Graph Neural Networks for Intrusion Detection: A Survey

Abstract

Cyberattacks represent an ever-growing threat that has become a real priority for most organizations. Attackers use sophisticated attack scenarios to deceive defense systems in order to access private data or cause harm. Machine Learning (ML) and Deep Learning (DL) have demonstrate impressive results for detecting cyberattacks due to their ability to learn generalizable patterns from flat data. However, flat data fail to capture the structural behavior of attacks, which is essential for effective detection. Contrarily, graph structures provide a more robust and abstract view of a system that is difficult for attackers to evade. Recently, Graph Neural Networks (GNNs) have become successful in learning useful representations from the semantic provided by graph-structured data. Intrusions have been detected for years using graphs such as network flow graphs or provenance graphs, and learning representations from these structures can help models understand the structural patterns of attacks, in addition to traditional features. In this survey, we focus on the applications of graph representation learning to the detection of network-based and hostbased intrusions, with special attention to GNN methods. For both network and host levels, we present the graph data structures that can be leveraged and we comprehensively review the state-of-the-art papers along with the used datasets. Our analysis reveals that GNNs are particularly efficient in cybersecurity, since they can learn effective representations without requiring any external domain knowledge. We also evaluate the robustness of these techniques based on adversarial attacks. Finally, we discuss the strengths and weaknesses of GNN-based intrusion detection and identify future research directions.INDEX TERMS Cyberattacks, cybersecurity, deep learning (DL), graph neural networks (GNNs), intrusion detection (IDS), machine learning (ML).

Efficient Graph Partitioning using LouvainSplit Algorithm

“…This precision in node detection surpasses traditional clustering methods, highlighting its criticality across diverse applications. For instance, in anomaly detection scenarios [51][52][53], the precise identification of unusual nodes is indispensable for tasks like fraud detection in financial transactions [54,55], intrusion detection in computer networks [56,57], and rare disease identification in biological networks [58,59]. Similarly, within network resource allocation frameworks [60,61]such as transportation or social networks, the ability to pinpoint nodes with specific characteristics is crucial for optimizing traffic flow, efficiently allocating resources, and upholding infrastructure integrity.…”

Network Intrusion Detection Based on Feature Image and Deformable Vision Transformer Classification

“…However, this model's practicality and scalability in real-world scenarios may be limited due to its requirement for a significant amount of training data and computing resources to achieve high accuracy. In another study [27], this paper explores using Graph Neural Networks (GNN) in network security intrusion detection. It focuses explicitly on applying graph representation learning techniques in intrusion detection.…”

Enhancing Multi-Class Attack Detection in Graph Neural Network through Feature Rearrangement

“…Despite their impressive performance, these methods share a limitation: CNN is primarily designed for grid data such as images and RNN performs well with sequential data (text), which represents as structured data. Therefore, these limitations will make these models ineffective when capturing flow data, which are organized as unstructured data [29,30].…”