KnowML: Improving Generalization of ML-NIDS with Attack Knowledge Graphs

This repository contains the code for our Euro S&P 2026 paper:

Xin Fan Guo, Xinran Zheng, Albert Merono Penuela, Lorenzo Cavallaro, Sergio Maffeis, and Fabio Pierazzi , "KnowML: Improving Generalization of ML-NIDS with Attack Knowledge Graphs" , In Proc. 11th IEEE European Symposium on Security and Privacy (EuroS&P), 2026

If using this code for research, please cite us:

@inproceedings{guo2026knowml,
  title = {KnowML: Improving Generalization of ML-NIDS with Attack Knowledge Graphs},
  author = {Guo, Xin Fan and and Xinran Zheng and Penuela, Albert Merono and Cavallaro, Lorenzo and Maffeis, Sergio and Pierazzi, Fabio},
  year = {2026},
  booktitle = {Proc. 11th IEEE European Symposium on Security and Privacy (EuroS\&P)},
}

Repository Structure

The repository is organized as follows:

• Feature_extraction/ Contains the code for feature extraction.

• KG_construction/ Contains the code for attack knowledge graph construction.

Dataset

The dataset used in this work is too large to be shared directly through this repository. We are currently figuring out the best way to make it available.

In the meantime, any questions can be sent to:

x.guo23@imperial.ac.uk