In recent years, graph neural networks (GNNs) have gained significant attention due to their outstanding performance on graph-related tasks by utilizing neighborhood aggregation. However, traditional GNNs are primarily designed based on the homophily assumption, which means that they show poor performance on heterophilic networks where dissimilar nodes prefer to connect. To address this issue, several heterophilic GNNs have been proposed that employ techniques, such as extending local neighbors and improving GNN architectures. From another perspective, recent studies have shown that, unlike homophilic GNNs, heterophilic GNNs exhibit higher robustness against graph adversarial attacks. In these attacks, the attackers try to inject small perturbations into the graph. Therefore, in this study, we delve into the core designs of heterophilic GNNs, including high-order neighbor, potential neighbor, ego-neighbor separation, and interlayer combination designs. We further analyze the influence of these key designs on the robustness of GNNs. We conducted comprehensive experiments to compare the impact of different designs on baseline and real-world GNN models. The findings of this work can serve as a reference for future studies aiming to design more robust and universal GNNs.

Strengthening critical components is considered one of the most essential means to enhance the robustness of power networks against cascading failure. This paper proposes an iterative method to strengthen the critical power network branches identified from a tailor-made failure propagation graph. To construct the failure propagation graph, we generate numerous cascading failure trees, capturing both temporal and spatial features of failure propagation processes from cascading failure simulations. The constructed graph is a weighted and directed graph that is able to characterize failure propagation patterns in a power network. By employing weighted eigenvector centrality to assess node criticality, we iterate through the graph to identify the most significant nodes and subsequently determine the critical power network branches to be strengthened. Simulation results in the IEEE 118 bus system demonstrate the effectiveness and efficiency of our strategy in mitigating cascading failure compared to existing methods.

Graph neural networks (GNNs) have found successful applications in various graph-related tasks. However, recent studies have shown that many GNNs are vulnerable to adversarial attacks. In a vast majority of existing studies, adversarial attacks on GNNs are launched via direct modification of the original graph such as adding/removing links, which may not be applicable in practice. In this article, we focus on a realistic attack operation via injecting fake nodes. The proposed global attack strategy via node injection (GANI) is designed under the comprehensive consideration of an unnoticeable perturbation setting from both structure and feature domains. Specifically, to make the node injections as imperceptible and effective as possible, we propose a sampling operation to determine the degree of the newly injected nodes, and then generate features and select neighbors for these injected nodes based on the statistical information of features and evolutionary perturbations obtained from a genetic algorithm, respectively. In particular, the proposed feature generation mechanism is suitable for both binary and continuous node features. Extensive experimental results on benchmark datasets against both general and defended GNNs show strong attack performance of GANI. Moreover, the imperceptibility analyses also demonstrate that GANI achieves a relatively unnoticeable injection on benchmark datasets.

As one of the most typical cybercrime types, phishing scams have extended the devil’s hand to the emerging blockchain ecosystem in recent years. Especially, huge economic losses have been caused by phishing scams in Ethereum, the second-largest blockchain system. Existing approaches for Ethereum phishing detection, however, typically use machine learning or transaction graph embedding methods to identify phishers in isolation and do not effectively uncover the group of transaction accounts linked to scams (which we term a “gang”). Since accounts are pseudonymous in Ethereum, these undisclosed conspirator accounts have potential risks to the system. In this paper, we conduct the first study that characterizes and detects Ethereum phishing gangs. We first investigate the transaction behaviors in phishing gangs from the perspectives of individuals, pairs, and higher-order patterns. Our analysis reveals that although the Ethereum transaction graph is sparse with a highly skewed degree distribution, phishing accounts in the same gang have closer relationships and share specific transaction patterns. Based on our findings, we formalize the phishing gang detection problem and introduce a novel detection model named PGDetector. Given a risky phishing account as a seed, PGDetector can find out the potential risky accounts sharing close relationships within the seed’s community based on genetic algorithm optimization. Experimental results on large-scale Ethereum transaction data demonstrate the effectiveness of PGDetector.

Graph neural networks (GNNs) have been widely applied to network related tasks in recent years, including node classification, link prediction, community detection, etc. The core idea of GNNs is neighborhood aggregation where nodes in a network can learn adequate representations by aggregating the information from their neighbors. Despite the great success of GNNs, few studies investigate how different types of structure of the network based data, such as random networks, small-world networks, and scale-free networks, affect the performance of GNNs in completing network related tasks. Moreover, recent studies have pointed out that the homophily of labels is one of the key properties that influence the performance of GNNs. In this work, we study the performance of GNNs for different types of network structure at different homophily levels. Comprehensive simulations on synthetic networks show the considerable impact of network structure and homophily on the performance of GNNs in terms of prediction effectiveness in node classification tasks. The findings of this work emphasize the necessary consideration of network structure of datasets in designing reliable GNNs so that the performance of these GNNs will not deviate due to structural change of the underlined data.

With the wide application and development of blockchain technology, the past years have witnessed the emergence of various cybercrimes, which have caused a huge amount of economic loss. Among them, phishing scams on the blockchain are regarded as a serious threat to the trading security of the blockchain ecosystem. By modeling the transaction data of blockchain as a network, a series of graph-based phishing detection frameworks have been proposed. Enlightened by adversarial attacks of graph data, we propose to verify the robustness of current phishing detection frameworks under intentional attackers aiming to hide phishing behaviors. In this study, we first propose a general phishing detection framework based on feature engineering and then propose a phishing hiding framework combing the greedy selection mechanism with four phishing hiding strategies to measure the robustness of the proposed general detection models. Extensive experiments evaluate the detective performance of the phishing detection model and its robustness against the hiding framework. The experimental results indicate that the detective model based on feature engineering is rather fragile under adversarial attacks.

Cascading failure modeling and analysis provide convenient tools for assessing and enhancing the robustness of power systems against severe power outages. In this paper, we apply a neural network-based classifier to predict the onset time of cascading failure. Onset time, which has been reported as the time when the number of component failure begins to rapidly increase in the failure propagation, serves as a crucial metric to evaluate the vulnerability of power systems to cascading failure. We formulate the prediction task as a multi-class classification problem and adopt a neural network-based classifier where topological and electrical information of a power system network can be exploited for learning. Experimental results on the UIUC 150-Bus power system demonstrate a high classification accuracy by only leveraging the initial states of power networks and the initial failure sets containing the power components to be tripped at the beginning of cascading failure.

The security issue of complex network systems, such as communication systems and power grids, has attracted increasing attention due to cascading failure threats. Many existing studies have investigated the robustness of complex networks against cascading failure from an attacker's perspective. However, most of them focus on the synchronous attack in which the network components under attack are removed synchronously rather than in a sequential fashion. Most recent pioneering work on sequential attack designs the attack strategies based on simple heuristics like degree and load information, which may ignore the inside functions of nodes. In the paper, we exploit a reinforcement learning-based sequential attack method to investigate the impact of different nodes on cascading failure. Besides, a candidate pool strategy is proposed to improve the performance of the reinforcement learning method. Simulation results on Barabási-Albert scale-free networks and real-world networks have demonstrated the superiority and effectiveness of the proposed method.

With the prosperous development of blockchain technologies in the past few years, some cybercrimes have emerged in the blockchain ecosystem, such as the phishing scams on Ethereum. To alleviate these security problems, a few anomaly detection frameworks were proposed. Specifically, previous studies usually model the transfer relationship between accounts in the blockchain ecosystem as a transaction network, where nodes represent accounts and edges represent the corresponding transaction records. Inspired by the adversarial attacks on graph data, we believe the robustness of existing detection frameworks still needs to be further verified even though they have achieved good performance. In this paper, a phishing detection framework based on feature learning and a phishing hidden framework based on inserting transaction records are proposed, respectively. Experimental results show the effectiveness of our phishing detection framework and the superiority of the phishing hidden strategies, which indicate that existing phishing detection frameworks are lack of robustness and still need further improvement against malicious attacks.

Graph embedding has been widely used to process various downstream tasks on large-scale graphs, i.e. node classification, community detection and link prediction. Among various embedding methods, Deep Graph Infomax (DGI) is a newly proposed method which achieves excellent performance in node classification. However, such outstanding achievement may cause the over-mining issue of user privacy and the robustness of this embedding method is still unexplored. In this paper, we investigate how to disturb the node classification accuracy of DGI from an attacker's perspective. We propose a novel attack method called Cross Entropy Attack (CEA), which aims to make target nodes be misclassified by DGI model with only limited edges being modified. By slightly changing the topological structure of a graph, CEA can successfully interfere with the accuracy of node classification in an unsupervised manner. Experiment results show that the proposed CEA obviously outperforms two baseline methods in terms of both Misclassified Rate (MR) and Average Modified of Edge (AME).

In the study of power grid security, the cascading failure process has attracted increasing attention in recent years. The robustness of a power grid against cascading failure can be evaluated from both structural and functional perspective. In most previous studies, these two types of robustness were treated separately in spite of the fact that both of them are considered equally important in many scenarios. In our study, we utilize multi-objective optimization to take both aspects of the system robustness against cascading failure into consideration. Based on NSGA-II, we develop an effective attack strategy to localize the critical nodes in the power grids. The variety of our solution is preserved, enabling flexible choices by decision makers. Simulations on a realistic power grid dataset demonstrate the capability of our strategy in serving as a guideline for launching attacks in power grids, for it can damage the power grid to the greatest extent in terms of both metrics.