2024 IEEE 29th Pacific Rim International Symposium on Dependable Computing (PRDC)

PALM: A framework to identify novel attacks in an

e-commerce system
2024 IEEE 29th Pacific Rim International Symposium on Dependable Computing (PRDC) | 979-8-3315-4074-6/24/$31.00 ©2024 IEEE | DOI: 10.1109/PRDC63035.2024.00027

Rajesh Kumar, Swapnil Pandey, Debanshu Das

Department of Computer Sc. and Information systems
Birla Institute of Technology and Science, K K Birla Goa campus
Goa, India
rajeshk@[Link]

Abstract—The widespread adoption of e-commerce and its lu- the constant maintenance of an updated database of attack
crative, decentralized, multi-agent nature have made these sys- signatures. Moreover, these approaches suffer from high false
tems vulnerable to cyber-attacks. Traditional signature-based positive rates. At the same time, they lack a comprehensive
approaches have been successful in detecting instances of fraud,
however, they continue to struggle against unknown attacks. view of how complex multi-stage attacks may unfold via zero-
To this end, we present PALM, a framework that bridges day exploits.
the data-oriented process mining community with model-based Challenge. Existing information-security risk analysis is
security engineering with an aim to detect novel cyber-exploit largely a manual activity or relies on domain-specific models,
automatically from a given event-log. It relies on the insight such as attack tree [6], [7], and attack graphs [8]. These
that security attacks on digital infrastructures seek to modify
the system behaviour inducing unsafe states. Consequently, we models pin domain knowledge in the form of enterprise risks
propose an approach to represent the behaviour of the system in a systematic graphical model. Other authors extract a
and establish a signature-based attack database that can be used mathematical model such as of state machines like Petri-Net
to predict unseen exploits. Building on the success of process- or Bayesian Networks [9] from the above-mentioned threat
mining community, our framework first discovers a Petri Net models to perform a granular analysis. For example, Kumar
model automatically from an event-log using the “Inductive
Miner (IM)” algorithm. Next we, explicitly map the system in [10], extracts a timed automaton model by first designing
features onto the discovered Petri-Net. Subsequently, the Petri- a cyber-kill chain to represent causal attack steps executed
Net model is trained over contextual attack signatures. This step by advanced persistent threats. Importantly, as noted in [11],
is crucial for capturing the nuances of system dynamics and entity behaviour when hard encoded as a mathematical model
identifying potential vulnerabilities or attack surfaces that may loses its flexibility to manipulate, making it hard to respond
be exploited by malicious actors. Graph Convolution Network
is then employed to look for malicious feature correlations and to security threats. Adequately, pressing for automatically
information flows, indicating a likelihood of a link between un- generated threat models.
connected neighbouring nodes. Using a sample event-log, we test A crucial but relatively challenging security problem tem-
the efficacy of our framework, achieving 83.33% accuracy and plate is novel attack path prediction. The challenge stems
an AUC-ROC of 0.9186, signifying its potential in identifying because unlike anomaly detection, which focuses on identi-
novel attack paths.
fying deviations from normal behaviour based on historical
Index Terms—E-commerce, Attack graph, Graph Convolution data, prediction requires anticipating novel attack vectors that
Network, Process mining, Novel attack detection, Exploit predic- may not have been previously observed. Technically, coupled
tion, Link prediction
with quantifying attacker uncertain moves, it also requires a
granular understanding of the system behaviour.
I. I NTRODUCTION Despite being widely acknowledged by several academic ed-
E-commerce, as depicted in Figure 1, is a complex, de- itorials that such complex data-intensive interactions neces-
centralized, multi-agent digital infrastructure involving var- sitate an amalgamation of domain knowledge and data-
ious stakeholders, cross-sectoral platforms, and multi-party oriented techniques [12], [13], there is a lack of a standard-
Application Programming Interfaces (APIs). Fraudsters can ized framework to integrate the two effectively.
exploit systemic data and control flaws or may call APIs in Our Contributions. This paper formalizes PALM, a frame-
an arbitrary order to compromise the system’s integrity [1]. work for identifying unobserved attack paths in E-commerce
Consequently, detecting fraud and cyber-attacks remains a sig- infrastructure. It relies on the insight that security attacks on
nificant research focus. An important reservoir of knowledge digital infrastructure seek to modify the system behaviour
about the way employees and customers conduct everyday inducing unsafe states. More precisely, we formulate detecting
business transactions is “Event-logs”. novel attack path as a link prediction problem in a graph,
Research gap. A vast majority of work focuses on closely searching for plausible malicious attack signatures, using fea-
monitoring indicators of compromise using log analysis [2], ture correlation and information flow. Our pipeline framework
[3], heuristics [4], and anomaly detection algorithms [5]. involves three well-defined stages. First, is to automatically
However, these methods often necessitate complex manual extract a compressed as-is low-level benign “process model”
searches through mostly benign host and network logs or from the event-log, identifying key system entities and the

2473-3105/24/$31.00 ©2024 IEEE 143

DOI 10.1109/PRDC63035.2024.00027
Authorized licensed use limited to: BIRLA INSTITUTE OF TECHNOLOGY AND SCIENCE. Downloaded on July 25,2025 at 15:22:17 UTC from IEEE Xplore. Restrictions apply.
 2

the prominent works utilizing deep learning frameworks over

standard semantic vector representation of logs for real-time
anomaly detection. In [22], Poirot develops provenance graphs
for representing system behaviour using kernel audit logs
while attack behaviour is constructed using threat intelligence
feeds captured as a query graph. Cloudseer [23], builds an
offline task automaton from event-logs coupled with an online
stage for checking interleaved log messages for deviations.
PALM, similar to previous papers uses event-logs, however, the
Fig. 1: E-Commerce System Model. This model is adapted scope is different, since it is a proactive framework to locate
from reference [14]. Here, the front-end enables customer unseen attacks based on feature correlations by comprehen-
interaction with a graphic user interface. The back-end encom- sively constructing an attack graph rather than picking a few
passes server-side infrastructure for managing databases and attack points/paths. In [24], authors combine system behaviour,
network components. Databases store and retrieve customer, modelled as a provenance graph with contextual information
product, and transaction information in real-time. Payment on attacks which is then analyzed using graph neural networks.
gateway infrastructure facilitates secure transactions between Although our workflows are similar, our problem formulations
the E-commerce back-end and payment processors. A banking differ. Their approach centres on graph pattern matching, while
network facilitates the transfer of funds between banks and ours is focused on link prediction. In [25], authors discovers
financial institutions. a Petri-Net model from an event log to perform scenario
analysis. Our work extends the previous paper by predicting
causal relationship between them. With the event log in the novel attacks.
previous step, we construct a process model. For this purpose, Process mining. Integral to our work is the derivation of
we use the Inductive Miner (IM) algorithm[56]. Among a a process model from the event-logs. Figure 2 shows the
plethora of process mining algorithms, our choice of IM broad activities in process mining. In recent years, the field
is based on quality metric of “fitness” ensuring accurate has witnessed significant attention, with works extending to
reproduction of all log-events. Second, the what-if “attack process discovery for automatically producing process models,
graph model” is developed by semantic enrichment of the conformance checking to allow users to check if a process was
process-level entities with contextual threat and vulnerability executed in line with the reference model, and applications of
information. Leveraging the attack graph structure in the third process mining, for example in healthcare [26], education [27],
stage, we employ a Graph Convolution Network (GCN) with manufacturing [28], etc. To the best of our knowledge, this
multiple neural network layers and passes to transform the paper is the first one that bridges process mining with model-
features of nodes in the attack graph, fuse neighbouring node based security engineering to detect novel attack paths auto-
features, and learn behavioural patterns by training with at- matically from an event-log.
tack/benign sequences, thus predicting the likelihood of edges
between un-connecting neighbouring nodes.
Over a small dataset on e-commerce transactions taken from
an open database [15], we test the effectiveness of PALM.
The outcomes of our framework exhibit promise, featuring
a test accuracy of 83.33% and an area under the receiver
operating characteristic curve (AUC-ROC) of 0.9186. Recall
that the AUROC ranges from 0 to 1 and the larger the AUROC,
the more accurate a link prediction algorithm. Adhering to
open-science principles, we provide all Python scripts on
process discovery, attack path enumeration, and attack
path detection in a public repository for the reproducibility
of our results and to promote extendability. The public
repository is accessible at [16].

II. R ELATED W ORK

Log-analysis. Event-logs are indispensable for system diag- Fig. 2: Process Mining. In the Figure, directed arrows rep-
nostics and security audits, but their non-uniform representa- resent the flow of data and models through different stages:
tion poses challenges for attack detection. Rule-based systems, data preparation to process tree to process model. The loop
such as those described in [17], [18], traditionally browse logs arrow (data preparation) indicates iterative refinement of the
for suspicious labels of IPs, domain names, and signatures event-log data, while the bidirectional arrows denote continu-
using specific attack databases. However, these systems often ous feedback and model enhancement between conformance
fail to detect unknown attacks. Recent works have leveraged checking and the Petri-Net process model.
deep learning frameworks for real-time anomaly detection.
Deeplog [19], DeepAG [20], and LogRobust [21] are some of Link prediction problem in a graph. Given a graph

144

Authorized licensed use limited to: BIRLA INSTITUTE OF TECHNOLOGY AND SCIENCE. Downloaded on July 25,2025 at 15:22:17 UTC from IEEE Xplore. Restrictions apply.
 3

G = (V, E), where V is the set of nodes and E is the set

of edges, the link prediction problem can be described as a
function f : V × V → R that assigns a score f (u, v) to
each pair of nodes (u, v), where set of node pairs (u, v) ∈/ E.
Many real-world problems, such as social network analysis,
bio-informatics and product recommendation, can be encoded
as link prediction problems. For example, in social networks,
link prediction has many potential applications such as un-
covering subversive communities of mafia [29], friendship
suggestions and discovering spurious connections [30]. In the
E-commerce context, the technique is the key to determining
and recommending new items to users. Analytically, several
metrics and measures are popular including similarity-based
indices [31], probabilistic methods [32], and dimensionality
reduction approaches [33]. The success of adversarial actions
is strongly influenced by the time and resources invested by the
attacker [34]. Similar in analytical spirit but with a different
problem formulation, we use graph convolution networks for
link prediction over an attack graph. Some recent works using
graph variants in security contexts are [35], [36], [37].

III. PALM GENERAL ARCHITECTURE

PALM is a pipeline of state-of-the-art algorithms in process

mining and deep learning. Though the scope of the work can
be readily adapted to other contexts, we showcase it via an
E-commerce case study. Figure 3, shows the framework with Fig. 3: PALM Approach. Stage 1 involves generation of a
three distinct stages, including an initial phase dedicated to benign behavioral system model in the form of Petri-Net.
the thorough collection of system and contextual data. Below For this, we use the e-commerce transaction event-log. Here,
we provide an overview of these stages. we also obtain information on threats and vulnerabilities on
1) Contextual environment. In this stage, we note the different system entities using the CAPEC & CWE threat
systemic boundaries detailing components, databases, databases. Stage 2 enhances the Petri-Net model with attack
network protocols and the security layer. Additionally, scenarios resulting in a comprehensive attack graph. Stage
we collect E-commerce transaction data from a public 3 extracts a Graph Convolution Network model from attack
repository. The details about this phase are described in graph to obtain node link probability scores, indicating the
Section III-A. likelihood of novel attack paths.
2) Generation of the Process model. In this stage, we use
process-mining algorithms to discover a state-transition A. Contextual information
machine from the event-log. The discovered model The novelty of PALM is to combine domain information
represents benign behaviour in the form of a Petri- with data-oriented techniques. In the context of the paper, the
Net. For this purpose, we use the Inductive Miner domain model is the E-commerce system model (shown in
(IM) algorithm [38] within the freely accessible ProM Figure 1 providing details on the entities and their functional
tool [39]. The details about this stage are described in relationships. At the same time, the data-oriented technique
Section III-B. consists of an e-commerce transaction event-log. Below, we
3) Threat Identification and construction of attack detail the domain model.
graph. In this stage, we systematically build a com- 1) E-commerce domain information.: Figure 1 shows the
prehensive graph augmenting the entities of the benign system model. Databases track product details and customer
Petri-Net model with attack information. To do this, information, including current shopping cart status, existing
we rigorously browse the existing security databases of products in the cart, customer details, and geographical loca-
CAPEC, ATT&CK, and CWE, and attacks on similar tion. The databases are synchronized with relevant servers such
distributed systems. The details about this stage are as Order Management and Inventory Management Servers.
described in Section III-C. An E-commerce transaction is characterized by a customer
4) Graph Neural Network Model Design. In this stage, interacting with the E-commerce web page. During the pro-
we transform the attack graph to a Graph Neural Net- cess, the information traverses bidirectionally across system
work (GNN) to estimate the link probabilities between components. For example, when the user views a product
two un-connected nodes. The details about this stage are page, the web server receives the request to query the product
described in Section III-D. database, the inventory management system is checked for

145

Authorized licensed use limited to: BIRLA INSTITUTE OF TECHNOLOGY AND SCIENCE. Downloaded on July 25,2025 at 15:22:17 UTC from IEEE Xplore. Restrictions apply.
 4

stock status, and the information is reverted to the front-end for a session can have multiple purchase events, as it represents
display. When proceeding to checkout, the customer database a single order.
is updated with cart information, the inventory database is Preprocessing of raw input. Preprocessing of the raw data
checked for final availability, and the separate payment gate- is performed by carefully cleaning the dataset. Several steps
way is engaged for secure transaction processing. include removing rows with missing values and filtering events
Apart from these functional entities and relationships to render where a user did not perform all the activities. Post-cleaning,
a transaction, we consider the following security features: we obtain a data set with 56,236 entries. However, this huge
• Multi-factor authentication (MFA). MFA enhances se- data together was difficult to analyze due to its non-well-
curity by requiring users to provide two or more verifi- behaving nature, where we encountered that in some cases
cation factors to access the E-commerce system. MFA cart is before view for the same user, which should not be
reduces the risk of unauthorized access by combining the case. For interpretability, we divided the cleaned log into
something the user knows (e.g., password) with some- 103 batches, each with the criteria to retain only five users per-
thing the user has (e.g., a smartphone) or something the forming all four activities in the ideal sequence. We then chose
user is (e.g., fingerprint) [40]. the batch representing the most accurate behaviour to generate
• Secure Electronic Transaction (SET). SET is a pro- a scaled-down model. This makes it possible to automatically
tocol designed to secure credit card transactions over verify the composed workflows. Building reliable systems
the Internet. It ensures the confidentiality of payment requires a considerable amount of effort, especially in data
information, verifies the identities of parties involved preparation. To generate the process tree (in the next phase),
in the transaction and prevents data tampering through we consider only three columns of Timestamp, Activity,
encryption and digital certificates [41]. and User_Id.
• Secure Sockets Layer (SSL) / Transport Layer Se-
curity (TLS). These protocols establish encrypted links B. Generation of Process model
between web servers and browsers, ensuring that all data
passed between them remains private and integral [42],
[43].
• Firewall and Intrusion Detection Systems (IDS). Fire-
walls monitor and control incoming and outgoing net-
work traffic based on predetermined security rules. IDS
detects and responds to potential security breaches or
malicious activity [44].
• Data encryption. Encrypting sensitive data in transit and
at rest protects it from unauthorized access and ensures
that even if data gets intercepted, it cannot get decrypted
without the correct decryption keys [45].
For the purpose of our paper, we use the e-commerce dataset
from kaggle1 .
Below, we provide the key fields in the dataset.
2) On E-commerce transaction event-log.: The e-commerce
dataset consists of transaction events made for a month (Jan-
Fig. 4: Petri-Net model for E-commerce application. Places,
uary 2020) in a multi-category online store. A total of 1048576
denoted as circles represent system states of Login, Home, and
entries are present over nine rows: event_time: Time
Product List. Rectangles represent transitions between these
when the event occurred, recorded in UTC; event_type:
places.
describes the type of event; product_id: unique identifier
for the product; category_id: category ID of the product; Discovering a concurrent process model when a dataset is
category_code: taxonomy code name for the product cat- noisy, as in our case, is not a straightforward task. Many
egory; price: The price of the product; user_id: user iden- process discovery algorithms exist, such as α−algorithm,
tifier; user_session: temporary session ID which changes heuristic miner [46]. In this work, we use the “Inductive Miner
each time a user returns to the online store after a long pause. (IM)” algorithm for process discovery by empirically compar-
The dataset includes the following event types: view: to ing it with the aforementioned algorithms based on quality
designate when a user viewed a product; cart: to desig- constraints of precision, replay fitness and generalization. The
nate when a user added a product to the shopping cart; algorithm constructs a graph that identifies common activity
remove_from_cart: to designate when a user removed sequences and relationships within the log. Subsequently, it
a product from the shopping cart; purchase: to designate seeks cuts in the graph to isolate subsets of activities ex-
when a user purchased a product. It is important to note that hibiting distinct behavioural patterns. Through partitioning, the
algorithm recursively dissects these subsets, exploring deeper
1 [Link] relationships and behaviours within each group. Ultimately, it
cosmetics-shop generates a process tree in .pnml format. A process tree is a

146

Authorized licensed use limited to: BIRLA INSTITUTE OF TECHNOLOGY AND SCIENCE. Downloaded on July 25,2025 at 15:22:17 UTC from IEEE Xplore. Restrictions apply.
 5

rooted graph where the leaves are annotated with activities or in the E-commerce behavioural model in which the user has
silent activities τ and inner nodes are annotated with opera- added products to a virtual cart. From the system point,
tors defining the order of activity execution. These operators the state is strongly knitted to front-end, Order Management
include sequential →, exclusive choice ×, parallel composition system database and network components. To prevent attacks
∧, and redo loop , based on data conditions. We refer the at this point, the deployed security measures of MFA, SET,
reader to [47] for the semantics of these operators. network protocols and data encryption, as discussed in the
Translation of process tree to a Petri-Net follows the previous section take significance. Attackers, at this point, can
semantics of operators. For example, the sequential operation exploit vulnerabilities in third-party components and libraries,
→ specifies the left-most child view is executed, then its steal active session tokens, register a rogue domain controller,
second left-most child cart, and so on until finally its right- steadily ingress the infrastructure, and disable preventive coun-
most child, the operator × forming the as-is model. Figure 4 termeasures, thus leading to compromising integrity, identity
shows the as-is model. Places P, shown as circles, in the as-is theft, fraud, or unauthorized exposure of sensitive information,
model are {Login_page, Home_page, Product_list, marked in red oval box.
Product_page, Cart_list, Order_confirmation,
Logged_out}. The transitions T, shown as rectangular D. Graph Neural Network Model Design
bars are {Authentication, View_homepage, Search,
Graph Neural Networks (GNNs), see Figure 6, generalize
View, View_more, Cart, Remove_from_cart,
traditional neural networks to work with graph-structured data.
Purchase, Cancel_recent_purchase,Exit}.
Among its several variants, Spatial Graph Neural Networks
F ⊆ (P × T) ∪ (T × P) represents the directed arcs
such as Graph Convolutional Networks (GCNs) [52], Graph
that define the connections between places and transitions.
Attention Networks (GATs) [53], and GraphSAGE [54] are
The initial place is Login_page accepting only one token,
well-suited mathematical frameworks for the link prediction
indicating the beginning of the process, while all other places
problem discussed in the paper. Input to the GCN is an attack
initially have zero tokens. The accepting place accepts exactly
graph G = (V, E). Here, V represents the set of nodes, and
one token to indicate the completion of the transition.
E represents the set of edges.
 
C. Threat Identification and Construction of Attack Graph. H (n) = h1 h2 ··· hN
The process model is a low-level model dictating the relation- To establish a signature-based attack database leveraged to
ship between entities for a successful e-transaction. To enrich it predict unseen attack paths.
with attack information on threats, exploits and vulnerabilities,  
we use the standard databases of CAPEC [48], CWE [49], and X = x1 x2 ··· xN
ATT&CK [50]. The limitation of these databases is that they
are generic. Hence, we iteratively search, identify and extract E. Feature Mapping
relevant content from these sources along with tagging the
The nodes vi ∈ V in the attack graph G = (V, E)
entity in our process model. While, the process of obtaining
are associated with respective feature vectors fvi ∈
this information can be performed automatically [51], in this
FV . Each feature vector comprises five boolean fea-
work, we do it manually, leaving automation as future work.
tures: Authentication, Authorization, Network
In Figure 5, we provide a schematic view of the complete
Access, Server Access, and Database Access, in-
attack graph. It consists of six sub-graphs and has a total of
dicating their presence (1) or absence (0). FV is the set of
62 nodes. Nodes V in the graph G = V, E represent the
feature vectors corresponding to the set of nodes V :
system states. Edges, E ⊆ V × V represent the evolution of
the attack move from one state to another by exploiting the  
F V = f v1 f v2 ··· f vN
systemic vulnerabilities. We develop the complete attack graph
in stages. where fvi ∈ {0, 1}5 is the feature vector for node vi , 5 is the
A subgraph G = V  , E   consolidates attack scenarios with number of features, and N is the number of nodes.
V  ⊆ V and E  ⊆ E. An attack path P = (v1 , v2 , . . . , vk ) The selection of features is dependent on recurring prerequi-
is a sequence of nodes where (vi , vi+1 ) ∈ E for 0 ≤ i < k, sites and attack patterns observed in the E-commerce system.
representing a series of vulnerabilities that an adversary could Similarly, edges eij ∈ E in the graph G are associated with
leverage to progress through the system. For each place their respective feature vectors feij ∈ FE , where E is the set
in the Petri-Net model of Login_page, Home_page, of edge labels:
Product_list, Product_page, Cart_list and  
FE = fe1 fe2 · · · feM
Order_confirmation, we construct a corresponding
attack sub-graph. Here, fek = fvik ⊕ fvjk ∈ {0, 1}10 is the concatenated feature
Due to limited space, we cannot display all the sub-graphs. vector for the edge connecting nodes (vik , vjk ). M is the
To ensure clarity, we explain a sub-graph as shown in Fig- number of edges, and ⊕ denotes concatenation.
ure 5. This sub-graph consolidates the various plausible attack Training Examples. The concatenated feature vector fek for
scenarios taking place in the Product list Petri-Net into each edge ek is associated with a binary label (1 or 0), as
consideration. The states of Product list represent a snapshot depicted in Figure 7.

147

Authorized licensed use limited to: BIRLA INSTITUTE OF TECHNOLOGY AND SCIENCE. Downloaded on July 25,2025 at 15:22:17 UTC from IEEE Xplore. Restrictions apply.
 6

Fig. 5: Attack graph representing attacks on E-commerce system. On the right, we represent the complete attack graph.
This figure represents various attacks on the e-commerce system, highlighting how adversaries achieve unauthorized access
and control over the system. In the left, we present a magnified view of one attack scenario. One of the state in the left attack
graph –Identity spoofing is a goal state (marked in a red oval box).

Fig. 7: Feature vector. In this figure, we show how we

concatenate the feature vectors. For example given two nodes
A and B, these nodes are connected by a directed edge, each
with a corresponding feature vector and a binary label. The
Fig. 6: GCN Control Flow Graph. It illustrates the archi-
binary label 0|1 indicates the feasible/actual (1) or infeasible
tecture of a Graph Convolutional Network. The input graph
(0) edge between the nodes.
G consists of nodes x1 , x2 , and x3 . The GCN processes
this graph through multiple convolution layers, such as Graph The core operation of a GCN is graph convolution, which
Convolution Layer 1 and Graph Convolution Layer 2, applying aggregates information from a node’s neighbours to update
an activation function (ReLU) between layers. The final output its feature representation. The graph convolution operation at
is an embedded graph with nodes y1 , y2 , and y3 , resulting from layer l is given by:
the transformations across N convolution layers.
H (l+1) = σ(ÂH (l) W (l) )
• 1 represents a positive example, indicating a valid tran-
Where H (l) is the feature matrix at layer l (with H (0) = X),
sition between the states.
 is the normalized adjacency matrix of the graph with added
• 0 represents a negative example, indicating an infeasible
self-loops, W (l) is the learnable weight matrix at layer l, and
transition.
σ is a non-linear activation function such as ReLU. After each
Infeasible transitions indicate no relationship or possible inter- graph convolution operation, a non-linear activation function is
action between those entities. For example, given two entities, applied to introduce non-linearity into the model. A commonly
the “Inventory Management System” and the “Authentication used activation function is the Rectified Linear Unit (ReLU),
Server”, the former does not directly interact with the authen- defined as:
tication server responsible for verifying user credentials.
Graph Convolutional Network Layers and Forward Pass. ReLU(x) = max(0, x)

148

Authorized licensed use limited to: BIRLA INSTITUTE OF TECHNOLOGY AND SCIENCE. Downloaded on July 25,2025 at 15:22:17 UTC from IEEE Xplore. Restrictions apply.
 7

Applying ReLU after the convolution operation updates the Recall represents the proportion of detected attacks among all
node features as follows: the true attacks:
TP
Recall = (4)
TP + FN
H (l+1) = ReLU(ÂH (l) W (l) )
The F1 score is calculated using precision and recall and
These transformations result in “node embeddings”, which represents their harmonic mean. It can assess the overall
convey the enriched representations of the nodes that capture performance of the model:
crucial information about the nodes and their connections. 2 × Precision × Recall
The first Graph Convolutional Network (GCN) layer, which F1-score =
Precision + Recall
takes the node feature matrix X and the edge index list I to
2) Results.: Due to the absence of similar works, we evaluate
combine each node’s features with those of its neighbours,
PALM using state-of-the-art learning models. We begin by
producing new feature vectors in a hidden space. The features
demonstrating why we chose a GCN model for novel attack
transformed after the ReLU activation function are input to the
path detection. In addition to GCN, we evaluated the following
second GCN layer, which enhances the node representations
models: GraphSage and Graph Attention Network (GAT). We
by incorporating broader neighbourhood information, resulting
compare their accuracies, precision/recall values, false positive
in rich node embeddings. Additionally, a fully connected layer
rates (FPR), and F1 scores. In Table I, it becomes clear that
computes edge embeddings to generate edge logits, predicting
GCN (with Weight Decay = 0.00047) performs the best.
the existence of edges. The forward pass applies the first GCN
layer to the node features, uses the edge index to understand TABLE I: Performance of ML models
connections, and applies ReLU for non-linearity. The second
Model Accuracy Precision Recall FPR F1
GCN layer generates the final node embeddings, while the
GraphSage 63.3% 0.80 0.47 0.15 0.59
fully connected layer processes edge features into logits for GAT 73.3% 0.76 0.76 0.30 0.76
final edge predictions. GCN 83.3% 0.83 0.88 0.23 0.85

We use the GCN model to predict the feasibility of all

IV. E XPERIMENT AND E VALUATION plausible edges of the attack graph. The test dataset contains
all plausible edges except the edges in the training dataset.
Implementation. The operating system in our setup is
The edges are converted into test vectors by concatenating
Windows 11 with 16GB memory and an 11th Gen Intel Core
the pair of connected node feature vectors. The confusion
i7-1165G7 CPU @ 2.80GHz. PALM is implemented in Python
matrix in Table II shows the number of true negatives (TNs),
3.12.3 and PyTorch 2.3.0+CPU to train the neural network
false positives (FPs), false negatives (FNs), and true positives
model as a back-end with 760 lines of code (LoC).
(TPs), depicting that the model has 10 true negatives, 15
We use PyTorch and the DGL (Deep Graph Library) to create
true positives, 3 false negatives, and 2 false positives. The
and train our graph neural network model. Our model utilizes
test dataset contains TD = 30 examples, indicating the model
a two-layer Graph Convolutional Network to aggregate the
effectively identifies negatives and positives., though it does
graph information. The input and output dimensions of the
make some errors in prediction.
node vectors in the model are 5 and 103, respectively. We
The attack DAG has 62 nodes and the training set has 118
optimize the model parameters using the Adam optimizer and
examples. The GCN model successfully predicts the existence
train the model for 100 epochs. The learning rate changes
of new feasible edges in the attack DAG. Each new edge cor-
step-wise, decreasing by a factor of 0.1 every ten epochs. The
responds to a unique novel attack path. Some feasible edges of
initial learning rate is 0.01.
the attack DAG predicted by GCN are listed in Table III along
1) Metrics.: We employed accuracy, precision, recall, and F1
with associated predicted probability as weight. These attacks
score as the four key evaluation metrics to assess the model’s
have been chosen to represent the most popular vulnerability
performance. These metrics were computed using the scikit-
categories. Training accuracy refers to the accuracy of the
learn library, which calculates them based on the number of
GCN model when evaluated on the training dataset. Only five
true positives (TP), false positives (FP), true negatives (TN),
of the 30 testing data points were incorrectly classified by the
and false negatives (FN). The specific formulas are as follows:
GCN model, yielding an accuracy of 83.3%. The test accuracy
Accuracy represents the probability of correct predictions
is computed using the scikit-learn library. We observed that
made by the GCN model among all the sample data, reflecting
2 of the 17 positive predictions were incorrect. On the other
the overall prediction accuracy of the model.
hand, 10 out of 13 negative predictions were accurate. Thus, 25
The Accuracy is defined as:
of the 30 data points of the test dataset were classified correctly
TP + TN by the GCN model, yielding a test accuracy of 83.3%.
Accuracy = (2)
TP + FP + TN + FN Adjacency matrices represent relationships between nodes in
a graph, indicating whether pairs of nodes are connected,
Precision represents the proportion of true attacks among all have no connection, or represent an infeasible connection.
the samples detected as APT [55] attacks: These matrices are essential tools in graph theory and network
TP analysis for both visualizing and analyzing the structure and
Precision = (3) connections within a graph. The adjacency matrix in Figure 8a
TP + FP

149

Authorized licensed use limited to: BIRLA INSTITUTE OF TECHNOLOGY AND SCIENCE. Downloaded on July 25,2025 at 15:22:17 UTC from IEEE Xplore. Restrictions apply.
 8

is constructed from training data using positive and infeasible a narrowed focus on predicting novel attacks, for which
edges. Each entry represents a connection between two nodes: such comprehensive attack graph is not required.
blue for direct connections, blank for no connection, and • Manual construction of attack graph. In this paper,
red for infeasible connections. This matrix serves as the we utilized a number of security databases, to enhance
foundational data for training the GCN, enabling the model the discovered Petri-Net model, showing how an attacker
to learn from valid and infeasible connections. can progress to system compromise via exploiting the
Figure 8b shows the GCN’s predictions about potential node system and network vulnerabilities. Though manual or
connections. This matrix contains only predicted edges, with semi-automated threat modelling techniques have been a
the shade of blue representing the probability of these predic- reasoned choice in absence of complete automation tool,
tions. Darker shades indicate higher confidence, while lighter we strongly believe that this restricts its practical usage
shades indicate lower confidence. and is prone to inaccuracies. Automation of this part is
an actively investigated field in our lab.
TABLE II: Confusion Matrix
• Scarce data. In this work, we utilized the deep learning
TD = 30 Actual = No Actual = Yes model of a Graph Convolution Network (GCN). Gener-
Predicted = No TNs = 10 FNs = 3 ally, its use requires a much larger (attack) graph as input,
Predicted = Yes FPs = 2 TPs = 15 which is one of the reasons for lower accuracy of PALM
framework. However, we believe that achieving a more
TABLE III: Predicted Links representative attack graph is feasible by focusing on au-
tomatically generation of the attack graph, as mentioned
Link Weight earlier.
Render Malicious 0.990239 All the above challenges make PALM immediate deployment
Advertisement → Replicate difficult. Notwithstanding, one should note that the problem
Browser Session template of “prediction” of novel attacks is an inherently
Register a Rogue Domain 0.995662 challenging where literature is scarce and our paper is one
Controller (DC) → Usurp of the few to initiate it.
Access to IMS SMB Protocol
Malicious Email in 0.996441
Employee’s Email → V. C ONCLUSION
i. Leverage Malicious RDP
Server ii. An RDP Relay iii. The increasing complexity of cyber threats necessitates in-
Weaponized RDP Connection novative solutions for identifying unforeseen attacks. In re-
File sponse, we propose PALM, an end-to-end framework that
Usurp Access to IMS SMB 0.998655 integrates process mining, graph-based threat modelling, and
Protocol → Create User deep learning. PALM combines knowledge of known vul-
Account with Full Privilege
nerabilities with data-oriented methodologies to construct a
[Link] → Access 1.000000 comprehensive graph-structure model. An E-commerce case
Customer Database
study demonstrated PALM’s effectiveness, achieving 83.33%
accuracy and an AUC-ROC of 0.9186 in identifying novel
Discussion. While PALM advances state-of-the-art with an
attack paths.
novel idea to predict unforeseen attacks and is successful with
To maximize the potential of PALM, future research should
its demonstrated results, it builds on a few assumptions on data
prioritize enhancing event log security, integrating multiple log
and analytical techniques, which forms the ground for future
types, and automating both Petri-Net model supplementation
work.
and attack graph development. Despite the challenges, PALM
• Assumption of benign event logs. In our paper, we represents a significant advancement in cyber attack prediction
used a data-set of an e-commerce application taken from and will play a crucial role in developing robust, proactive
a publicly available database. Although it appears to cybersecurity strategies for digitized systems.
be a good choice for the proof-of-concept, our work Acknowledgment. The corresponding author of the pa-
makes a strong assumption of data-set being benign. In per would like to acknowledge the C3iHub, Indian In-
practical contexts, such dataset may be tampered, hence stitute of Technology, Kanpur, Project number IHUB-
the discovered Petri-Net model from tampered data set is NTIHAC/2021/01/4, which provided the funding for this re-
not reflective of benign system behaviour. search.
• Single source of system behaviour. In this paper, we
demonstrate our work using a single source – the event
log of e-commerce transactions. Much in practical con- R EFERENCES
texts, along with these logs, many other crucial events are [1] S. Furnell, “E-commerce security: a question of trust,” J. Computer
logged, for example, the network logs, or system logs. A Fraud & Security, no. 10, pp. 10–14, 2004.
comprehensive system behavioral model would emerge [2] T. F. Yen, A. Oprea, K. Onarlioglu, T. Leetham, W. Robertson, A. Juels,
and E. Kirda, “Beehive: Large-scale log analysis for detecting suspicious
by collating all these logs. While, such information activity in enterprise networks,” Proc. 29th annual computer security
would be useful in many other contexts, this paper has applications Conf., pp. 199–208, 2013.

150

Authorized licensed use limited to: BIRLA INSTITUTE OF TECHNOLOGY AND SCIENCE. Downloaded on July 25,2025 at 15:22:17 UTC from IEEE Xplore. Restrictions apply.
 9

(a) Adjacency Matrix for Training Data (b) Adjacency Matrix for Predicted Non-existent Edges
Fig. 8: Adjacency matrices. These matrices represent the node relationships. The matrix in Figure 8(a) depicts the connections
from the training data, with blue dots representing direct connections, blanks for no connections, and red boxes for infeasible
ones, used to train the GCN. The matrix in Figure 8(b) shows the GCN’s predicted non-existent edges, with shades of blue boxes
indicating the probability of predictions. Darker shades reflect higher confidence and lighter shades indicate lower confidence.

[3] M. Asiri, N. Saxena, R. Gjomemo, and P. Burnap, “Understanding literature review,” J. Electronic Commerce Research and Applications,
indicators of compromise against cyber-attacks in industrial control sys- vol. 56, no. C, 2022.
tems: A security perspective,” J. ACM Transactions on Cyber-Physical [15] “E-commerce events history in cosmetics shop,” [Link]
Systems, vol. 7, no. 2, pp. 1–33, 2023. com/datasets/mkechinov/ecommerce-events-history-in-cosmetics-shop,
[4] S. S. Chen, R. H. Hwang, A. Ali, Y. D. Lin, Y. C. Wei, and T. W. Pai, accessed: September 15, 2024.
“Improving quality of indicators of compromise using stix graphs,” J. [16] PALM: Public repository. [Link] Ac-
Comput. Secur., vol. 144, p. 103972, 2024. cessed: September 15, 2024.
[5] A. Patcha and J. M. Park, “An overview of anomaly detection techniques: [17] D. Gümüşbaş, T. Yıldırım, A. Genovese, and F. Scotti, “A comprehen-
Existing solutions and latest technological trends,” J. Comput. Secur., sive survey of databases and deep learning methods for cybersecurity
vol. 51, no. 12, pp. 3448–3470, 2007. and intrusion detection systems,” J. IEEE Systems, vol. 15, no. 2, pp.
[6] R. Kumar, R. Kela, S. Singh, and R. T. Rasua, “APT Attacks on 1717–1731, 2021.
Industrial Control Systems: A Tale of Three Incidents,” J. Int. Critical [18] C. Abad, J. Taylor, C. Sengul, W. Yurcik, Y. Zhou, and K. Rowe,
Infrastructure Protection, vol. 37, 2022. “Log correlation for intrusion detection: a proof of concept,” Proc. 19th
[7] R. Kumar, “Truth or dare: quantitative security risk analysis via attack Annual Computer Security Applications Conf., pp. 255–264, 2003.
trees,” 2018. [19] M. Du, F. Li, G. Zheng, and V. Srikumar, “Deeplog: Anomaly detection
and diagnosis from system logs through deep learning,” Proc. (ACM)
[8] X. Ou, W. F. Boyer, and M. A. McQueen, “A Scalable Approach to
SIGSAC conf. on computer and communications security, pp. 1285–
Attack Graph Generation,” Proc. 13th ACM Conf. on Computer and
1298, 2017.
Communications Security., pp. 336–345, 2006.
[20] T. Li, Y. Jiang, C. Lin, M. S. Obaidat, Y. Shen, and J. Ma, “Deepag:
[9] R. Kumar, I. Rai, K. Vora, and M. Shah, “Realistic attacks with realistic
Attack graph construction and threats prediction with bi-directional
attackers: An information-security risk analysis of an automatic metering
deep learning,” J. Transactions on Dependable and Secure Computing.,
infrastructure,” in IECON 2023- 49th Annual Conference of the IEEE
vol. 20, no. 1, pp. 740–757, 2023.
Industrial Electronics Society, 2023, pp. 1–6.
[21] W. Meng, Y. Liu, Y. Zhu, S. Zhang, D. Pei, Y. Liu, Y. Chen, R. Zhang,
[10] R. Kumar, S. Singh, and R. Kela, “A quantitative security risk analysis S. Tao, P. Sun, and R. Zhou, “Loganomaly: Unsupervised detection of
framework for modelling and analyzing advanced persistent threats,” vol. sequential and quantitative anomalies in unstructured logs.” Int. Joint
12637, pp. 29–46, 2020. Conf. on AI (IJCAI), vol. 19, no. 7, pp. 4739–4745, 2019.
[11] D. Granata and M. Rak, “Systematic analysis of automated threat [22] S. M. Milajerdi, B. Eshete, R. Gjomemo, and V. Venkatakrishnan,
modelling techniques: Comparison of open-source tools,” J. Software “Poirot: Aligning attack behavior with kernel audit records for cyber
Quality, vol. 32, no. 1, pp. 125–161, 2024. threat hunting,” Proc. 19th (ACM) SIGSAC Conf. on Computer and
[12] N. Tax, K. J. de Vries, M. de Jong, N. Dosoula, B. van den Akker, Communication Security, p. 1795–1812, 2019.
J. Smith, O. Thuong, and L. Bernardi, “Machine learning for fraud [23] X. Yu, P. Joshi, J. Xu, G. Jin, H. Zhang, and G. Jiang, “Cloudseer:
detection in e-Commerce: A research agenda,” Proc. 2nd Int. Workshop, Workflow monitoring of cloud infrastructures via interleaved logs,” J.
MLHat, Virtual Event, pp. 30–54, 2021. ACM SIGARCH Computer Architecture News, vol. 44, no. 2, pp. 489–
[13] S. Visbeek, E. Acar, and F. den Hengst, “Explainable Fraud Detection 502, 2016.
with Deep Symbolic Classification,” World Conf. on Explainable AI , [24] Y. Pan, L. Cai, T. Leng, L. Zhao, J. Ma, A. Yu, and D. Meng, “At-
pp. 350–373, 2024. tackminer: A graph neural network based approach for attack detection
[14] V. F. Rodrigues, L. M. Policarpo, D. E. da Silveira, R. da Rosa Righi, from audit logs,” Int. Conf. on Security and Privacy in Communication
C. A. da Costa, J. L. V. Barbosa, R. S. Antunes, R. Scorsatto, and Systems, pp. 510–528, 2023.
T. Arcot, “Fraud detection and prevention in e-commerce: A systematic [25] M. D. Makwana, V. Thakkar, D. Das, and R. Kumar, “Simulating cyber-

151

Authorized licensed use limited to: BIRLA INSTITUTE OF TECHNOLOGY AND SCIENCE. Downloaded on July 25,2025 at 15:22:17 UTC from IEEE Xplore. Restrictions apply.
 10

attack scenarios by discovering petri-nets from large-scale event logs,” Conf. on Cognitive and Intelligent Computing ICCIC, Volume 2, pp.
in 2024 16th International Conference on COMmunication Systems & 463–468, 2023.
NETworkS (COMSNETS), 2024, pp. 49–54. [47] W. van der Aalst, J. Buijs, and B. van Dongen, “Towards Improving
[26] M. LANGab, T. Bürkle, S. Laumann, and H.-U. Prokosch, “Process the Representational Bias of Process Mining,” Data-Driven Process
Mining for Clinical Workflows: Challenges and Current Limitations,” Discovery and Analysis: First Int. Symposium, SIMPDA 2011, vol. 1,
eHealth Beyond the Horizon - Get IT There, beyond the horizon: 2012.
Proc. MIE, 21st Int. Congress of the European Federation for Medical [48] Common attack pattern enumeration and classification (CAPEC). https:
Informatics, vol. 136, pp. 229–234, 2008. //[Link]/. Accessed: September 15, 2024.
[27] C. Diamantini, L. Genga, A. Mircoli, D. Potena, and N. Zannone, “Un- [49] Common weakness enumeration (CWE). [Link] Ac-
derstanding the Stumbling Blocks of Italian Higher Education System: cessed: September 15, 2024.
A Process Mining Approach,” J. Expert System Applications, vol. 242, [50] MITRE ATT&CK. [Link] Accessed: September 15,
pp. 1–11, 2024. 2024.
[28] A. Birk, Y. Wilhelm, S. Dreher, C. Flack, P. Reimann, and C. Gröger, [51] K. Ahmed, S. K. Khurshid, and S. Hina, “Cyberentrel: Joint extraction
“A Real-World Application of Process Mining for Data-Driven Analysis of cyber entities and relations using deep learning,” J. Comput. Secur.,
of Multi-Level Interlinked Manufacturing Processes,” J. Procedia CIRP, vol. 136, p. 103579, 2024.
vol. 104, pp. 417–422, 2021. [52] T. N. Kipf and M. Welling, “Semi-supervised classification with graph
[29] C. Yang, “Crimegraphnet: Link prediction in criminal networks with convolutional networks,” 5th Int. Conf. on Learning Representations,
graph convolutional networks,” J. ArXiv, vol. abs/2311.18543, 2023. ICLR, 2016.
[30] P. Wang, B. Xu, Y. Wu, and X. Zhou, “Link prediction in social [53] P. Veličković, G. Cucurull, A. Casanova, A. Romero, P. Lio, , and
networks: the state-of-the-art,” J. Science China Information Science, B. Yoshua, “Graph attention networks,” J. CoRR, vol. abs/1710.10903,
vol. 58, no. 1, pp. 1–38, 2015. 2017.
[31] S. Shaikh, S. Rathi, and P. Janrao, “Recommendation system in e- [54] W. Hamilton, Z. Ying, and J. Leskovec, “Inductive representation
commerce websites: A graph based approached,” IEEE 7th Int. Advance learning on large graphs,” Advances in Neural Information Processing
Computing Conf. (IACC), pp. 931–934, 2017. Systems 30: Annual Conf. on Neural Information Processing Systems,
[32] R. S. Gaikwad, S. S. Udmale, and V. K. Sambhe, “E-commerce rec- vol. 30, 2017.
ommendation system using improved probabilistic model,” Information [55] R. Kumar, S. Singh, and R. Kela, “Analyzing advanced persistent threats
and Communication Technology for Sustainable Development: Proc. of using game theory: A critical literature review,” Critical Infrastructure
ICT4SD, Volume 2, pp. 277–284, 2018. Protection XV: 15th IFIP WG 11.10 International Conference, ICCIP,
[33] S. Bandyopadhyay, S. Thakur, and J. Mandal, “Product recommendation Virtual Event, pp. 45–69, 2022.
for e-commerce business by applying principal component analysis (pca)
and k-means clustering: benefit for the society,” J. Innovations in Systems
and Software Engineering, vol. 17, no. 1, pp. 45–52, 2021.
[34] R. Kumar, D. Guck, and M. Stoelinga, “Time dependent analysis with
dynamic counter measure trees,” arXiv preprint arXiv:1510.00050, 2015.
[35] J. Gruber, L. L. Voigt, Z. Benenson, and F. C. Freiling, “Foundations
of cybercriminalistics: From general process models to case-specific
concretizations in cybercrime investigations,” J. Forensic Science Int.:
Digital Investigation, vol. 43, pp. 1–11, 2022.
[36] D. R. Arikkat, P. Vinod, R. R. KA, S. Nicolazzo, A. Nocera, G. Timpau,
and M. Conti, “OSTIS: A novel organization-specific threat intelligence
system,” J. Comput. Secur., vol. 145, pp. 1–19, 2024.
[37] T. Saha, N. Aaraj, N. Ajjarapu, and N. K. Jha, “SHARKS: Smart
Hacking Approaches for Risk Scanning in Internet-of-Things and Cyber-
Physical Systems Based on Machine Learning,” J. IEEE Transactions
on Emerging Topics in Computing, vol. 10, no. 2, pp. 870–885, 2021.
[38] S. Leemans, D. Fahland, and W. Aalst, “Discovering Block-Structured
Process Models from Event Logs Containing Infrequent Behaviour,”
Business Process Manag. Workshops: BPM 2013 Int. Workshops, vol.
171, pp. 1–13, 2014.
[39] B. F. Van Dongen, A. K. A. de Medeiros, H. M. Verbeek, A. Weijters,
and W. M. van Der Aalst, “The ProM framework: A new era in process
mining tool support,” Application and Theory of Petri Nets : 26th Int.
Conf., ICATPN, Proc., pp. 444–454, 2005.
[40] A. Ometov, S. Bezzateev, N. Mäkitalo, S. Andreev, T. Mikkonen, and
Y. Koucheryavy, “Multi-factor authentication: A survey,” J. Cryptogr.,
vol. 2, no. 1, p. 1, 2018.
[41] P. Giorgini, F. Massacci, and J. Mylopoulos, “Requirement engineering
meets security: A case study on modelling secure electronic transactions
by VISA and Mastercard,” Int. Conf. on Conceptual Modeling, pp. 263–
276, 2003.
[42] R. Dastres and M. Soori, “Secure socket layer (SSL) in the network and
web security,” J. Int. Computer and Information Engineering, vol. 14,
no. 10, pp. 330–333, 2020.
[43] G. Apostolopoulos, V. Peris, and D. Saha, “Transport layer security:
How much does it really cost?” Proc. IEEE INFOCOM ’99, The Conf.
on Computer Communications, 18th Annual Joint Conf. of the IEEE
Computer and Communications Societies, vol. 2, pp. 717–725, 1999.
[44] H. Cavusoglu, S. Raghunathan, and H. Cavusoglu, “Configuration of
and interaction between information security technologies: The case
of firewalls and intrusion detection systems,” J. Information Systems
Research, vol. 20, no. 2, pp. 198–217, 2009.
[45] A. Atadoga, O. A. Farayola, B. S. Ayinla, O. O. Amoo, T. O. Abrahams,
and F. Osasona, “A comparative review of data encryption methods in
the USA and Europe,” J. Computer Science and IT Research, vol. 5,
no. 2, pp. 447–460, 2024.
[46] M. Shanmuga Sundari and R. K. Nayak, “Comparative analysis of
process mining algorithms in industrial applications,” Proc. of the Int.

152

Authorized licensed use limited to: BIRLA INSTITUTE OF TECHNOLOGY AND SCIENCE. Downloaded on July 25,2025 at 15:22:17 UTC from IEEE Xplore. Restrictions apply.