His work displays significantly different results than the ones obtained in this research about embeddings. It shows that the question of embeddings is indeed a complex topic, and that the results can vary a lot depending on the dataset, the model, and the approach used.

The big difference between this present work and his thesis is that he used a much larger number of input memgraphs, but also that he actually perform a real rebalancing on the dataset before training. This means that whereas the experiments perform in this work have been dealing with a very high imbalance rate, his classifiers have been trained on a much better balanced dataset. This is a huge difference, and it's not surprising that the results are so different. The reason why this thesis did not use active rebalancing is that we wanted to explore the impact of learning on a full memgraph dataset, without alteration of those memgraphs. This is due to the
fact that this work has been focused around those graphs and their equivalent in the classification
phase with GCNs that rely on the graph structure. The goal was to see if the graph structure was
enough to perform the classification, and the results are very promising. Results show that the
imbalance ratio is not a problem for the models, as they are able to perform well despite the very
high imbalance ratio.

5.1.6 Comparing GCN and classical ML models

In this subsection, we aim to compare the performance of classical machine learning models with Graph Convolutional Networks (GCNs) for the task of key chunk prediction. The comparison is based the results of the experiments, the best instances of each model on each metric, but also the distribution of the metrics as illustrated in 4.4.

5.1.6.1 Overall Performance

For overall balanced performance, the SGD Classifier from the classical models and the Very Simple GCN from the GCN models stand out. The SGD Classifier excels in recall and AUC, making it highly sensitive and excellent in class separation, although it lacks in precision. On the other hand, the Very Simple GCN shows balanced metrics across the board. It has a decent recall and AUC, but its precision is not perfect. However, it is the best performing GCN model in terms of precision.

5.1.6.2 Precision

If precision is the primary concern, then Logistic Regression and Random Forest from the classical
models and the Very Simple GCN from the GCN models are the best choices. Logistic Regression
and Random Forest both have a perfect precision score of 1.0000, while the Very Simple GCN has
a precision of 0.6000, which is the highest among the GCN models.

5.1.6.3 Recall

For applications where high recall is crucial, the SGD Classifier from the classical models and the
Advanced GCN from the GCN models are the most suitable. The SGD Classifier has a near-perfect
recall, while the Advanced GCN has the highest recall among the GCN models at 0.9000.

5.1.6.4 Class Separation (AUC)

If the ability to distinguish between classes is of utmost importance, then the SGD Classifier from
the classical models and the Very Simple GCN from the GCN models are the best options. Both
models have AUC scores close to 1, indicating excellent class separation capabilities, between key
and non-key chunks.
fact that this work has been focused around those graphs and their equivalent in the classification
phase with GCNs that rely on the graph structure. The goal was to see if the graph structure was
enough to perform the classification, and the results are very promising. Results show that the
imbalance ratio is not a problem for the models, as they are able to perform well despite the very
high imbalance ratio.

5.1.6 Comparing GCN and classical ML models

In this subsection, we aim to compare the performance of classical machine learning models with Graph Convolutional Networks (GCNs) for the task of key chunk prediction. The comparison is based the results of the experiments, the best instances of each model on each metric, but also the distribution of the metrics as illustrated in 4.4.

5.1.6.1 Overall Performance

For overall balanced performance, the SGD Classifier from the classical models and the Very Simple GCN from the GCN models stand out. The SGD Classifier excels in recall and AUC, making it highly sensitive and excellent in class separation, although it lacks in precision. On the other hand, the Very Simple GCN shows balanced metrics across the board. It has a decent recall and AUC, but its precision is not perfect. However, it is the best performing GCN model in terms of precision.

5.1.6.2 Precision

If precision is the primary concern, then Logistic Regression and Random Forest from the classical
models and the Very Simple GCN from the GCN models are the best choices. Logistic Regression
and Random Forest both have a perfect precision score of 1.0000, while the Very Simple GCN has
a precision of 0.6000, which is the highest among the GCN models.

5.1.6.3 Recall

For applications where high recall is crucial, the SGD Classifier from the classical models and the
Advanced GCN from the GCN models are the most suitable. The SGD Classifier has a near-perfect
recall, while the Advanced GCN has the highest recall among the GCN models at 0.9000.

5.1.6.4 Class Separation (AUC)

If the ability to distinguish between classes is of utmost importance, then the SGD Classifier from
the classical models and the Very Simple GCN from the GCN models are the best options. Both
models have AUC scores close to 1, indicating excellent class separation capabilities, between key
and non-key chunks.
### 5.1.6.5 Considerations for Small Datasets

It's worth noting that the simpler GCN models (Very Simple and Simple GCN) tend to perform better on the limited dataset used for training. This suggests that for small datasets, simpler models may be more effective. The Advanced GCN model, despite its complexity, does not perform as well but shows promise in terms of high recall, which could potentially improve with more training data.

### 5.1.6.6 Summary

In summary, the choice of model would depend on the specific metric that is most important for the task. For balanced performance, the SGD Classifier and Very Simple GCN are recommended. For high precision, Logistic Regression or Very Simple GCN should be considered. For high recall, the SGD Classifier or Advanced GCN would be the most appropriate. Finally, for excellent class separation, the SGD Classifier and Very Simple GCN are the best choices according to the experiments.

## 5.2 Limitations of the Experiments

While the experiments conducted offer valuable insights into the performance and capabilities of the machine learning and deep learning classifiers, it is crucial to acknowledge the limitations that were inherent in the experimental setup. These limitations range from computational resources to the scale and duration of the experiments. Understanding these constraints is essential for interpreting the results accurately and for identifying avenues for future research. This section aims to discuss the following limitations in detail:

* **Number of Compute Instances:** The experiments were constrained by the available number of compute instances, affecting the scale at which they could be conducted.

* **Number of Input Graphs:** The quantity of input graphs used in the experiments was rather limited, which could impact the generalizability of the results.

* **Duration of the Experiments:** The time allocated for each experiment was finite, potentially affecting the depth of the analysis.

* **CPU-only Environment:** The experiments were conducted in a CPU-only setting, without the acceleration benefits that a GPU could offer, due to problems of memory consumption being too high for the GPU. Additional work on this aspect could significantly improve the performance of the experiments, especially the Node2Vec embedding generation.

* **High Memory Bandwidth Usage:** The experiments were characterized by high memory bandwidth usage, which could have implications for performance.

The subsequent subsections will delve into each of these limitations, providing a comprehensive understanding of their impact on the experiments.
### 5.1.6.5 Considerations for Small Datasets

It's worth noting that the simpler GCN models (Very Simple and Simple GCN) tend to perform better on the limited dataset used for training. This suggests that for small datasets, simpler models may be more effective. The Advanced GCN model, despite its complexity, does not perform as well but shows promise in terms of high recall, which could potentially improve with more training data.

### 5.1.6.6 Summary

In summary, the choice of model would depend on the specific metric that is most important for the task. For balanced performance, the SGD Classifier and Very Simple GCN are recommended. For high precision, Logistic Regression or Very Simple GCN should be considered. For high recall, the SGD Classifier or Advanced GCN would be the most appropriate. Finally, for excellent class separation, the SGD Classifier and Very Simple GCN are the best choices according to the experiments.

## 5.2 Limitations of the Experiments

While the experiments conducted offer valuable insights into the performance and capabilities of the machine learning and deep learning classifiers, it is crucial to acknowledge the limitations that were inherent in the experimental setup. These limitations range from computational resources to the scale and duration of the experiments. Understanding these constraints is essential for interpreting the results accurately and for identifying avenues for future research. This section aims to discuss the following limitations in detail:

* **Number of Compute Instances:** The experiments were constrained by the available number of compute instances, affecting the scale at which they could be conducted.

* **Number of Input Graphs:** The quantity of input graphs used in the experiments was rather limited, which could impact the generalizability of the results.

* **Duration of the Experiments:** The time allocated for each experiment was finite, potentially affecting the depth of the analysis.

* **CPU-only Environment:** The experiments were conducted in a CPU-only setting, without the acceleration benefits that a GPU could offer, due to problems of memory consumption being too high for the GPU. Additional work on this aspect could significantly improve the performance of the experiments, especially the Node2Vec embedding generation.

* **High Memory Bandwidth Usage:** The experiments were characterized by high memory bandwidth usage, which could have implications for performance.

The subsequent subsections will delve into each of these limitations, providing a comprehensive understanding of their impact on the experiments.
### 5.2.1 Limited number of input graphs

The number of input graphs is a parameter that can be easily changed, and the experiments can be run again with a higher number of input graphs, but it would take a very long time to run, and the results would be similar although improved to the ones obtained with 16 input graphs. Improving the performances could be done essentially by recoding the program Node2Vec embedding part and adding those results directly inside the *Mem2Graph* program. Leveraging the Rust zero-abstraction costs philosophy, it would be possible to improve the performances by a probable factor of 100 to 1000 times, and to run the experiments with a higher number of input graphs. For ease of development and handling of the results, I would still recommend to perform the machine learning related experiments using the powerful Python dedicated libraries.

That being said, it's remarkable that the models can perform so well considering the very small number of training memgraph and the very high imbalance ratio of the dataset. The imbalance ratio is the ratio of the number of negative samples over the number of positive samples. In the case of the dataset used in this research, the imbalance ratio is very high, ranging generally at several hundred times more negative samples than positive samples. No rebalancing has been performed on the dataset since we wanted to explore the impact of learning on a full memgraph dataset, without alteration of those memgraphs.

The results obtained in this research are already very promising, and the imbalance ratio is not a problem for the models, as they are able to perform very well despite the very high imbalance ratio.

### 5.2.2 Duration of the experiments

Although a lot of efforts have been put to deal both with dataset reduction, for instance transforming the initial block address prediction into a chunk address prediction problem, then optimizing a lot of computing through the use of a dedicated Rust parallel and optimized program, then using techniques like file preloading, the sheer number of hyperparameters and the number of experiments to run, as well as the compute time for the Node2Vec embedding generation, make the experiments very long to run.

Below are the duration times for the different steps of the experiments.

<table><caption>Table 5.1: Duration times for duration of embedding generation in ML/DL/FE pipeline (in seconds).</caption><thead><tr><td>Model</td><td>Min duration</td><td>Max duration</td><td>Min duration</td></tr></thead><tbody><tr><td>advanced-gcn</td><td>506.5721079074733</td><td>1548.909129</td><td>0.129933</td></tr><tr><td>first-gcn</td><td>503.49931116140345</td><td>1548.909129</td><td>0.129933</td></tr><tr><td>gcn-with-dropout</td><td>506.5721079074733</td><td>1548.909129</td><td>0.129933</td></tr><tr><td>logistic-regression</td><td>505.3690870955711</td><td>1565.660571</td><td>0.06828</td></tr><tr><td>random-forest</td><td>505.3690870955711</td><td>1565.660571</td><td>0.06828</td></tr><tr><td>sgd-classifier</td><td>505.3690870955711</td><td>1565.660571</td><td>0.06828</td></tr><tr><td>simple-gcn</td><td>506.5721079074733</td><td>1548.909129</td><td>0.129933</td></tr><tr><td>very-simple-gcn</td><td>506.5721079074733</td><td>1548.909129</td><td>0.129933</td></tr></tbody></table>

Considering the tested models are not especially complex, and since the number of input memgraph stays limited, the duration of the training and testing steps is actually quite small:
### 5.2.1 Limited number of input graphs

The number of input graphs is a parameter that can be easily changed, and the experiments can be run again with a higher number of input graphs, but it would take a very long time to run, and the results would be similar although improved to the ones obtained with 16 input graphs. Improving the performances could be done essentially by recoding the program Node2Vec embedding part and adding those results directly inside the *Mem2Graph* program. Leveraging the Rust zero-abstraction costs philosophy, it would be possible to improve the performances by a probable factor of 100 to 1000 times, and to run the experiments with a higher number of input graphs. For ease of development and handling of the results, I would still recommend to perform the machine learning related experiments using the powerful Python dedicated libraries.

That being said, it's remarkable that the models can perform so well considering the very small number of training memgraph and the very high imbalance ratio of the dataset. The imbalance ratio is the ratio of the number of negative samples over the number of positive samples. In the case of the dataset used in this research, the imbalance ratio is very high, ranging generally at several hundred times more negative samples than positive samples. No rebalancing has been performed on the dataset since we wanted to explore the impact of learning on a full memgraph dataset, without alteration of those memgraphs.

The results obtained in this research are already very promising, and the imbalance ratio is not a problem for the models, as they are able to perform very well despite the very high imbalance ratio.

### 5.2.2 Duration of the experiments

Although a lot of efforts have been put to deal both with dataset reduction, for instance transforming the initial block address prediction into a chunk address prediction problem, then optimizing a lot of computing through the use of a dedicated Rust parallel and optimized program, then using techniques like file preloading, the sheer number of hyperparameters and the number of experiments to run, as well as the compute time for the Node2Vec embedding generation, make the experiments very long to run.

Below are the duration times for the different steps of the experiments.

<table><caption>Table 5.1: Duration times for duration of embedding generation in ML/DL/FE pipeline (in seconds).</caption><thead><tr><td>Model</td><td>Min duration</td><td>Max duration</td><td>Min duration</td></tr></thead><tbody><tr><td>advanced-gcn</td><td>506.5721079074733</td><td>1548.909129</td><td>0.129933</td></tr><tr><td>first-gcn</td><td>503.49931116140345</td><td>1548.909129</td><td>0.129933</td></tr><tr><td>gcn-with-dropout</td><td>506.5721079074733</td><td>1548.909129</td><td>0.129933</td></tr><tr><td>logistic-regression</td><td>505.3690870955711</td><td>1565.660571</td><td>0.06828</td></tr><tr><td>random-forest</td><td>505.3690870955711</td><td>1565.660571</td><td>0.06828</td></tr><tr><td>sgd-classifier</td><td>505.3690870955711</td><td>1565.660571</td><td>0.06828</td></tr><tr><td>simple-gcn</td><td>506.5721079074733</td><td>1548.909129</td><td>0.129933</td></tr><tr><td>very-simple-gcn</td><td>506.5721079074733</td><td>1548.909129</td><td>0.129933</td></tr></tbody></table>

Considering the tested models are not especially complex, and since the number of input memgraph stays limited, the duration of the training and testing steps is actually quite small:
<table><caption>Table 5.2: Duration times for duration of training and testing in ML/DL/FE pipeline (in seconds).</caption><thead><tr><td>Model</td><td>Min duration</td><td>Max duration</td><td>Min duration</td></tr></thead><tbody><tr><td>advanced-gcn</td><td>10.843279690391459</td><td>496.664757</td><td>2.247229</td></tr><tr><td>first-gcn</td><td>5.5063934491228075</td><td>279.007307</td><td>0.583914</td></tr><tr><td>gcn-with-dropout</td><td>8.272014035587189</td><td>418.445809</td><td>0.905496</td></tr><tr><td>logistic-regression</td><td>1.3495811305361307</td><td>4.165722</td><td>0.362695</td></tr><tr><td>random-forest</td><td>11.72722453030303</td><td>48.723031</td><td>0.315739</td></tr><tr><td>sgd-classifier</td><td>0.6751382750582751</td><td>6.405859</td><td>0.020952</td></tr><tr><td>simple-gcn</td><td>4.337255024911032</td><td>163.587265</td><td>0.509536</td></tr><tr><td>very-simple-gcn</td><td>8.188304871886121</td><td>58.307836</td><td>0.242535</td></tr></tbody></table>

All those values have been produced only by the python pipeline program. The embedding time is actually mostly accounting for the Node2Vec generation, since the other embeddings are already loaded in memory as they are produced and included in the outputs of Mem2Graph. The Node2Vec generation is the most time-consuming part of the pipeline, and it is the reason why the experiments take so long to run. Transferring this algorithm into Mem2Graph would be a huge improvement, and would allow to run the experiments with a much higher number of input memgraphs.

Throughout this report, we have introduced a lot of concepts, diverse algorithms, and different models. The experiments conducted in this research were limited in scope due to the focus around a large set of models, embeddings and hyperparameters which already represented a consequent amount of work and computational resources. However, there are many more avenues for future research, which will be introduced with the conclusion of this report.
<table><caption>Table 5.2: Duration times for duration of training and testing in ML/DL/FE pipeline (in seconds).</caption><thead><tr><td>Model</td><td>Min duration</td><td>Max duration</td><td>Min duration</td></tr></thead><tbody><tr><td>advanced-gcn</td><td>10.843279690391459</td><td>496.664757</td><td>2.247229</td></tr><tr><td>first-gcn</td><td>5.5063934491228075</td><td>279.007307</td><td>0.583914</td></tr><tr><td>gcn-with-dropout</td><td>8.272014035587189</td><td>418.445809</td><td>0.905496</td></tr><tr><td>logistic-regression</td><td>1.3495811305361307</td><td>4.165722</td><td>0.362695</td></tr><tr><td>random-forest</td><td>11.72722453030303</td><td>48.723031</td><td>0.315739</td></tr><tr><td>sgd-classifier</td><td>0.6751382750582751</td><td>6.405859</td><td>0.020952</td></tr><tr><td>simple-gcn</td><td>4.337255024911032</td><td>163.587265</td><td>0.509536</td></tr><tr><td>very-simple-gcn</td><td>8.188304871886121</td><td>58.307836</td><td>0.242535</td></tr></tbody></table>

All those values have been produced only by the python pipeline program. The embedding time is actually mostly accounting for the Node2Vec generation, since the other embeddings are already loaded in memory as they are produced and included in the outputs of Mem2Graph. The Node2Vec generation is the most time-consuming part of the pipeline, and it is the reason why the experiments take so long to run. Transferring this algorithm into Mem2Graph would be a huge improvement, and would allow to run the experiments with a much higher number of input memgraphs.

Throughout this report, we have introduced a lot of concepts, diverse algorithms, and different models. The experiments conducted in this research were limited in scope due to the focus around a large set of models, embeddings and hyperparameters which already represented a consequent amount of work and computational resources. However, there are many more avenues for future research, which will be introduced with the conclusion of this report.
# 6 Conclusion

The evolving landscape of cybersecurity necessitates robust techniques for safeguarding digital communications. OpenSSH, a pivotal element in this landscape, is a popular implementation of the Secure Shell (SSH) protocol, which enables secure communication between two networked devices. The protocol is widely used in the industry, particularly in the context of remote access to servers. Using digital forensic techniques, it is possible to extract the SSH keys from memory dumps, which can then be used to decode encrypted communications thus allowing the monitoring of controlled systems. At the crux of this Masterarbeit is the development of algorithms and machine learning models to predict SSH keys within these heap dumps, focusing on using graph-like-structures and vectorization for custom embeddings. With an interdisciplinary approach that fuses traditional feature engineering with graph-based methods as well as memory modelization for inductive reasoning and learning inspired by recent developments in Knowledge Graph (KG)s, this research not only leverages existing machine learning paradigms but also explores new avenues, such as Graph Convolutional Networks (GCN) applied to memory forensics. The present work also introduces a new memory forensics tool, *mem2graph*, which is designed to be modular and extensible, and which can be used to generate memory graphs from memory dumps.

## 6.1 Summary of Results

Below is a summary of the results achieved in the present work.

### 6.1.1 Dataset Exploration

A careful exploration of the dataset, and deep understanding of the original heap dumps have been invaluable in discovering patterns in the raw data. This exploration has allowed the development of a range of parsing algorithm able to extract information like structure and content of a given heap dump.

It has been discovered that the problem of finding the address of keys in the heap dump can be reduced to identifying the chunks that contain those keys. This allows to reduce the size of the problems from around 100 000 of blocks per heap dump, to around 1000 chunks per file. This also allows to concentrate the heap dump memory graph representation around the chunks.

It has also been demonstrated that two powerful chunk filtering techniques can drastically reduce the number of chunks to consider. The first filter criterion consists in the Shannon's entropy value of a chunk user data start bytes. This is because the keys are expected to have a high entropy compared to other raw data types. The second important criterion is the chunk byte size. It has been shown that key chunks actually have a small size in the range of possible key size. If filtering is not possible, as it is the case with GCN models, those filters can actually be converted in powerful float and boolean features.

However, its worth noting that instead of doing active node filtering and data rebalancing, we have run the experiments and model training and evaluation on full memory graphs with high imbalance ratio. This is because we wanted to test GCN that are able to handle imbalanced data with graphs of varying size, and because we wanted to test the ability of the GCN to learn from the imbalanced data.
# 6 Conclusion

The evolving landscape of cybersecurity necessitates robust techniques for safeguarding digital communications. OpenSSH, a pivotal element in this landscape, is a popular implementation of the Secure Shell (SSH) protocol, which enables secure communication between two networked devices. The protocol is widely used in the industry, particularly in the context of remote access to servers. Using digital forensic techniques, it is possible to extract the SSH keys from memory dumps, which can then be used to decode encrypted communications thus allowing the monitoring of controlled systems. At the crux of this Masterarbeit is the development of algorithms and machine learning models to predict SSH keys within these heap dumps, focusing on using graph-like-structures and vectorization for custom embeddings. With an interdisciplinary approach that fuses traditional feature engineering with graph-based methods as well as memory modelization for inductive reasoning and learning inspired by recent developments in Knowledge Graph (KG)s, this research not only leverages existing machine learning paradigms but also explores new avenues, such as Graph Convolutional Networks (GCN) applied to memory forensics. The present work also introduces a new memory forensics tool, *mem2graph*, which is designed to be modular and extensible, and which can be used to generate memory graphs from memory dumps.

## 6.1 Summary of Results

Below is a summary of the results achieved in the present work.

### 6.1.1 Dataset Exploration

A careful exploration of the dataset, and deep understanding of the original heap dumps have been invaluable in discovering patterns in the raw data. This exploration has allowed the development of a range of parsing algorithm able to extract information like structure and content of a given heap dump.

It has been discovered that the problem of finding the address of keys in the heap dump can be reduced to identifying the chunks that contain those keys. This allows to reduce the size of the problems from around 100 000 of blocks per heap dump, to around 1000 chunks per file. This also allows to concentrate the heap dump memory graph representation around the chunks.

It has also been demonstrated that two powerful chunk filtering techniques can drastically reduce the number of chunks to consider. The first filter criterion consists in the Shannon's entropy value of a chunk user data start bytes. This is because the keys are expected to have a high entropy compared to other raw data types. The second important criterion is the chunk byte size. It has been shown that key chunks actually have a small size in the range of possible key size. If filtering is not possible, as it is the case with GCN models, those filters can actually be converted in powerful float and boolean features.

However, its worth noting that instead of doing active node filtering and data rebalancing, we have run the experiments and model training and evaluation on full memory graphs with high imbalance ratio. This is because we wanted to test GCN that are able to handle imbalanced data with graphs of varying size, and because we wanted to test the ability of the GCN to learn from the imbalanced data.
### 6.1.2 Memory Graph Generation

This Masterarbeit has introduced a range of algorithms able to generate memory graphs from
memory dumps. The algorithms are designed to be as generic as possible, and can be applied to
any memory dump dataset. The algorithms are mostly implemented in the *mem2graph* program,
and many exploration and sanity checking scripts are also available in Python.

With those algorithms, it is possible to parse a RAW heap dump file, and transform it into a
memory graph, or memgraph. This graph is a data structure, where each node represents a
memory block with a precise address in the heap. Each edge represents either a pointer pointing
to another block, or materialize the fact that a block belongs to a specific chunk. In order to
reduce the size of the graph, it is possible to compact the block graph into a chunk graph, where
each node represents a chunk, and chunks are connected through their pointers. Those kinds of
graphs are only composed of Chunk Header Nodes whose address is considered the address of
the related chunk. This allows to reduce the size of the graph by a factor of 10 to 100.

### 6.1.3 Feature Engineering and Embeddings

The memory graph can be used to extract features from the memory dump, and to apply machine
learning algorithms to the memory dump. It can also be used for direct graph visualization. The
memory graph serves as a direct source of embedding whether they are made manually or using
readily available and tested techniques like RandomWalks or Node2Vec.

All those embeddings can be combined. The feature evaluation has shown that those features are
very lowly correlated, meaning that their quality is high. However, all those different embeddings
doesn't have the same results on the ML and GCN models, depending on the strengths and
weaknesses of the different models.

However, it's worth noting that the best results are always obtained when using the Node2Vec
embedding, no matter the type of model used. These observations are likely to be due to the fact
that Node2Vec is able to capture the structure of the graph, and that the structure of the graph is
the most important feature for the models, given a relatively small number of input memgraph
and considering that those memgraphs are highly imbalanced.

### 6.1.4 Conclusion on Model Performances

In this study, we compared the efficiency of classical machine learning models and Graph Convolutional Networks (GCN) in the task of key chunk prediction. Our findings indicate that the choice of model largely depends on the specific metric of interest. For a balanced performance encompassing recall, precision, and AUC, the SGD Classifier from the classical models and the Very Simple GCN from the GCN models are the most promising.

If precision is the primary metric of concern, Logistic Regression and Random Forest from the
classical models excel with perfect scores, while the Very Simple GCN leads among the GCNs. For
scenarios where high recall is crucial, the SGD Classifier and the Advanced GCN model stand out.
Both models also perform exceptionally well in class separation, as indicated by their high AUC
scores.

It's also worth noting that simpler GCN models like the Very Simple and Simple GCN tend to
perform better on limited datasets, suggesting their suitability for tasks with constrained data
### 6.1.2 Memory Graph Generation

This Masterarbeit has introduced a range of algorithms able to generate memory graphs from
memory dumps. The algorithms are designed to be as generic as possible, and can be applied to
any memory dump dataset. The algorithms are mostly implemented in the *mem2graph* program,
and many exploration and sanity checking scripts are also available in Python.

With those algorithms, it is possible to parse a RAW heap dump file, and transform it into a
memory graph, or memgraph. This graph is a data structure, where each node represents a
memory block with a precise address in the heap. Each edge represents either a pointer pointing
to another block, or materialize the fact that a block belongs to a specific chunk. In order to
reduce the size of the graph, it is possible to compact the block graph into a chunk graph, where
each node represents a chunk, and chunks are connected through their pointers. Those kinds of
graphs are only composed of Chunk Header Nodes whose address is considered the address of
the related chunk. This allows to reduce the size of the graph by a factor of 10 to 100.

### 6.1.3 Feature Engineering and Embeddings

The memory graph can be used to extract features from the memory dump, and to apply machine
learning algorithms to the memory dump. It can also be used for direct graph visualization. The
memory graph serves as a direct source of embedding whether they are made manually or using
readily available and tested techniques like RandomWalks or Node2Vec.

All those embeddings can be combined. The feature evaluation has shown that those features are
very lowly correlated, meaning that their quality is high. However, all those different embeddings
doesn't have the same results on the ML and GCN models, depending on the strengths and
weaknesses of the different models.

However, it's worth noting that the best results are always obtained when using the Node2Vec
embedding, no matter the type of model used. These observations are likely to be due to the fact
that Node2Vec is able to capture the structure of the graph, and that the structure of the graph is
the most important feature for the models, given a relatively small number of input memgraph
and considering that those memgraphs are highly imbalanced.

### 6.1.4 Conclusion on Model Performances

In this study, we compared the efficiency of classical machine learning models and Graph Convolutional Networks (GCN) in the task of key chunk prediction. Our findings indicate that the choice of model largely depends on the specific metric of interest. For a balanced performance encompassing recall, precision, and AUC, the SGD Classifier from the classical models and the Very Simple GCN from the GCN models are the most promising.

If precision is the primary metric of concern, Logistic Regression and Random Forest from the
classical models excel with perfect scores, while the Very Simple GCN leads among the GCNs. For
scenarios where high recall is crucial, the SGD Classifier and the Advanced GCN model stand out.
Both models also perform exceptionally well in class separation, as indicated by their high AUC
scores.

It's also worth noting that simpler GCN models like the Very Simple and Simple GCN tend to
perform better on limited datasets, suggesting their suitability for tasks with constrained data
availability. In contrast, more complex models like the Advanced GCN show promise in terms of
high recall but require more extensive training data for optimal performance.

In summary, the optimal model selection is contingent upon the specific requirements of the task, whether it be balanced performance, high precision, high recall, or excellent class separation. The choice of model also depends on the availability of training data. For instance, if the dataset is limited, a simpler GCN model like the Very Simple GCN is preferable. However, if the dataset is extensive, a more complex model like the Advanced GCN is more suitable.

## 6.2 Outlook on Future Work

The current report, in conjunction with the associated Masterarbeit, has introduced numerous novel algorithms and implementations. These have been instrumental in addressing the initial research questions. However, as with most research endeavors, new queries and potential avenues for enhancement have emerged, paving the way towards further exploration.

The methodologies and algorithms introduced for the OpenSSH memory dump dataset are versatile and can be extended to other memory dump datasets utilizing the GLIBC library. Given that this library is the default for Linux, adapting the methods from this Masterarbeit to other applications requires minimal effort. The *mem2graph* program is inherently modular and built for extensibility. Furthermore, this tool can be employed to produce memory graphs for diverse datasets. Thanks to the universal character of the generated embeddings and memory graphs, new datasets can be readily integrated into the ML and DL pipelines crafted in Python. While an extensive array of features and embedding techniques have been explored in this report, there remains ample opportunity for innovative experimentation.

For a seamless fusion of machine learning into the *mem2graph* program, further effort is required. Embedding machine learning immediately post-memory graph creation can substantially boost efficiency, particularly when aiming to craft a real-time OpenSSH memory forensics utility. However, this integration is challenging due to the current limited ML support within Rust.

Another avenue for enhancement involves analyzing the effects of different C libraries on allocated chunks and the layout of heap dump memory. Investigating various languages could also be insightful. Depending on the level of variation encountered, modifications to the algorithms might be required, especially concerning the architecture involved in generating or extracting heap dump configurations. Pursuing this direction could significantly advance the development of a universal machine learning-assisted memory forensics tool for key extraction.

While the background section underscores the vast array of ML architectures available, it's clear that not all can be thoroughly explored. This research has primarily addressed the most common and promising ones, yet numerous others await investigation. The tools crafted to bolster ML pipelines present a solid foundation for such endeavors. Another dimension to consider is hyperparameter optimization. Given the constraints of time and resources, only certain parameter ranges were tested. Expanding these tests, incorporating larger datasets, and harnessing increased computational capacity can directly enhance performance.
availability. In contrast, more complex models like the Advanced GCN show promise in terms of
high recall but require more extensive training data for optimal performance.

In summary, the optimal model selection is contingent upon the specific requirements of the task, whether it be balanced performance, high precision, high recall, or excellent class separation. The choice of model also depends on the availability of training data. For instance, if the dataset is limited, a simpler GCN model like the Very Simple GCN is preferable. However, if the dataset is extensive, a more complex model like the Advanced GCN is more suitable.

## 6.2 Outlook on Future Work

The current report, in conjunction with the associated Masterarbeit, has introduced numerous novel algorithms and implementations. These have been instrumental in addressing the initial research questions. However, as with most research endeavors, new queries and potential avenues for enhancement have emerged, paving the way towards further exploration.

The methodologies and algorithms introduced for the OpenSSH memory dump dataset are versatile and can be extended to other memory dump datasets utilizing the GLIBC library. Given that this library is the default for Linux, adapting the methods from this Masterarbeit to other applications requires minimal effort. The *mem2graph* program is inherently modular and built for extensibility. Furthermore, this tool can be employed to produce memory graphs for diverse datasets. Thanks to the universal character of the generated embeddings and memory graphs, new datasets can be readily integrated into the ML and DL pipelines crafted in Python. While an extensive array of features and embedding techniques have been explored in this report, there remains ample opportunity for innovative experimentation.

For a seamless fusion of machine learning into the *mem2graph* program, further effort is required. Embedding machine learning immediately post-memory graph creation can substantially boost efficiency, particularly when aiming to craft a real-time OpenSSH memory forensics utility. However, this integration is challenging due to the current limited ML support within Rust.

Another avenue for enhancement involves analyzing the effects of different C libraries on allocated chunks and the layout of heap dump memory. Investigating various languages could also be insightful. Depending on the level of variation encountered, modifications to the algorithms might be required, especially concerning the architecture involved in generating or extracting heap dump configurations. Pursuing this direction could significantly advance the development of a universal machine learning-assisted memory forensics tool for key extraction.

While the background section underscores the vast array of ML architectures available, it's clear that not all can be thoroughly explored. This research has primarily addressed the most common and promising ones, yet numerous others await investigation. The tools crafted to bolster ML pipelines present a solid foundation for such endeavors. Another dimension to consider is hyperparameter optimization. Given the constraints of time and resources, only certain parameter ranges were tested. Expanding these tests, incorporating larger datasets, and harnessing increased computational capacity can directly enhance performance.
# Appendix

## .1 Code and files

```json
strict digraph "17016-1643962152" {
    "CHN(0x558343d21d40)" [label="CHN(1)" color="cyan" style=filled shape=square];
    "CHN(0x558343d1a448)" [label="CHN(2)" color="cyan" style=filled shape=square];
    "VN(0x558343d1a450)" [label="VN" color="grey" style=filled];
    "VN(0x558343d1a458)" [label="VN" color="grey" style=filled];
    "PN(0x558343d24ae8)" [label="PN" color="orange" style=filled shape=hexagon];
    "KN_KEY_A(0x558343d29460)" [label="KN(A)" color="green" style=filled];
    "KN_KEY_B(0x558343d2b960)" [label="KN(B)" color="green" style=filled];
    "CHN(0x558343d21d40)" -> "KN_KEY_A(0x558343d29460)" [label="dts" weight=1]
    "PN(0x558343d204e8)" -> "KN_KEY_A(0x558343d29460)" [label="ptr" weight=1]
    "CHN(0x558343d21d40)" -> "KN_KEY_B(0x558343d2b960)" [label="dts" weight=1]
    "PN(0x558343d2deb8)" -> "KN_KEY_B(0x558343d2b960)" [label="ptr" weight=1]
    "CHN(0x558343d21d40)" -> "KN_KEY_C(0x558343d29080)" [label="dts" weight=1]
    "PN(0x558343d204e0)" -> "KN_KEY_C(0x558343d29080)" [label="ptr" weight=1]
    "PN(0x558343d24ae8)" -> "VN(0x558343d1a010)" [label="ptr" weight=1]
    "PN(0x558343d1a240)" -> "VN(0x558343d20680)" [label="ptr" weight=1]
}
```

<caption>Listing 1: The DOT file of uncompressed block memgraph, here Training/basic/V_7_1_P1/24/17016-1643962152-heap/raw, with real addresses. Output is cropped.</caption>
# Appendix

## .1 Code and files

```json
strict digraph "17016-1643962152" {
    "CHN(0x558343d21d40)" [label="CHN(1)" color="cyan" style=filled shape=square];
    "CHN(0x558343d1a448)" [label="CHN(2)" color="cyan" style=filled shape=square];
    "VN(0x558343d1a450)" [label="VN" color="grey" style=filled];
    "VN(0x558343d1a458)" [label="VN" color="grey" style=filled];
    "PN(0x558343d24ae8)" [label="PN" color="orange" style=filled shape=hexagon];
    "KN_KEY_A(0x558343d29460)" [label="KN(A)" color="green" style=filled];
    "KN_KEY_B(0x558343d2b960)" [label="KN(B)" color="green" style=filled];
    "CHN(0x558343d21d40)" -> "KN_KEY_A(0x558343d29460)" [label="dts" weight=1]
    "PN(0x558343d204e8)" -> "KN_KEY_A(0x558343d29460)" [label="ptr" weight=1]
    "CHN(0x558343d21d40)" -> "KN_KEY_B(0x558343d2b960)" [label="dts" weight=1]
    "PN(0x558343d2deb8)" -> "KN_KEY_B(0x558343d2b960)" [label="ptr" weight=1]
    "CHN(0x558343d21d40)" -> "KN_KEY_C(0x558343d29080)" [label="dts" weight=1]
    "PN(0x558343d204e0)" -> "KN_KEY_C(0x558343d29080)" [label="ptr" weight=1]
    "PN(0x558343d24ae8)" -> "VN(0x558343d1a010)" [label="ptr" weight=1]
    "PN(0x558343d1a240)" -> "VN(0x558343d20680)" [label="ptr" weight=1]
}
```

<caption>Listing 1: The DOT file of uncompressed block memgraph, here Training/basic/V_7_1_P1/24/17016-1643962152-heap/raw, with real addresses. Output is cropped.</caption>
## .2 Memory Graphs

<figure><img src="image_21.png" /><figcaption>Figure 1: Visualization of the full memory graph generated from Training/scp/V_7_8_P1/16/302-1644391327-heap/raw.</figcaption></figure>

<figure><img src="image_22.png" /><figcaption>Figure 2: Visualization of the full memory graph generated from Training/basic/V_7_1_P1/24/17016-1643962152-heap/raw.</figcaption></figure>
## .2 Memory Graphs

<figure><img src="image_22.png" /><figcaption>Figure 1: Visualization of the full memory graph generated from Training/scp/V_7_8_P1/16/302-1644391327-heap/raw.</figcaption></figure>

<figure><img src="image_23.png" /><figcaption>Figure 2: Visualization of the full memory graph generated from Training/basic/V_7_1_P1/24/17016-1643962152-heap/raw.</figcaption></figure>
<figure><img src="image_23.png" /><figcaption>Figure 3: Visualization of a truncated memory graph generated from *Training/basic/V_7_1_-P1/24/17016-1643962152-heap/raw*. Here with real addresses.</figcaption></figure>

Generated using a slightly different command, for better layout of the nodes:

1

sfdp -Gsize=30! -Goverlap=ortho -Tpng 17016-1643962152_truncated.gv > 17016-1643962152_truncated.png

<caption>Listing 2: Command used to generate the memory graph visualization of *Training/basic/V_7_1_-P1/24/17016-1643962152-heap/raw* here using real addresses.</caption>
<figure><img src="image_24.png" /><figcaption>Figure 3: Visualization of a truncated memory graph generated from *Training/basic/V_7_1_-P1/24/17016-1643962152-heap/raw*. Here with real addresses.</figcaption></figure>

Generated using a slightly different command, for better layout of the nodes:

1

sfdp -Gsize=30! -Goverlap=ortho -Tpng 17016-1643962152_truncated.gv > 17016-1643962152_truncated.png

<caption>Listing 2: Command used to generate the memory graph visualization of *Training/basic/V_7_1_-P1/24/17016-1643962152-heap/raw* here using real addresses.</caption>
<figure><img src="image_24.png" /><figcaption>Figure 4: Visualization of a chunk memory graph generated from Validation/Validation/basic/V_7_8_P1/24/8708-1643979488-heapraw.</figcaption></figure>

<figure><img src="image_25.png" /><figcaption>Figure 5: Visualization of a chunk memory graph generated from Training/Training/basic/V_6_8_P1/24/28621-1643890740-heapraw.</figcaption></figure>
<figure><img src="image_25.png" /><figcaption>Figure 4: Visualization of a chunk memory graph generated from Validation/Validation/basic/V_7_8_P1/24/8708-1643979488-heapraw.</figcaption></figure>

<figure><img src="image_26.png" /><figcaption>Figure 5: Visualization of a chunk memory graph generated from Training/Training/basic/V_6_8_P1/24/28621-1643890740-heapraw.</figcaption></figure>
## 3 Latest ML Experiment results

The following are the latest results for ML experiments. Those tables were generated after the submission of the thesis.

<table><caption>Table 1: Best instance for each model, with respect to accuracy.</caption><thead><tr><td>Model</td><td>Accuracy</td><td>Precision</td><td>Recall</td><td>F1 Score</td><td>Embedding</td></tr></thead><tbody><tr><td>random-forest</td><td>0.9984</td><td>1.0000</td><td>0.0833</td><td>0.1538</td><td>chunk-start-bytes</td></tr><tr><td>sgd-classifier</td><td>0.9984</td><td>0.6250</td><td>0.2083</td><td>0.3125</td><td>node2vec</td></tr><tr><td>logistic-regression</td><td>0.9983</td><td>1.0000</td><td>0.0417</td><td>0.0800</td><td>node2vec</td></tr><tr><td>advanced-gcn</td><td>0.9969</td><td>0.0000</td><td>0.0000</td><td>0.0000</td><td>node2vec</td></tr><tr><td>gcn-with-dropout</td><td>0.9969</td><td>0.0000</td><td>0.0000</td><td>0.0000</td><td>node2vec</td></tr><tr><td>first-gcn</td><td>0.9963</td><td>0.0000</td><td>0.0000</td><td>0.0000</td><td>node2vec-chunk-statistic</td></tr><tr><td>simple-gcn</td><td>0.9962</td><td>0.0000</td><td>0.0000</td><td>0.0000</td><td>chunk-statistic</td></tr><tr><td>very-simple-gcn</td><td>0.9959</td><td>0.0000</td><td>0.0000</td><td>0.0000</td><td>node2vec</td></tr></tbody></table>

<table><caption>Table 2: Best instance for each model, with respect to precision.</caption><thead><tr><td>Model</td><td>Accuracy</td><td>Precision</td><td>Recall</td><td>F1 Score</td><td>Embedding</td></tr></thead><tbody><tr><td>logistic-regression</td><td>0.9944</td><td>1.0000</td><td>0.0417</td><td>0.0800</td><td>node2vec</td></tr><tr><td>random-forest</td><td>0.9983</td><td>1.0000</td><td>0.0417</td><td>0.0800</td><td>chunk-start-bytes</td></tr><tr><td>sgd-classifier</td><td>0.9983</td><td>1.0000</td><td>0.0417</td><td>0.0800</td><td>node2vec</td></tr><tr><td>very-simple-gcn</td><td>0.9946</td><td>0.6000</td><td>0.5000</td><td>0.5455</td><td>node2vec</td></tr><tr><td>first-gcn</td><td>0.9935</td><td>0.5000</td><td>0.5000</td><td>0.5000</td><td>node2vec</td></tr><tr><td>simple-gcn</td><td>0.9935</td><td>0.5000</td><td>0.5000</td><td>0.5000</td><td>node2vec</td></tr><tr><td>gcn-with-dropout</td><td>0.9920</td><td>0.3500</td><td>0.2333</td><td>0.2800</td><td>node2vec</td></tr><tr><td>advanced-gcn</td><td>0.9898</td><td>0.2097</td><td>0.4333</td><td>0.2826</td><td>node2vec</td></tr></tbody></table>

<table><caption>Table 3: Best instance for each model, with respect to recall.</caption><thead><tr><td>Model</td><td>Accuracy</td><td>Precision</td><td>Recall</td><td>F1 Score</td><td>Embedding</td></tr></thead><tbody><tr><td>first-gcn</td><td>0.9826</td><td>0.2727</td><td>1.0000</td><td>0.4286</td><td>node2vec</td></tr><tr><td>sgd-classifier</td><td>0.9924</td><td>0.4615</td><td>1.0000</td><td>0.6316</td><td>node2vec</td></tr><tr><td>simple-gcn</td><td>0.9783</td><td>0.2308</td><td>1.0000</td><td>0.3750</td><td>node2vec</td></tr><tr><td>very-simple-gcn</td><td>0.9815</td><td>0.2609</td><td>1.0000</td><td>0.4138</td><td>node2vec</td></tr><tr><td>advanced-gcn</td><td>0.8887</td><td>0.0533</td><td>0.9000</td><td>0.1006</td><td>node2vec</td></tr><tr><td>gcn-with-dropout</td><td>0.9613</td><td>0.0863</td><td>0.8000</td><td>0.1558</td><td>node2vec</td></tr><tr><td>logistic-regression</td><td>0.9912</td><td>0.3333</td><td>0.5000</td><td>0.4000</td><td>node2vec</td></tr><tr><td>random-forest</td><td>0.9984</td><td>1.0000</td><td>0.0833</td><td>0.1538</td><td>chunk-start-bytes</td></tr></tbody></table>
## 3 Latest ML Experiment results

The following are the latest results for ML experiments. Those tables were generated after the submission of the thesis.

<table><caption>Table 1: Best instance for each model, with respect to accuracy.</caption><thead><tr><td>Model</td><td>Accuracy</td><td>Precision</td><td>Recall</td><td>F1 Score</td><td>Embedding</td></tr></thead><tbody><tr><td>random-forest</td><td>0.9984</td><td>1.0000</td><td>0.0833</td><td>0.1538</td><td>chunk-start-bytes</td></tr><tr><td>sgd-classifier</td><td>0.9984</td><td>0.6250</td><td>0.2083</td><td>0.3125</td><td>node2vec</td></tr><tr><td>logistic-regression</td><td>0.9983</td><td>1.0000</td><td>0.0417</td><td>0.0800</td><td>node2vec</td></tr><tr><td>advanced-gcn</td><td>0.9969</td><td>0.0000</td><td>0.0000</td><td>0.0000</td><td>node2vec</td></tr><tr><td>gcn-with-dropout</td><td>0.9969</td><td>0.0000</td><td>0.0000</td><td>0.0000</td><td>node2vec</td></tr><tr><td>first-gcn</td><td>0.9963</td><td>0.0000</td><td>0.0000</td><td>0.0000</td><td>node2vec-chunk-statistic</td></tr><tr><td>simple-gcn</td><td>0.9962</td><td>0.0000</td><td>0.0000</td><td>0.0000</td><td>chunk-statistic</td></tr><tr><td>very-simple-gcn</td><td>0.9959</td><td>0.0000</td><td>0.0000</td><td>0.0000</td><td>node2vec</td></tr></tbody></table>

<table><caption>Table 2: Best instance for each model, with respect to precision.</caption><thead><tr><td>Model</td><td>Accuracy</td><td>Precision</td><td>Recall</td><td>F1 Score</td><td>Embedding</td></tr></thead><tbody><tr><td>logistic-regression</td><td>0.9944</td><td>1.0000</td><td>0.0417</td><td>0.0800</td><td>node2vec</td></tr><tr><td>random-forest</td><td>0.9983</td><td>1.0000</td><td>0.0417</td><td>0.0800</td><td>chunk-start-bytes</td></tr><tr><td>sgd-classifier</td><td>0.9983</td><td>1.0000</td><td>0.0417</td><td>0.0800</td><td>node2vec</td></tr><tr><td>very-simple-gcn</td><td>0.9946</td><td>0.6000</td><td>0.5000</td><td>0.5455</td><td>node2vec</td></tr><tr><td>first-gcn</td><td>0.9935</td><td>0.5000</td><td>0.5000</td><td>0.5000</td><td>node2vec</td></tr><tr><td>simple-gcn</td><td>0.9935</td><td>0.5000</td><td>0.5000</td><td>0.5000</td><td>node2vec</td></tr><tr><td>gcn-with-dropout</td><td>0.9920</td><td>0.3500</td><td>0.2333</td><td>0.2800</td><td>node2vec</td></tr><tr><td>advanced-gcn</td><td>0.9898</td><td>0.2097</td><td>0.4333</td><td>0.2826</td><td>node2vec</td></tr></tbody></table>

<table><caption>Table 3: Best instance for each model, with respect to recall.</caption><thead><tr><td>Model</td><td>Accuracy</td><td>Precision</td><td>Recall</td><td>F1 Score</td><td>Embedding</td></tr></thead><tbody><tr><td>first-gcn</td><td>0.9826</td><td>0.2727</td><td>1.0000</td><td>0.4286</td><td>node2vec</td></tr><tr><td>sgd-classifier</td><td>0.9924</td><td>0.4615</td><td>1.0000</td><td>0.6316</td><td>node2vec</td></tr><tr><td>simple-gcn</td><td>0.9783</td><td>0.2308</td><td>1.0000</td><td>0.3750</td><td>node2vec</td></tr><tr><td>very-simple-gcn</td><td>0.9815</td><td>0.2609</td><td>1.0000</td><td>0.4138</td><td>node2vec</td></tr><tr><td>advanced-gcn</td><td>0.8887</td><td>0.0533</td><td>0.9000</td><td>0.1006</td><td>node2vec</td></tr><tr><td>gcn-with-dropout</td><td>0.9613</td><td>0.0863</td><td>0.8000</td><td>0.1558</td><td>node2vec</td></tr><tr><td>logistic-regression</td><td>0.9912</td><td>0.3333</td><td>0.5000</td><td>0.4000</td><td>node2vec</td></tr><tr><td>random-forest</td><td>0.9984</td><td>1.0000</td><td>0.0833</td><td>0.1538</td><td>chunk-start-bytes</td></tr></tbody></table>
<table><caption>Table 5: Best model instance for each metric.</caption><thead><tr><th>Metric</th><th>Model</th><th>Accuracy</th><th>Precision</th><th>Recall</th><th>F1 Score</th><th>Embedding</th></tr></thead><tbody><tr><td>accuracy</td><td>random-forest</td><td>0.9984</td><td>1.0000</td><td>0.0833</td><td>0.1538</td><td>chunk-start-bytes</td></tr><tr><td>precision</td><td>logistic-regression</td><td>0.9944</td><td>1.0000</td><td>0.0417</td><td>0.0800</td><td>node2vec</td></tr><tr><td>recall</td><td>first-gcn</td><td>0.9826</td><td>0.2727</td><td>1.0000</td><td>0.4286</td><td>node2vec</td></tr><tr><td>f1 score</td><td>sgd-classifier</td><td>0.9924</td><td>0.4615</td><td>1.0000</td><td>0.6316</td><td>node2vec</td></tr></tbody></table>

<table><caption>Table 4: Best instance for each model, with respect to f1 score.</caption><thead><tr><th>Model</th><th>Accuracy</th><th>Precision</th><th>Recall</th><th>F1 Score</th><th>Embedding</th></tr></thead><tbody><tr><td>sgd-classifier</td><td>0.9924</td><td>0.4615</td><td>1.0000</td><td>0.6316</td><td>node2vec</td></tr><tr><td>very-simple-gcn</td><td>0.9946</td><td>0.6000</td><td>0.5000</td><td>0.5455</td><td>node2vec</td></tr><tr><td>first-gcn</td><td>0.9935</td><td>0.5000</td><td>0.5000</td><td>0.5000</td><td>node2vec</td></tr><tr><td>simple-gcn</td><td>0.9935</td><td>0.5000</td><td>0.5000</td><td>0.5000</td><td>node2vec</td></tr><tr><td>logistic-regression</td><td>0.9912</td><td>0.3333</td><td>0.5000</td><td>0.4000</td><td>node2vec</td></tr><tr><td>gcn-with-dropout</td><td>0.9858</td><td>0.2110</td><td>0.7667</td><td>0.3309</td><td>node2vec</td></tr><tr><td>advanced-gcn</td><td>0.9898</td><td>0.2097</td><td>0.4333</td><td>0.2826</td><td>node2vec</td></tr><tr><td>random-forest</td><td>0.9984</td><td>1.0000</td><td>0.0833</td><td>0.1538</td><td>chunk-start-bytes</td></tr></tbody></table>
<table><caption>Table 5: Best model instance for each metric.</caption><thead><tr><th>Metric</th><th>Model</th><th>Accuracy</th><th>Precision</th><th>Recall</th><th>F1 Score</th><th>Embedding</th></tr></thead><tbody><tr><td>accuracy</td><td>random-forest</td><td>0.9984</td><td>1.0000</td><td>0.0833</td><td>0.1538</td><td>chunk-start-bytes</td></tr><tr><td>precision</td><td>logistic-regression</td><td>0.9944</td><td>1.0000</td><td>0.0417</td><td>0.0800</td><td>node2vec</td></tr><tr><td>recall</td><td>first-gcn</td><td>0.9826</td><td>0.2727</td><td>1.0000</td><td>0.4286</td><td>node2vec</td></tr><tr><td>f1 score</td><td>sgd-classifier</td><td>0.9924</td><td>0.4615</td><td>1.0000</td><td>0.6316</td><td>node2vec</td></tr></tbody></table>

<table><caption>Table 4: Best instance for each model, with respect to f1 score.</caption><thead><tr><th>Model</th><th>Accuracy</th><th>Precision</th><th>Recall</th><th>F1 Score</th><th>Embedding</th></tr></thead><tbody><tr><td>sgd-classifier</td><td>0.9924</td><td>0.4615</td><td>1.0000</td><td>0.6316</td><td>node2vec</td></tr><tr><td>very-simple-gcn</td><td>0.9946</td><td>0.6000</td><td>0.5000</td><td>0.5455</td><td>node2vec</td></tr><tr><td>first-gcn</td><td>0.9935</td><td>0.5000</td><td>0.5000</td><td>0.5000</td><td>node2vec</td></tr><tr><td>simple-gcn</td><td>0.9935</td><td>0.5000</td><td>0.5000</td><td>0.5000</td><td>node2vec</td></tr><tr><td>logistic-regression</td><td>0.9912</td><td>0.3333</td><td>0.5000</td><td>0.4000</td><td>node2vec</td></tr><tr><td>gcn-with-dropout</td><td>0.9858</td><td>0.2110</td><td>0.7667</td><td>0.3309</td><td>node2vec</td></tr><tr><td>advanced-gcn</td><td>0.9898</td><td>0.2097</td><td>0.4333</td><td>0.2826</td><td>node2vec</td></tr><tr><td>random-forest</td><td>0.9984</td><td>1.0000</td><td>0.0833</td><td>0.1538</td><td>chunk-start-bytes</td></tr></tbody></table>
# Acronyms

**AI** Artificial Intelligence. 18

**DEL** Directed Edge-labelled Graphs. 16

**DL** Deep Learning. 96, 118

**ESS** Estimated Security Strength. 8

**FE** Feature Evaluation. 96

**GCN** Graph Convolutional Networks. 2, 96, 104, 110, 116, 117

**GNN** Graph Neural Network. 32, 33

**GRU** Gated Recurrent Units. 31

**KG** Knowledge Graph. 12, 16, 17, 74, 116

**KNN** K-Nearest Neighbors. 20

**LDA** Linear Discriminant Analysis. 20

**LLM** Large Language Model. 24

**LSB** Least Significant Bit. 61, 64, 69

**ML** Machine Learning. 2, 18, 20, 28, 29, 40, 41, 49, 58–60, 76, 87, 96, 117, 118

**NLP** Natural Language Processing. 22

**OWL** Web Ontology Language. 17

**PCA** Principal Component Analysis. 20

**RDF** Resource Description Framework. 16, 17, 74

**RNN** Recurrent Neural Networks. 30

**SMOTE** Synthetic Minority Over-sampling Technique. 37

**SSH** Secure Shell Protocol. ii, 5, 8, 116

**SVM** Support Vector Machine. 20

**t-SNE** t-distributed Stochastic Neighbor Embedding. 20

**VMI** Virtual Machine Introspection. 36
# Acronyms

**AI** Artificial Intelligence. 18

**DEL** Directed Edge-labelled Graphs. 16

**DL** Deep Learning. 96, 118

**ESS** Estimated Security Strength. 8

**FE** Feature Evaluation. 96

**GCN** Graph Convolutional Networks. 2, 96, 104, 110, 116, 117

**GNN** Graph Neural Network. 32, 33

**GRU** Gated Recurrent Units. 31

**KG** Knowledge Graph. 12, 16, 17, 74, 116

**KNN** K-Nearest Neighbors. 20

**LDA** Linear Discriminant Analysis. 20

**LLM** Large Language Model. 24

**LSB** Least Significant Bit. 61, 64, 69

**ML** Machine Learning. 2, 18, 20, 28, 29, 40, 41, 49, 58–60, 76, 87, 96, 117, 118

**NLP** Natural Language Processing. 22

**OWL** Web Ontology Language. 17

**PCA** Principal Component Analysis. 20

**RDF** Resource Description Framework. 16, 17, 74

**RNN** Recurrent Neural Networks. 30

**SMOTE** Synthetic Minority Over-sampling Technique. 37

**SSH** Secure Shell Protocol. ii, 5, 8, 116

**SVM** Support Vector Machine. 20

**t-SNE** t-distributed Stochastic Neighbor Embedding. 20

**VMI** Virtual Machine Introspection. 36
# Glossary

**CHN** Chunk Header Node. This is a node whose bytes have been identified as a data structure header. In the graph, this node is the root node of an malloc-allocated memory chunk.. 75

**KN** Key Node. This is a node whose bytes have been identified as a key. This identification relies both on the annotations and some verification checks.. 75

**memory graph** A memory graph, or *memgraph* is a graph representation of a memory dump. This graph can be a graph of blocks, where each node in the graph corresponds to a block of 8 bytes in the heap dump and each edge corresponds to a pointer from one block to another, or describes which blocks are part of a chunk whose root note is a Chunk Header Node. It can also be a graph of chunks (only CHNs), where each node in the graph corresponds to a chunk in heap dump and each edge corresponds to a pointer from one object to another.. 77

**PN** Pointer Node. This is a node whose bytes have been identified as a pointer.. 75

**VN** Value Node. These are all blocks that have not been identified. It is the default node type.. 75
# Glossary

**CHN** Chunk Header Node. This is a node whose bytes have been identified as a data structure header. In the graph, this node is the root node of an malloc-allocated memory chunk.. 75

**KN** Key Node. This is a node whose bytes have been identified as a key. This identification relies both on the annotations and some verification checks.. 75

**memory graph** A memory graph, or *memgraph* is a graph representation of a memory dump. This graph can be a graph of blocks, where each node in the graph corresponds to a block of 8 bytes in the heap dump and each edge corresponds to a pointer from one block to another, or describes which blocks are part of a chunk whose root note is a Chunk Header Node. It can also be a graph of chunks (only CHNs), where each node in the graph corresponds to a chunk in heap dump and each edge corresponds to a pointer from one object to another.. 77

**PN** Pointer Node. This is a node whose bytes have been identified as a pointer.. 75

**VN** Value Node. These are all blocks that have not been identified. It is the default node type.. 75
References

[0] Stewart Sentanoe and Hans P. Reiser. „SSHkex: Leveraging virtual machine introspection for extracting SSH keys and decrypting SSH network traffic“. en. In: *Forensic Science International: Digital Investigation* 40 (2022), p. 301337. doi: 10.1016/j.fsidi.2022.30133 7. url: https://linkinghub.elsevier.com/retrieve/pii/S2666281722000063.

[0] Clement Lahoche. *Structure embeddings for OpenSSH heap dump analysis*. en. Available online. 2023. url: https://github.com/passau-masterarbeit-2023/masterarbeit-report-clement (visited on 11/01/2023).

[0] Matthias Fey and Jan Eric Lenssen. *Fast Graph Representation Learning with PyTorch Geometric*. 2019. arXiv: 1903.02428 [cs.LG].

[0] Emden R. Gansner, Eleftherios Koutsofios, and Stephen North. *Drawing graphs with dot*. Accessed: 2023-10-27. Jan. 2015. url: https://graphviz.org/pdf/dotguide.pdf.

[0] Wolfram Gloger and Doug Lea. *Malloc implementation for multiple threads without lock contention*. Accessed: 2023-09-22. Free Software Foundation, Inc. 2001. url: https://elixir. r bootlin.com/glibc/glibc-2.28/source/malloc/malloc.c (visited on 09/22/2023).

[0] DJ Delorie et al. *Malloc Internals*. Accessed: 2023-09-22. Sourceware. 2023. url: https://sourceware.org/glibc/wiki/MallocInternals (visited on 09/25/2023).

[0] Unknown. *How does glibc malloc work?* Asked 6 years, 6 months ago; Modified 3 years, 6 months ago; Viewed 11k times; Accessed: 2023-09-25. 2023. url: https://reverseengineering stackexchange.com/questions/15033/how-does-glibc-malloc-work/15038#15038.

[0] Joep Meindertma. *Ordered data in RDF: About Arrays, Lists, Collections, Sequences and Pagination*. Accessed: 2023-09-22. Feb. 7, 2020. url: https://ontola.io/blog/ordered-data-in-rdf (visited on 09/22/2023).

[0] Christofer Fellicious et al. „SmartKex: Machine Learning Assisted SSH Keys Extraction From The Heap Dump“. In: arXiv:2209.05243 (Sept. 2022). arXiv:2209.05243 [cs]. doi: 10.48550/arXiv.2209.05243. url: http://arxiv.org/abs/2209.05243.

[0] M. Baushke. *Key Exchange (KEX) Method Updates and Recommendations for Secure Shell (SSH)*. RFC 9142. Updates: 4250, 4253, 4432, 4462; Errata exist. Internet Engineering Task Force (IETF), Jan. 2022.

[0] Nicole Perlroth, Jeff Larson, and Scott Shane. „N.S.A. Able to Foil Basic Safeguards of Privacy on Web“. In: *The New York Times* (Sept. 2013). url: https://www.nytimes.com/2013/09/06/us/nsa-foils-much-internet-encryption.html.

[0] James Ball, Julian Borger, and Glenn Greenwald. „Revealed: how US and UK spy agencies defeat internet privacy and security“. In: *The Guardian* (Sept. 2013). Published at 11.24 BST. url: https://www.theguardian.com/world/2013/sep/05/nsa-gchq-encryption-codes-security.

[0] Aris Adamantiadis. *OpenSSH introduces curve25519-sha256@libssh.org key exchange!* Retrieved 2023-09-05. Nov. 2013. url: https://www.libssh.org/2013/11/03/openssh-introduces-curve25519-sha256/libssh-org-key-exchange/.

[0] OpenSSH. *OpenSSH 5.7 release notes*. Retrieved 2022-11-13. Jan. 2011. url: https://www.openssh.com/txt/release-5.7.

[0] Stewart Sentanoe, Benjamin Taubmann, and Hans P. Reiser. „Sarracenia: Enhancing the Performance and Stealthiness of SSH Honeypots Using Virtual Machine Introspection“. In: *Lecture Notes in Computer Science*. Vol. 11252. Conference paper. Nov. 2018. url: https://link.springer.com/chapter/10.1007/978-3-030-03638-6_16.
References

[0] Stewart Sentanoe and Hans P. Reiser. „SSHkex: Leveraging virtual machine introspection for extracting SSH keys and decrypting SSH network traffic“. en. In: *Forensic Science International: Digital Investigation* 40 (2022), p. 301337. doi: 10.1016/j.fsidi.2022.30133 7. url: https://linkinghub.elsevier.com/retrieve/pii/S2666281722000063.

[0] Clement Lahoche. *Structure embeddings for OpenSSH heap dump analysis*. en. Available online. 2023. url: https://github.com/passau-masterarbeit-2023/masterarbeit-report-clement (visited on 11/01/2023).

[0] Matthias Fey and Jan Eric Lenssen. *Fast Graph Representation Learning with PyTorch Geometric*. 2019. arXiv: 1903.02428 [cs.LG].

[0] Emden R. Gansner, Eleftherios Koutsofios, and Stephen North. *Drawing graphs with dot*. Accessed: 2023-10-27. Jan. 2015. url: https://graphviz.org/pdf/dotguide.pdf.

[0] Wolfram Gloger and Doug Lea. *Malloc implementation for multiple threads without lock contention*. Accessed: 2023-09-22. Free Software Foundation, Inc. 2001. url: https://elixir. r bootlin.com/glibc/glibc-2.28/source/malloc/malloc.c (visited on 09/22/2023).

[0] DJ Delorie et al. *Malloc Internals*. Accessed: 2023-09-22. Sourceware. 2023. url: https://sourceware.org/glibc/wiki/MallocInternals (visited on 09/25/2023).

[0] Unknown. *How does glibc malloc work?* Asked 6 years, 6 months ago; Modified 3 years, 6 months ago; Viewed 11k times; Accessed: 2023-09-25. 2023. url: https://reverseengineering stackexchange.com/questions/15033/how-does-glibc-malloc-work/15038#15038.

[0] Joep Meindertma. *Ordered data in RDF: About Arrays, Lists, Collections, Sequences and Pagination*. Accessed: 2023-09-22. Feb. 7, 2020. url: https://ontola.io/blog/ordered-data-in-rdf (visited on 09/22/2023).

[0] Christofer Fellicious et al. „SmartKex: Machine Learning Assisted SSH Keys Extraction From The Heap Dump“. In: arXiv:2209.05243 (Sept. 2022). arXiv:2209.05243 [cs]. doi: 10.48550/arXiv.2209.05243. url: http://arxiv.org/abs/2209.05243.

[0] M. Baushke. *Key Exchange (KEX) Method Updates and Recommendations for Secure Shell (SSH)*. RFC 9142. Updates: 4250, 4253, 4432, 4462; Errata exist. Internet Engineering Task Force (IETF), Jan. 2022.

[0] Nicole Perlroth, Jeff Larson, and Scott Shane. „N.S.A. Able to Foil Basic Safeguards of Privacy on Web“. In: *The New York Times* (Sept. 2013). url: https://www.nytimes.com/2013/09/06/us/nsa-foils-much-internet-encryption.html.

[0] James Ball, Julian Borger, and Glenn Greenwald. „Revealed: how US and UK spy agencies defeat internet privacy and security“. In: *The Guardian* (Sept. 2013). Published at 11.24 BST. url: https://www.theguardian.com/world/2013/sep/05/nsa-gchq-encryption-codes-security.

[0] Aris Adamantiadis. *OpenSSH introduces curve25519-sha256@libssh.org key exchange!* Retrieved 2023-09-05. Nov. 2013. url: https://www.libssh.org/2013/11/03/openssh-introduces-curve25519-sha256/libssh-org-key-exchange/.

[0] OpenSSH. *OpenSSH 5.7 release notes*. Retrieved 2022-11-13. Jan. 2011. url: https://www.openssh.com/txt/release-5.7.

[0] Stewart Sentanoe, Benjamin Taubmann, and Hans P. Reiser. „Sarracenia: Enhancing the Performance and Stealthiness of SSH Honeypots Using Virtual Machine Introspection“. In: *Lecture Notes in Computer Science*. Vol. 11252. Conference paper. Nov. 2018. url: https://link.springer.com/chapter/10.1007/978-3-030-03638-6_16.
[0] OpenSSH. *OpenSSH 6.5 release notes*. Retrieved 2022-11-13. Jan. 2014. url: https://www.openssh.com/txt/release-6.5.

[0] OpenSSH. *OpenSSH 7.0 release notes*. Retrieved 2022-11-13. Aug. 2015. url: https://www.openssh.com/txt/release-7.0.

[0] Christine Solnon. „Théorie des graphes et optimisation dans les graphes”. In: *INSA de Lyon*().

[0] Douglas Brent West et al. *Introduction to graph theory*. Vol. 2. Prentice hall Upper Saddle River, 2001.

[0] OpenSSH. *OpenSSH 7.2 release notes*. Retrieved 2022-11-13. Jan. 2016. url: https://www.openssh.com/txt/release-7.2.

[0] OpenSSH. *OpenSSH 8.2 release notes*. Retrieved 2022-11-13. Feb. 2020. url: https://www.openssh.com/txt/release-8.2.

[0] OpenSSH. *OpenSSH 8.8 release notes*. Retrieved 2022-11-13. Sept. 2021. url: https://www.openssh.com/txt/release-8.2.

[0] Samina Khalid, Tehmina Khalil, and Shamila Nasreen. „A survey of feature selection and feature extraction techniques in machine learning”. In: *2014 Science and Information Conference*. Aug. 2014, pp. 372–378. doi: 10.1109/SAI.2014.6918213.

[0] Sinan Ozdemir and Divya Susarla. *Feature Engineering Made Easy: Identify unique features from your dataset in order to build powerful machine learning systems*. Packt Publishing Ltd, 2018.

[0] C E Shannon. „A Mathematical Theory of Communication”. en. In: *The Bell System Technical Journal* 27 (Oct. 1948), pp. 379–423.

[0] F. Pedregosa et al. „Scikit-learn: Machine Learning in Python”. In: *Journal of Machine Learning Research* 12 (2011). Software available at https://scikit-learn.org/stable/index.html, pp. 2825–2830.

[0] Richard Boddy and Gordon Smith. *Statistical methods in practice: for scientists and technologists*. John Wiley & Sons, 2009.

[0] Michael I Jordan and Tom M Mitchell. „Machine learning: Trends, perspectives, and prospects”. In: *Science* 349.6245 (2015), pp. 255–260. url: https://www.science.org/doi/full/10.1126/science.aaa8415.

[0] Todd G Nick and Kathleen M Campbell. „Logistic regression”. In: *Topics in biostatistics* (2007). Publisher: Springer, pp. 273–301.

[0] S. B. Kotsiantis. „Decision trees: a recent overview”. In: *Artificial Intelligence Review* 39.4 (Apr. 2013), pp. 261–283. issn: 0269-2821, 1573-7462. doi: 10.1007/s10462-011-9272-4. url: http://link.springer.com/10.1007/s10462-011-9272-4 (visited on 08/30/2023).

[0] Philipp Probst, Marvin Wright, and Anne-Laure Boulesteix. „Hyperparameters and Tuning Strategies for Random Forest”. In: *WIREs Data Mining and Knowledge Discovery* 9.3 (May 2019), e1301. issn: 1942-4787, 1942-4795. doi: 10.1002/widm.1301. arXiv: 1804.03515 [cs, stat]. url: http://arxiv.org/abs/1804.03515 (visited on 08/30/2023).

[0] Yann LeCun et al. „Gradient-Based Learning Applied to Document Recognition”. In: *proc of the IEEE* (1998).

[0] Dai Quoc Nguyen et al. „A Novel Embedding Model for Knowledge Base Completion Based on Convolutional Neural Network”. In: *Proceedings of the 2018 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, Volume 2 (Short Papers)*. Association for Computational Linguistics, 2018. doi: 10.18653/v1/n18-2053. url: https://doi.org/10.18653%2Fv1%2Fn18-2053.
[0] OpenSSH. *OpenSSH 6.5 release notes*. Retrieved 2022-11-13. Jan. 2014. url: https://www.openssh.com/txt/release-6.5.

[0] OpenSSH. *OpenSSH 7.0 release notes*. Retrieved 2022-11-13. Aug. 2015. url: https://www.openssh.com/txt/release-7.0.

[0] Christine Solnon. „Théorie des graphes et optimisation dans les graphes”. In: *INSA de Lyon* ().

[0] Douglas Brent West et al. *Introduction to graph theory*. Vol. 2. Prentice hall Upper Saddle River, 2001.

[0] OpenSSH. *OpenSSH 7.2 release notes*. Retrieved 2022-11-13. Jan. 2016. url: https://www.openssh.com/txt/release-7.2.

[0] OpenSSH. *OpenSSH 8.2 release notes*. Retrieved 2022-11-13. Feb. 2020. url: https://www.openssh.com/txt/release-8.2.

[0] OpenSSH. *OpenSSH 8.8 release notes*. Retrieved 2022-11-13. Sept. 2021. url: https://www.openssh.com/txt/release-8.2.

[0] Samina Khalid, Tehmina Khalil, and Shamila Nasreen. „A survey of feature selection and feature extraction techniques in machine learning”. In: *2014 Science and Information Conference*. Aug. 2014, pp. 372–378. doi: 10.1109/SAI.2014.6918213.

[0] Sinan Ozdemir and Divya Susarla. *Feature Engineering Made Easy: Identify unique features from your dataset in order to build powerful machine learning systems*. Packt Publishing Ltd, 2018.

[0] C E Shannon. „A Mathematical Theory of Communication”. en. In: *The Bell System Technical Journal* 27 (Oct. 1948), pp. 379–423.

[0] F. Pedregosa et al. „Scikit-learn: Machine Learning in Python”. In: *Journal of Machine Learning Research* 12 (2011). Software available at https://scikit-learn.org/stable/index.html, pp. 2825–2830.

[0] Richard Boddy and Gordon Smith. *Statistical methods in practice: for scientists and technologists*. John Wiley & Sons, 2009.

[0] Michael I Jordan and Tom M Mitchell. „Machine learning: Trends, perspectives, and prospects”. In: *Science* 349.6245 (2015), pp. 255–260. url: https://www.science.org/doi/full/10.1126/science.aaa8415.

[0] Todd G Nick and Kathleen M Campbell. „Logistic regression”. In: *Topics in biostatistics* (2007). Publisher: Springer, pp. 273–301.

[0] S. B. Kotsiantis. „Decision trees: a recent overview”. In: *Artificial Intelligence Review* 39.4 (Apr. 2013), pp. 261–283. issn: 0269-2821, 1573-7462. doi: 10.1007/s10462-011-9272-4. url: http://link.springer.com/10.1007/s10462-011-9272-4 (visited on 08/30/2023).

[0] Philipp Probst, Marvin Wright, and Anne-Laure Boulesteix. „Hyperparameters and Tuning Strategies for Random Forest”. In: *WIREs Data Mining and Knowledge Discovery* 9.3 (May 2019), e1301. issn: 1942-4787, 1942-4795. doi: 10.1002/widm.1301. arXiv: 1804.03515 [cs, stat]. url: http://arxiv.org/abs/1804.03515 (visited on 08/30/2023).

[0] Yann LeCun et al. „Gradient-Based Learning Applied to Document Recognition”. In: *proc of the IEEE* (1998).

[0] Dai Quoc Nguyen et al. „A Novel Embedding Model for Knowledge Base Completion Based on Convolutional Neural Network”. In: *Proceedings of the 2018 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, Volume 2 (Short Papers)*. Association for Computational Linguistics, 2018. doi: 10.18653/v1/n18-2053. url: https://doi.org/10.18653%2Fv1%2Fn18-2053.
[0] Daixin Wang, Peng Cui, and Wenwu Zhu. „Structural Deep Network Embedding“. In: *Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining*. KDD ’16. San Francisco, California, USA: Association for Computing Machinery, 2016, pp. 1225–1234. doi: 10.1145/2939672.2939753. url: https://doi.org/10.1145/2939672.2939753.

[0] Michael Schlichtkrull et al. „Modeling relational data with graph convolutional networks“. In: *The Semantic Web: 15th International Conference, ESWC 2018, Heraklion, Crete, Greece, June 3–7, 2018, Proceedings 15*. Springer. 2018, pp. 593–607. url: https://arxiv.org/pdf/1703.06103.pdf.

[0] Liang Yao, Chengsheng Mao, and Yuan Luo. „KG-BERT: BERT for knowledge graph completion“. In: *arXiv preprint arXiv:1909.03193* (2019). url: https://arxiv.org/pdf/1909.03193.pdf.

[0] Ralph C. Merkle. „Secure Communications over Insecure Channels“. In: *Commun. ACM* 21.4 (Apr. 1978), pp. 294–299. doi: 10.1145/359460.359473. url: https://doi.org/10.1145/359460.359473.

[0] Ye Liu et al. „Kg-bart: Knowledge graph-augmented bart for generative commonsense reasoning“. In: *Proceedings of the AAAI Conference on Artificial Intelligence*. Vol. 35. 7. 2021, pp. 6418–6425. url: file:///home/onyr/Downloads/16796-Article%20Text-20290-1-2-20210518.pdf.

[0] Aditya Grover and Jure Leskovec. „node2vec: Scalable feature learning for networks“. In: *Proceedings of the 22nd ACM SIGKDD international conference on Knowledge discovery and data mining*. 2016, pp. 855–864. url: https://dl.acm.org/doi/pdf/10.1145/2939672.2939754.

[0] Jian Tang et al. „Line: Large-scale information network embedding“. In: *Proceedings of the 24th international conference on world wide web*. 2015, pp. 1067–1077. url: https://dl.acm.org/doi/pdf/10.1145/2736277.2741093.

[0] Petar Velickovic et al. „Graph attention networks“. In: *stat 1050.20 (2017)*, pp. 10–48550. url: https://personal.utdallas.edu/~fxc190007/courses/20S-7301/GAT-questions.pdf.

[0] Keiron O’Shea and Ryan Nash. „An Introduction to Convolutional Neural Networks“. In: *CoRR abs/1511.08458* (2015). url: http://arxiv.org/abs/1511.08458.

[0] Eelco Dolstra. *The purely functional software deployment model*. Utrecht University, 2006. url: https://edolstra.github.io/pubs/phd-thesis.pdf.

[0] OpenScience ASAP. *Was ist Open Science?* Accessed: 2023/09/19. 2023. url: http://openscienceasap.org/open-science/ (visited on 09/19/2023).

[0] DGE Gomes et al. „Why don’t we share data and code? Perceived barriers and benefits to public archiving practices“. In: *Proc Biol Sci* 289.1987 (Nov. 30, 2022), p. 20221113. doi: 10.1098/rspb.2022.1113. eprint: Epub2022Nov23.

[0] Eelco Dolstra and Andres Löh. „NixOS: A Purely Functional Linux Distribution“. In: *SIGPLAN Not.* 43.9 (Sept. 2008), pp. 367–378. doi: 10.1145/1411203.1411255. url: https://doi.org/10.1145/1411203.1411255.

[0] Jamie Ludwig. „Image convolution“. In: *Portland State University* (2013). url: https://web.pdx.edu/~jduh/courses/Archive/geog481w07/Students/Ludwig_ImageConvolution.pdf.

[0] Vic Degraeve et al. „R-GCN: the R could stand for random“. In: *arXiv:2203.02424 preprint* (2022). url: https://arxiv.org/pdf/2203.02424.pdf.
[0] Daixin Wang, Peng Cui, and Wenwu Zhu. „Structural Deep Network Embedding“. In: *Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining*. KDD ’16. San Francisco, California, USA: Association for Computing Machinery, 2016, pp. 1225–1234. doi: 10.1145/2939672.2939753. url: https://doi.org/10.1145/2939672.2939753.

[0] Michael Schlichtkrull et al. „Modeling relational data with graph convolutional networks“. In: *The Semantic Web: 15th International Conference, ESWC 2018, Heraklion, Crete, Greece, June 3–7, 2018, Proceedings 15*. Springer. 2018, pp. 593–607. url: https://arxiv.org/pdf/1703.06103.pdf.

[0] Liang Yao, Chengsheng Mao, and Yuan Luo. „KG-BERT: BERT for knowledge graph completion“. In: *arXiv preprint arXiv:1909.03193* (2019). url: https://arxiv.org/pdf/1909.03193.pdf.

[0] Ralph C. Merkle. „Secure Communications over Insecure Channels“. In: *Commun. ACM* 21.4 (Apr. 1978), pp. 294–299. doi: 10.1145/359460.359473. url: https://doi.org/10.1145/359460.359473.

[0] Ye Liu et al. „Kg-bart: Knowledge graph-augmented bart for generative commonsense reasoning“. In: *Proceedings of the AAAI Conference on Artificial Intelligence*. Vol. 35. 7. 2021, pp. 6418–6425. url: file:///home/onyr/Downloads/16796-Article%20Text-20290-1-2-20210518.pdf.

[0] Aditya Grover and Jure Leskovec. „node2vec: Scalable feature learning for networks“. In: *Proceedings of the 22nd ACM SIGKDD international conference on Knowledge discovery and data mining*. 2016, pp. 855–864. url: https://dl.acm.org/doi/pdf/10.1145/2939672.2939754.

[0] Jian Tang et al. „Line: Large-scale information network embedding“. In: *Proceedings of the 24th international conference on world wide web*. 2015, pp. 1067–1077. url: https://dl.acm.org/doi/pdf/10.1145/2736277.2741093.

[0] Petar Velickovic et al. „Graph attention networks“. In: *stat 1050.20 (2017)*, pp. 10–48550. url: https://personal.utdallas.edu/~fxc190007/courses/20S-7301/GAT-questions.pdf.

[0] Keiron O’Shea and Ryan Nash. „An Introduction to Convolutional Neural Networks“. In: *CoRR abs/1511.08458* (2015). url: http://arxiv.org/abs/1511.08458.

[0] Eelco Dolstra. *The purely functional software deployment model*. Utrecht University, 2006. url: https://edolstra.github.io/pubs/phd-thesis.pdf.

[0] OpenScience ASAP. *Was ist Open Science?* Accessed: 2023/09/19. 2023. url: http://openscienceasap.org/open-science/ (visited on 09/19/2023).

[0] DGE Gomes et al. „Why don’t we share data and code? Perceived barriers and benefits to public archiving practices“. In: *Proc Biol Sci* 289.1987 (Nov. 30, 2022), p. 20221113. doi: 10.1098/rspb.2022.1113. eprint: Epub2022Nov23.

[0] Eelco Dolstra and Andres Löh. „NixOS: A Purely Functional Linux Distribution“. In: *SIGPLAN Not.* 43.9 (Sept. 2008), pp. 367–378. doi: 10.1145/1411203.1411255. url: https://doi.org/10.1145/1411203.1411255.

[0] Jamie Ludwig. „Image convolution“. In: *Portland State University* (2013). url: https://web.pdx.edu/~jduh/courses/Archive/geog481w07/Students/Ludwig_ImageConvolution.pdf.

[0] Vic Degraeve et al. „R-GCN: the R could stand for random“. In: *arXiv:2203.02424 preprint* (2022). url: https://arxiv.org/pdf/2203.02424.pdf.
[0] Bryan Perozzi, Rami Al-Rfou, and Steven Skiena. „Deepwalk: Online learning of social representations”. In: *Proceedings of the 20th ACM SIGKDD international conference on Knowledge discovery and data mining*. 2014, pp. 701–710. url: https://dl.acm.org/doi/pdf/10.1145/2623330.2623732.

[0] Will Hamilton, Zhitao Ying, and Jure Leskovec. „Inductive representation learning on large graphs”. In: *Advances in neural information processing systems* 30 (2017). Ed. by I. Guyon et al. url: https://proceedings.neurips.cc/paper_files/paper/2017/file/5dd9db5e033da9c6fb5ba83c7a7ebea9-Paper.pdf.

[0] Zonghan Wu et al. „A comprehensive survey on graph neural networks”. In: *IEEE transactions on neural networks and learning systems* 32.1 (2020), pp. 4–24. url: https://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=9046288.

[0] Zonghan Wu et al. „Beyond low-pass filtering: Graph convolutional networks with automatic filtering”. In: *IEEE Transactions on Knowledge and Data Engineering* (2022). url: https://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=9806316.

[0] Federico Monti et al. „Geometric deep learning on graphs and manifolds using mixture model cnns”. In: *Proceedings of the IEEE conference on computer vision and pattern recognition*. 2017, pp. 5115–5124. url: https://openaccess.thecvf.com/content_cvpr_2017/papers/Monti_Geometric_Deep_Learning_CVPR_2017_paper.pdf.

[0] Franco Scarselli et al. „The graph neural network model”. In: *IEEE transactions on neural networks* 20.1 (2008), pp. 61–80. url: https://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=4700287.

[0] Joan Bruna et al. „Spectral networks and locally connected networks on graphs”. In: *arXiv preprint arXiv:1312.6203* (2013). url: https://arxiv.org/pdf/1312.6203.pdf.

[0] Quoc V Le et al. „A tutorial on deep learning part 2: Autoencoders, convolutional neural networks and recurrent neural networks”. In: *Google Brain* 20 (2015), pp. 1–20. url: https://ai.stanford.edu/~quocle/tutorial2.pdf.

[0] Thomas N Kipf and Max Welling. „Semi-supervised classification with graph convolutional networks”. In: *arXiv preprint arXiv:1609.02907* (2016). url: https://arxiv.org/pdf/1609.02907.pdf.

[0] Junyoung Chung et al. *Empirical Evaluation of Gated Recurrent Neural Networks on Sequence Modeling*. Dec. 11, 2014. arXiv: 1412.3555[cs]. url: http://arxiv.org/abs/1412.3555 (visited on 08/23/2023).

[0] J. Laaksonen and E. Oja. „Classification with learning k-nearest neighbors”. In: *Proceedings of International Conference on Neural Networks (ICNN’96)*. International Conference on Neural Networks (ICNN’96). Vol. 3. Washington, DC, USA: IEEE, 1996, pp. 1480–1483. ISBN: 978-0-7803-3210-2. doi: 10.1109/ICNN.1996.549118. url: http://ieeexplore.ieee.org/document/549118/ (visited on 08/30/2023).

[0] Sepp Hochreiter and Jürgen Schmidhuber. „Long short-term memory”. In: *Neural computation* 9.8 (1997). Publisher: MIT Press, pp. 1735–1780. (Visited on 08/23/2023).

[0] Ian Goodfellow, Yoshua Bengio, and Aaron Courville. *Deep learning*. MIT press, 2016. url: https://books.google.de/books?hl=en&lr=&id=omivDQAAQBAJ&oi=fnd&pg=PR5&dq=deep+learning&ots=MNV2eosBRS&sig=jN2QwFikq3g_YqU3hJVPEP0XIJ4&redir_esc=y#v=onepag=e&q=deep%20learning&f=false.

[0] Qiang Wu and Ding-Xuan Zhou. „Analysis of Support Vector Machine Classification”. In: *Journal of Computational Analysis & Applications* 8.2 (2006).
[0] Bryan Perozzi, Rami Al-Rfou, and Steven Skiena. „Deepwalk: Online learning of social representations”. In: *Proceedings of the 20th ACM SIGKDD international conference on Knowledge discovery and data mining*. 2014, pp. 701–710. url: https://dl.acm.org/doi/pdf/10.1145/2623330.2623732.

[0] Will Hamilton, Zhitao Ying, and Jure Leskovec. „Inductive representation learning on large graphs”. In: *Advances in neural information processing systems* 30 (2017). Ed. by I. Guyon et al. url: https://proceedings.neurips.cc/paper_files/paper/2017/file/5dd9db5e033da9c6fb5ba83c7a7ebea9-Paper.pdf.

[0] Zonghan Wu et al. „A comprehensive survey on graph neural networks”. In: *IEEE transactions on neural networks and learning systems* 32.1 (2020), pp. 4–24. url: https://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=9046288.

[0] Zonghan Wu et al. „Beyond low-pass filtering: Graph convolutional networks with automatic filtering”. In: *IEEE Transactions on Knowledge and Data Engineering* (2022). url: https://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=9806316.

[0] Federico Monti et al. „Geometric deep learning on graphs and manifolds using mixture model cnns”. In: *Proceedings of the IEEE conference on computer vision and pattern recognition*. 2017, pp. 5115–5124. url: https://openaccess.thecvf.com/content_cvpr_2017/papers/Monti_Geometric_Deep_Learning_CVPR_2017_paper.pdf.

[0] Franco Scarselli et al. „The graph neural network model”. In: *IEEE transactions on neural networks* 20.1 (2008), pp. 61–80. url: https://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=4700287.

[0] Joan Bruna et al. „Spectral networks and locally connected networks on graphs”. In: *arXiv preprint arXiv:1312.6203* (2013). url: https://arxiv.org/pdf/1312.6203.pdf.

[0] Quoc V Le et al. „A tutorial on deep learning part 2: Autoencoders, convolutional neural networks and recurrent neural networks”. In: *Google Brain* 20 (2015), pp. 1–20. url: https://ai.stanford.edu/~quocle/tutorial2.pdf.

[0] Thomas N Kipf and Max Welling. „Semi-supervised classification with graph convolutional networks”. In: *arXiv preprint arXiv:1609.02907* (2016). url: https://arxiv.org/pdf/1609.02907.pdf.

[0] Junyoung Chung et al. *Empirical Evaluation of Gated Recurrent Neural Networks on Sequence Modeling*. Dec. 11, 2014. arXiv: 1412.3555[cs]. url: http://arxiv.org/abs/1412.3555 (visited on 08/23/2023).

[0] J. Laaksonen and E. Oja. „Classification with learning k-nearest neighbors”. In: *Proceedings of International Conference on Neural Networks (ICNN’96)*. International Conference on Neural Networks (ICNN’96). Vol. 3. Washington, DC, USA: IEEE, 1996, pp. 1480–1483. ISBN: 978-0-7803-3210-2. doi: 10.1109/ICNN.1996.549118. url: http://ieeexplore.ieee.org/document/549118/ (visited on 08/30/2023).

[0] Sepp Hochreiter and Jürgen Schmidhuber. „Long short-term memory”. In: *Neural computation* 9.8 (1997). Publisher: MIT Press, pp. 1735–1780. (Visited on 08/23/2023).

[0] Ian Goodfellow, Yoshua Bengio, and Aaron Courville. *Deep learning*. MIT press, 2016. url: https://books.google.de/books?hl=en&lr=&id=omivDQAAQBAJ&oi=fnd&pg=PR5&dq=deep+learning&ots=MNV2eosBRS&sig=jN2QwFikq3g_YqU3hJVPEP0XIJ4&redir_esc=y#v=onepagewq=deep%20learning&f=false.

[0] Qiang Wu and Ding-Xuan Zhou. „Analysis of Support Vector Machine Classification”. In: *Journal of Computational Analysis & Applications* 8.2 (2006).
[0] Jianlong Zhou et al. „Evaluating the Quality of Machine Learning Explanations: A Survey on Methods and Metrics“. In: *Electronics* 10.5 (Mar. 4, 2021), p. 593. issn: 2079-9292. doi: 10.3390/electronics10050593. url: https://www.mdpi.com/2079-9292/10/5/593 (visited on 09/11/2023).

[0] Jose Manuel Gomez-Perez, Ronald Denaux, and Andres Garcia-Silva. „Understanding Word Embeddings and Language Models“. In: *A Practical Guide to Hybrid Natural Language Processing: Combining Neural Models and Knowledge Graphs for NLP*. Cham: Springer International Publishing, 2020, pp. 17–31. doi: 10.1007/978-3-030-44830-1_3. url: https://doi.org/10.1007/978-3-030-44830-1_3.

[0] OpenSSH. *OpenSSH 9.0 release notes*. Retrieved 2022-11-13. Apr. 2022. url: https://www.openssh.com/txt/release-9.0.

[0] Unknown. *How does SSH use both RSA and Diffie-Hellman? Asked 8 years, 9 months ago; Modified 8 years, 9 months ago; Viewed 22k times; Accessed: 2023-09-21. 2023. url: https://security stackexchange.com/questions/76894/how-does-ssh-use-both-rsa-and-diffie-hellman.*

[0] T. Ylonen and C. Lonvick. *The Secure Shell (SSH) Protocol Architecture*. RFC 4251. Updated by: 8308, 9141. Network Working Group, Jan. 2006.

[0] T. Ylonen and C. Lonvick. *The Secure Shell (SSH) Transport Layer Protocol*. RFC 4253. Updated by: 6668, 8268, 8308, 8332, 8709, 8758, 9142; Errata Exist. Network Working Group, Jan. 2006.

[0] Girish Venkatachalam. „The OpenSSH Protocol under the Hood“. In: *Linux Journal* 156 (Apr. 2007). url: https://www.ecb.torontomu.ca/~courses/coe518/LinuxJournal/elj2007-156-OpenSSH.pdf.

[0] Oscar M. Guillen et al. „Towards post-quantum security for IoT endpoints with NTRU“. In: *Design, Automation & Test in Europe Conference & Exhibition (DATE), 2017*. 2017, pp. 698–703. doi: 10.23919/DATE.2017.7927079.

[0] Paulo Nunes de Souza and Pavel Gladyshev. „Inference of Endianness and Wordsize From Memory Dumps“. In: *European Conference on Cyber Warfare and Security*. Academic Conferences International Limited. 2017, pp. 619–627.

[0] P. McLaren et al. „Decrypting live SSH traffic in virtual environments“. In: *Digital Investigation* 29 (2019), pp. 109–117. url: https://www.sciencedirect.com/science/article/abs/pii/S1742287619300647.

[0] Tatu Ylonen. *Portable OpenSSH*. Github repositor. Accessed on 25.08.2023. 1995. url: https://github.com/openssh/openssh-portable/.

[0] José Tomás Martínez Garre, Manuel Gil Pérez, and Antonio Ruiz-Martínez. „A novel Machine Learning-based approach for the detection of SSH botnet infection“. In: *Future Generation Computer Systems* 115 (Feb. 2021), pp. 387–396. doi: 10.1016/j.future.2020.09.004. url: https://www.sciencedirect.com/science/article/pii/S0167739X20303265.

[0] SSH Communications Security. *SSH Annual Report 2018*. Annual Report. Accessed: 2023-08-30. SSH Communications Security, 2018. url: https://info.ssh.com/hubfs/2021%20Investor%20documents/SSH_Annual_Report_2018_final.pdf.

[0] W. Yurcik and Chao Liu. „A first step toward detecting SSH identity theft in HPC cluster environments: discriminating masqueraders based on command behavior“. In: *CCGrid 2005. IEEE International Symposium on Cluster Computing and the Grid, 2005*. Vol. 1. May 2005, 111–120 Vol. 1. doi: 10.1109/CCGRID.2005.1558542.

[0] *Weak CRC allows packet injection into SSH sessions encrypted with block ciphers*. Accessed: 2023-08-30. Nov. 2001. url: https://www.kb.cert.org.
[0] Jianlong Zhou et al. „Evaluating the Quality of Machine Learning Explanations: A Survey on Methods and Metrics“. In: *Electronics* 10.5 (Mar. 4, 2021), p. 593. issn: 2079-9292. doi: 10.3390/electronics10050593. url: https://www.mdpi.com/2079-9292/10/5/593 (visited on 09/11/2023).

[0] Jose Manuel Gomez-Perez, Ronald Denaux, and Andres Garcia-Silva. „Understanding Word Embeddings and Language Models“. In: *A Practical Guide to Hybrid Natural Language Processing: Combining Neural Models and Knowledge Graphs for NLP*. Cham: Springer International Publishing, 2020, pp. 17–31. doi: 10.1007/978-3-030-44830-1_3. url: https://doi.org/10.1007/978-3-030-44830-1_3.

[0] OpenSSH. *OpenSSH 9.0 release notes*. Retrieved 2022-11-13. Apr. 2022. url: https://www.openssh.com/txt/release-9.0.

[0] Unknown. *How does SSH use both RSA and Diffie-Hellman? Asked 8 years, 9 months ago; Modified 8 years, 9 months ago; Viewed 22k times; Accessed: 2023-09-21. 2023. url: https://security stackexchange.com/questions/76894/how-does-ssh-use-both-rsa-and-diffie-hellman.*

[0] T. Ylonen and C. Lonvick. *The Secure Shell (SSH) Protocol Architecture*. RFC 4251. Updated by: 8308, 9141. Network Working Group, Jan. 2006.

[0] T. Ylonen and C. Lonvick. *The Secure Shell (SSH) Transport Layer Protocol*. RFC 4253. Updated by: 6668, 8268, 8308, 8332, 8709, 8758, 9142; Errata Exist. Network Working Group, Jan. 2006.

[0] Girish Venkatachalam. „The OpenSSH Protocol under the Hood“. In: *Linux Journal* 156 (Apr. 2007). url: https://www.ecb.torontomu.ca/~courses/coe518/LinuxJournal/elj2007-156-OpenSSH.pdf.

[0] Oscar M. Guillen et al. „Towards post-quantum security for IoT endpoints with NTRU“. In: *Design, Automation & Test in Europe Conference & Exhibition (DATE), 2017*. 2017, pp. 698–703. doi: 10.23919/DATE.2017.7927079.

[0] Paulo Nunes de Souza and Pavel Gladyshev. „Inference of Endianness and Wordsize From Memory Dumps“. In: *European Conference on Cyber Warfare and Security*. Academic Conferences International Limited. 2017, pp. 619–627.

[0] P. McLaren et al. „Decrypting live SSH traffic in virtual environments“. In: *Digital Investigation* 29 (2019), pp. 109–117. url: https://www.sciencedirect.com/science/article/abs/pii/S1742287619300647.

[0] Tatu Ylonen. *Portable OpenSSH*. Github repositor. Accessed on 25.08.2023. 1995. url: https://github.com/openssh/openssh-portable/.

[0] José Tomás Martínez Garre, Manuel Gil Pérez, and Antonio Ruiz-Martínez. „A novel Machine Learning-based approach for the detection of SSH botnet infection“. In: *Future Generation Computer Systems* 115 (Feb. 2021), pp. 387–396. doi: 10.1016/j.future.2020.09.004. url: https://www.sciencedirect.com/science/article/pii/S0167739X20303265.

[0] SSH Communications Security. *SSH Annual Report 2018*. Annual Report. Accessed: 2023-08-30. SSH Communications Security, 2018. url: https://info.ssh.com/hubfs/2021%20Inves tor%20documents/SSH_Annual_Report_2018_final.pdf.

[0] W. Yurcik and Chao Liu. „A first step toward detecting SSH identity theft in HPC cluster environments: discriminating masqueraders based on command behavior“. In: *CCGrid 2005. IEEE International Symposium on Cluster Computing and the Grid, 2005*. Vol. 1. May 2005, 111–120 Vol. 1. doi: 10.1109/CCGRID.2005.1558542.

[0] *Weak CRC allows packet injection into SSH sessions encrypted with block ciphers*. Accessed: 2023-08-30. Nov. 2001. url: https://www.kb.cert.org.
[0] Core Security Technologies. SSH Insertion Attack. https://www.coresecurity.com/core-labs/advisories/ssh-insertion-attack. Archived from the original on 2011-07-08. 2023.

[0] US CERT. SSH CBC vulnerability. Vulnerability Note VU#958563 - SSH CBC vulnerability. https://www.kb.cert.org/vuls/id/958563. Archived from the original on 2011-06-22. 2011.

[0] Spiegel Online. Prying Eyes: Inside the NSA's War on Internet Security. Spiegel Online. Archived from the original on January 24, 2015. 2014. url: https://www.spiegel.de/inter national/germany/inside-the-nsa-s-war-on-internet-security-a-1010361.html.

[0] Olivier Bilodeau et al. Operation WINDIGO. en. Mar. 2014, p. 69. url: https://web-assets.esetstatic.com/wls/2014/03/operation windigo.pdf.

[0] Pooneh Nikkhah Bahrami* et al. „Cyber Kill Chain-Based Taxonomy of Advanced Persistent Threat Actors: Analogy of Tactics, Techniques, and Procedures“. In: Journal of Information Processing Systems 15.4 (Nov. 2019), pp. 865–889. doi: 10.3745/JIPS.03.0126. url: http://xml.jips-k.org/full-text/view?doi=10.3745/JIPS.03.0126.

[0] Sanjay Madan and Monika Singh. „Classification of IOT-Malware using Machine Learning“. In: 2021 International Conference on Technological Advancements and Innovations (ICTAI). Nov. 2021, pp. 599–605. doi: 10.1109/ICTAI53825.2021.9673185.

[0] Connor Hetzler, Zachary Chen, and Tahir M. Khan. „Analysis of SSH Honeypot Effectiveness“. en. In: Advances in Information and Communication. Ed. by Kohei Arai. Lecture Notes in Networks and Systems. Cham: Springer Nature Switzerland, Mar. 2023, pp. 759–782. ISBN: 9783031280733. doi: 10.1007/978-3-031-28073-3_51.

[0] ppacher. honeyssh. https://github.com/ppacher/honeyssh. GitHub repository. 2017.

[0] Aidan Hogan et al. „Knowledge Graphs“. In: ACM Comput. Surv. 54.4 (July 2021). issn: 0360-0300. doi: 10.1145/3447772. url: https://doi.org/10.1145/3447772.

[0] Aidan Hogan et al. „Knowledge Graphs (Extended)“. In: ACM Computing Surveys 54.4 (May 2022). arXiv:2003.02320 [cs], pp. 1–37. doi: 10.1145/3447772. url: http://arxiv.org/abs/2003.02320.

[0] Marvin Hofer et al. „Construction of Knowledge Graphs: State and Challenges“. In: arXiv preprint arXiv:2302.11509 (2023). url: https://doi.org/10.48550/arXiv.2302.11509.

[0] Google. „Introducing the Knowledge Graph: Things, not strings“. In: Google Blog (May 2012). Accessed: 2023-06-16. url: https://blog.google/products/search/introducing-knowle dge-graph-things-not/.

Additional bibliography

[0] Florian O. Rascoussier and C. Lahoche. Machine Learning Assisted SSH Keys Extraction From The Heap Dump | Cleaned for Embedding. Version 0.1.1. Zenodo, 2022. doi: 10.5281/zenodo.10514199. url: https://doi.org/10.5281/zenodo.10514199.

[0] Auguste Kerckhoffs. „La cryptographic militaire“. In: Journal des sciences militaires (1883), pp. 5–38.

[0] Dimitrios Georgoulias et al. „Botnet Business Models, Takedown Attempts, and the Darkweb Market: A Survey“. en. In: ACM Computing Surveys 55.11 (Nov. 2023), pp. 1–39. doi: 10.1145/53575808. url: https://dl.acm.org/doi/10.1145/53575808.
[0] Core Security Technologies. SSH Insertion Attack. https://www.coresecurity.com/core-labs/advisories/ssh-insertion-attack. Archived from the original on 2011-07-08. 2023.

[0] US CERT. SSH CBC vulnerability. Vulnerability Note VU#958563 - SSH CBC vulnerability. https://www.kb.cert.org/vuls/id/958563. Archived from the original on 2011-06-22. 2011.

[0] Spiegel Online. Prying Eyes: Inside the NSA's War on Internet Security. Spiegel Online. Archived from the original on January 24, 2015. 2014. url: https://www.spiegel.de/inter national/germany/inside-the-nsa-s-war-on-internet-security-a-1010361.html.

[0] Olivier Bilodeau et al. Operation WINDIGO. en. Mar. 2014, p. 69. url: https://web-assets.esetstatic.com/wls/2014/03/operation windigo.pdf.

[0] Pooneh Nikkhah Bahrami* et al. „Cyber Kill Chain-Based Taxonomy of Advanced Persistent Threat Actors: Analogy of Tactics, Techniques, and Procedures“. In: Journal of Information Processing Systems 15.4 (Nov. 2019), pp. 865–889. doi: 10.3745/JIPS.03.0126. url: http://xml.jips-k.org/full-text/view?doi=10.3745/JIPS.03.0126.

[0] Sanjay Madan and Monika Singh. „Classification of IOT-Malware using Machine Learning“. In: 2021 International Conference on Technological Advancements and Innovations (ICTAI). Nov. 2021, pp. 599–605. doi: 10.1109/ICTAI53825.2021.9673185.

[0] Connor Hetzler, Zachary Chen, and Tahir M. Khan. „Analysis of SSH Honeypot Effectiveness“. en. In: Advances in Information and Communication. Ed. by Kohei Arai. Lecture Notes in Networks and Systems. Cham: Springer Nature Switzerland, Mar. 2023, pp. 759–782. ISBN: 9783031280733. doi: 10.1007/978-3-031-28073-3_51.

[0] ppacher. honeyssh. https://github.com/ppacher/honeyssh. GitHub repository. 2017.

[0] Aidan Hogan et al. „Knowledge Graphs“. In: ACM Comput. Surv. 54.4 (July 2021). issn: 0360-0300. doi: 10.1145/3447772. url: https://doi.org/10.1145/3447772.

[0] Aidan Hogan et al. „Knowledge Graphs (Extended)“. In: ACM Computing Surveys 54.4 (May 2022). arXiv:2003.02320 [cs], pp. 1–37. doi: 10.1145/3447772. url: http://arxiv.org/abs/2003.02320.

[0] Marvin Hofer et al. „Construction of Knowledge Graphs: State and Challenges“. In: arXiv preprint arXiv:2302.11509 (2023). url: https://doi.org/10.48550/arXiv.2302.11509.

[0] Google. „Introducing the Knowledge Graph: Things, not strings“. In: Google Blog (May 2012). Accessed: 2023-06-16. url: https://blog.google/products/search/introducing-knowle dge-graph-things-not/.

Additional bibliography

[0] Florian O. Rascoussier and C. Lahoche. Machine Learning Assisted SSH Keys Extraction From The Heap Dump | Cleaned for Embedding. Version 0.1.1. Zenodo, 2022. doi: 10.5281/zenodo.10514199. url: https://doi.org/10.5281/zenodo.10514199.

[0] Auguste Kerckhoffs. „La cryptographic militaire“. In: Journal des sciences militaires (1883), pp. 5–38.

[0] Dimitrios Georgoulias et al. „Botnet Business Models, Takedown Attempts, and the Darkweb Market: A Survey“. en. In: ACM Computing Surveys 55.11 (Nov. 2023), pp. 1–39. doi: 10.1145/53575808. url: https://dl.acm.org/doi/10.1145/53575808.
[0] Paul Groth et al. „Knowledge Graphs and their Role in the Knowledge Engineering of the 21st Century“. In: *Dagstuhl Reports* 12.9 (2022). Report from Dagstuhl Seminar 22372. Specific usage: pp. 60-72, Subsection "3.2 A Brief History of Knowledge Engineering: A Practitioner’s Perspective", pp. 60–120. doi: 10.4230/DagRep.12.9.60.

[0] Lisa Ehrlinger and Wolfram Wöß. „Towards a Definition of Knowledge Graphs“. In: (2016), pp. 1–4.

[0] Frederick Edward Hulme. *Proverb Lore: Many Sayings, Wise Or Otherwise, on Many Subjects, Gleaned from Many Sources*. E. Stock, 1902, p. 188.

[0] Michelle Venables. *An Introduction to Graph Theory*. Accessed: 2023-06-12. 2019. url: https://towardsdatascience.com/an-introduction-to-graph-theory-24b41746fabe.

[0] Gianluca Fiorelli. *Best of 2013: No 13 - Search in the Knowledge Graph era*. Accessed: 2023-06-12. 2013. url: https://www.stateofdigital.com/search-in-the-knowledge-graph-era/.

[0] Jackson Gilkey. *Graph Theory and Data Science*. Accessed: 2023-05-25. 2019. url: https://towardsdatascience.com/graph-theory-and-data-science-ec95fe2f31d8.

[0] M.S. Jawad et al. „Adoption of knowledge-graph best development practices for scalable and optimized manufacturing processes“. In: *MethodsX* 10 (2023), p. 102124. issn: 2215-0161. doi: https://doi.org/10.1016/j.mex.2023.102124. url: https://www.sciencedirect.com/science/article/pii/S2215016123001255.
[0] Paul Groth et al. „Knowledge Graphs and their Role in the Knowledge Engineering of the 21st Century“. In: *Dagstuhl Reports* 12.9 (2022). Report from Dagstuhl Seminar 22372. Specific usage: pp. 60-72, Subsection "3.2 A Brief History of Knowledge Engineering: A Practitioner’s Perspective", pp. 60–120. doi: 10.4230/DagRep.12.9.60.

[0] Lisa Ehrlinger and Wolfram Wöß. „Towards a Definition of Knowledge Graphs“. In: (2016), pp. 1–4.

[0] Frederick Edward Hulme. *Proverb Lore: Many Sayings, Wise Or Otherwise, on Many Subjects, Gleaned from Many Sources*. E. Stock, 1902, p. 188.

[0] Michelle Venables. *An Introduction to Graph Theory*. Accessed: 2023-06-12. 2019. url: https://towardsdatascience.com/an-introduction-to-graph-theory-24b41746fabe.

[0] Gianluca Fiorelli. *Best of 2013: No 13 - Search in the Knowledge Graph era*. Accessed: 2023-06-12. 2013. url: https://www.stateofdigital.com/search-in-the-knowledge-graph-era/.

[0] Jackson Gilkey. *Graph Theory and Data Science*. Accessed: 2023-05-25. 2019. url: https://towardsdatascience.com/graph-theory-and-data-science-ec95fe2f31d8.

[0] M.S. Jawad et al. „Adoption of knowledge-graph best development practices for scalable and optimized manufacturing processes“. In: *MethodsX* 10 (2023), p. 102124. issn: 2215-0161. doi: https://doi.org/10.1016/j.mex.2023.102124. url: https://www.sciencedirect.com/science/article/pii/S2215016123001255.
Eidesstattliche Erklärung

Hiermit versichere ich, dass ich diese Masterarbreit selbstständig und ohne Benutzung anderer als der angegebenen Quellen und Hilfsmittel angefertigt habe und alle Ausführungen, die wörtlich oder sinngemäß übernommen wurden, als solche gekennzeichnet sind, sowie, dass ich die Masterarbreit in gleicher oder ähnlicher Form noch keiner anderen Prüfungsbehörde vorgelegt habe.

Passau, April 29, 2024

Rascoussier, Florian Guillaume Pierre
Eidesstattliche Erklärung

Hiermit versichere ich, dass ich diese Masterarbreit selbstständig und ohne Benutzung anderer als der angegebenen Quellen und Hilfsmittel angefertigt habe und alle Ausführungen, die wörtlich oder sinngemäß übernommen wurden, als solche gekennzeichnet sind, sowie, dass ich die Masterarbreit in gleicher oder ähnlicher Form noch keiner anderen Prüfungsbehörde vorgelegt habe.

Passau, April 29, 2024

Rascoussier, Florian Guillaume Pierre