Network attack detection using graph neural networks
Abstract
This paper presents a graph neural network (GNN)-based approach for network attack detection, emphasizing the representation of hosts and flows as heterogeneous graphs. By leveraging topological and relational dependencies, the proposed models—GraphSAGE, GAT, and temporal GNN—demonstrate superior adaptability and accuracy compared to traditional intrusion detection systems. Evaluations on CIC-IDS2017, UNSW-NB15, and real NetFlow data confirm that GNNs effectively capture multi-stage and evolving attack behaviors while maintaining robustness under dynamic network conditions.
Downloads
References
[1]. Bilot, T. et al. (2023) “Graph neural networks for intrusion detection: A survey,” IEEE Access, 11, pp. 49114–49139. doi:10.1109/ACCESS.2023.3275789.
[2]. Caville, E. et al. (2022) “Anomal-E: A self-supervised network intrusion detection system based on graph neural networks,” Knowledge-Based Systems, 258, p. 110030. doi:10.1016/j.knosys.2022.110030.
[3]. Nandan, M., Mitra, S. and De, D. (2025) “GraphXAI: a survey of graph neural networks (GNNs) for explainable AI (XAI),” Neural Computing and Applications, 37, pp. 10949–11000. doi:10.1007/s00521-025-11054-3.
[4]. Yılmaz, A. and Das, R. (2025) “A novel hybrid approach combining GCN and GAT for effective anomaly detection from firewall logs in campus networks,” Computer Networks, 259, p. 111082. doi:10.1016/j.comnet.2025.111082.
