E-GraphSAGE: A Graph Neural Network based Intrusion Detection System for IoT

Lo, Wai Weng; Layeghy, Siamak; Sarhan, Mohanad; Gallagher, Marcus; Portmann, Marius

doi:10.1109/noms54207.2022.9789878

Cited by 144 publications

(68 citation statements)

References 14 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…e models E-GraphSAGE [14], CNN [29], RF [27], ResNet50 [30], and the model proposed in this paper are compared in terms of F1-score, ACC, Precision, and Recall.…”

Section: Resultsmentioning

confidence: 99%

“…Lo et al [14] proposed a model named E-GraphSAGE based on the GraphSAGE model, which supports edge classification. Taking IP addresses and application-layer ports as nodes, the data flows communicated between hosts are treated as side information, thereby classifying network flows into benign flows and attack flows.…”

Section: Industrial Internet Attack Behavior Detection Algorithmmentioning

confidence: 99%

“…e scale of the Industrial Internet has begun to grow explosively, and the network structure has become increasingly complex. In order to detect attacks in a complex network environment, this paper proposes an improved method based on E-GraphSAGE algorithm [14], E-GraphSAGE is a variant of GraphSAGE [15], which allows to collect graph edge information and support edge features Perform edge classification to detect malicious network flows. In this paper, the E-minBatch GraphSAGE algorithm is proposed to be able to better adapt to the complex network environments.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

E-minBatch GraphSAGE: An Industrial Internet Attack Detection Model

Lan

Wan

et al. 2022

Security and Communication Networks

View full text Add to dashboard Cite

The Industrial Internet has grown rapidly in recent years, and attacks against the Industrial Internet have also increased. When compared with the traditional Internet, the industrial Internet has a more complex network structure, and the traditional graph neural network attack behavior detection model cannot well adapt to the complex network environment. To make the model better adapt to the complex network environment, this paper proposes the E-minBatch GraphSAG model. First, the application layer source port and source IP address is used as source nodes, the application layer target port and target IP address are used as target nodes, and the remaining traffic information is used as edge information to complete the construction of the graph structure data, and then the constructed graph structure data is presampled to select the edge information that needs to be aggregated next, followed by using the AGG aggregation function to aggregate the information in the domain generated by the presampling process. Finally, the information of two adjacent nodes is aggregated as edge information to classify the edges. Increase the number of IP addresses in the UNSW-NB15 dataset, and then use it for model training and testing. The experimental results show that the accuracy of the model reaches 99.49% in a relatively complex network environment. In this paper, the E-minBatch GraphSAG model is presented in an attempt to solve the problem of attack detection in the complex industrial Internet environment.

show abstract

“…e models E-GraphSAGE [14], CNN [29], RF [27], ResNet50 [30], and the model proposed in this paper are compared in terms of F1-score, ACC, Precision, and Recall.…”

Section: Resultsmentioning

confidence: 99%

Section: Industrial Internet Attack Behavior Detection Algorithmmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

E-minBatch GraphSAGE: An Industrial Internet Attack Detection Model

Lan

Wan

et al. 2022

Security and Communication Networks

View full text Add to dashboard Cite

show abstract

“…Thus, we propose Anomal-E to overcome this restriction and leverage graph information in a self-supervised learning manner. Anomal-E consists of two main components; the first component is E-GraphSAGE [4]. E-GraphSAGE extends the original GraphSAGE [2] model to capture edge features and topological patterns in graphs.…”

Section: Introductionmentioning

confidence: 99%

“…Graph representation learning is a fast growing area of research that can be applied to various applications such as telecommunication and molecular networks. Recently, GNNs have achieved state-of-the-art performance in cyberattack detection, such as network intrusion detection [4,20].…”

Section: Introductionmentioning

confidence: 99%

Anomal-E: A Self-Supervised Network Intrusion Detection System based on Graph Neural Networks

Caville¹,

Lo²,

Layeghy³

et al. 2022

Preprint

Self Cite

View full text Add to dashboard Cite

This paper investigates Graph Neural Networks (GNNs) application for self-supervised intrusion and anomaly detection in computer networks. GNNs are a deep learning approach for graph-based data that incorporate graph structures into learning to generalise graph representations and output embeddings. As traffic flows in computer networks naturally exhibit a graph structure, GNNs are a suitable fit in this context. The majority of current implementations of GNN-based Network Intrusion Detection Systems (NIDSs) rely heavily on labelled network traffic which can not only restrict the amount and structure of input traffic, but also the NIDS' potential to adapt to unseen attacks. To overcome these restrictions, we present Anomal-E, a GNN approach to intrusion and anomaly detection that leverages edge features and graph topological structure in a self-supervised process. This approach is, to the best our knowledge, the first successful and practical approach to network intrusion detection that utilises network flows in a self-supervised, edge leveraging GNN. Experimental results on two modern benchmark NIDS datasets not only clearly display the improvement of using Anomal-E embeddings, rather than raw features, but also the potential Anomal-E has for detection on wild network traffic.

show abstract

Artificial intelligence of things (AIoT) data acquisition based on graph neural networks: A systematical review

Wang

Zhang

et al. 2023

Concurrency and Computation

View full text Add to dashboard Cite

SummaryThe power of artificial intelligence of things (AIoT) stems from adapting machine learning (ML) and artificial intelligence (AI) models into abundant intelligent IoT fields, based on a large data stream with different formats, sizes, and timestamps generated by massive numbers of heterogeneous sensors. On the one hand, data acquisition is the fundamental basis for any AIoT systems, but data sensed by massive IoT devices may be noisy and even contain adversarial samples. On the other hand, ensuring the efficiency and robustness in data acquisition is vitally important for data‐driven ML and AI. Recently, besides perceiving ability, the literature has witnessed great development of empowering things with learning and reasoning ability through deep learning models, including recurrent neural networks (RNNs) and/or convolutional neural network (CNNs). However, the existing works have one significant weakness: fail to explicitly leverage the geospatial implications and latent connections among sensors for high‐quality data acquisition and quality control. Graphs are intrinsically suitable for representing the dependencies and inter‐relationships between AIoT data sensing devices. Due to the ability of capturing the complex interactive relationships between nodes and producing high‐level representations of the graph input, graph neural networks (GNNs) have exploded onto various ML and AI fields, to learn from graph‐structured data. Our review covers the latest progresses in GNN for the fundamental atomic task of data acquisition in AIoT. Instead of surveying the abundant GNN schemes in vertically various IoT sensing applications, this paper systematically reviews the horizontal infrastructure that all AIoT fields should have, that is, AIoT data acquisition, based on GNN and other related emerging AI factors. Our contributions include the following aspects: Provide the latest progresses in GNN for the horizontal task of data acquisition in AIoT, propose the unified GNN pipeline based on encoder–decoder paradigm, and systematically categorize and summarize the emerging technologies helpful to address the issues in AIoT data acquisition, especially the noisy and adversarial data, and point out some future directions about GNN‐based AIoT data acquisition.

show abstract

E-GraphSAGE: A Graph Neural Network based Intrusion Detection System for IoT

Cited by 144 publications

References 14 publications

E-minBatch GraphSAGE: An Industrial Internet Attack Detection Model

E-minBatch GraphSAGE: An Industrial Internet Attack Detection Model

Anomal-E: A Self-Supervised Network Intrusion Detection System based on Graph Neural Networks

Artificial intelligence of things (AIoT) data acquisition based on graph neural networks: A systematical review

Contact Info

Product

Resources

About