# Graph-Based Multi-Label Classification for WiFi Network Traffic Analysis
###### Abstract
In addition, however, rather than working on sequences of packets (as already explored in [3]), we derive graphs from ordered sequences of packets being transmitted over the network and use elements of those graphs to build an alphabet of symbols to encode the information carried in the traffic stream useful to classify attacks. The purpose of this work is to compare a multi-labelled Granular Computing-based approach with a conventional Graph Neural Network, in order to perform network traffic classification. Specifically, we aim to study network anomalies from a higher semantic level, described by network graphs directly built from buffered frames captured from a monitor host. For this purpose, the main contributions of this paper are described as follows:  
* We introduce a structured domain representation by a preprocessing strategy able to extract weighted network graphs directly from buffered frames;
* We formally define the network anomaly detection problem as a non-exclusive supervised problem in graph domain;
* We introduce a Granular Computing approach in the graph domain aimed at network traffic anomaly detection and automatic analysis;
* Furthermore, we provide an extensive analysis of two consolidated approaches revised to work in a multi-label context, the aforementioned Granular Computing-based one and a genetically optimized Graph Neural Network;
* Next, we show experimental results and performance analysis of such two consolidated approaches for graph machine learning, applied to network traffic classification. * Lastly, we describe the model interpretability and knowledge discovery capabilities of the considered approaches, as applied to the specific application domain of network traffic anomaly detection. These contributions are particularly important in order to build prediction systems that are able not only to achieve state-of-the-art performances as other analyzed works, but also to keep focus on improving models' human interpretability, obtaining further semantic insights on the analyzed data. The remainder of the paper is organized as follows: In Section 2, we summarize a review of recent works focusing on machine learning on structured domains and anomaly detection in telecommunications networks, particularly concerning IEEE 802.11 networks. Next, in Section 3, we describe the dataset used, introducing the dissimilarity measures adopted in the starting features space and in the graph structured domain, and explaining the sequences to graphs procedure along with the supervised problems we are going to test. In Section 4, we detail how the GRALG classification system works, by formally recalling each key component behavior and describing its application on the target dataset. In Section 5, we perform an overview of the GNN architecture used as baseline to compare results with GRALG. Furthermore, in Section 6, we outline results analysis, comparing performances obtained with other state-of-the-art papers and previous works. Lastly, in Section 7, we sum up details concerning proposed solutions, along with results analysis obtained so far, and provide further points for future works.