Abstract:As network sizes grow, attack schemes not only become more varied but also increase in complexity. This diversification leads to a proliferation of attack variants, complicating the identification and differentiation of potential threats. Enhancing system security necessitates the implementation of multi-class intrusion detection systems. This approach enables the categorization of incoming network traffic into distinct intrusion types and illustrates the specific attack encountered within the Internet. Numerous studies have leveraged deep learning (DL) for Network-based Intrusion Detection Systems (NIDS), aiming to improve intrusion detection. Among these DL algorithms, Graph Neural Networks (GNN) stand out for their ability to efficiently process unstructured data, especially network traffic, making them particularly suitable for NIDS applications. Although NIDS usually monitors incoming and outgoing flows in a network, represented as edge features in graph format, traditional GNN studies only consider node features, overlooking edge features. This oversight can result in losing important flow data and diminish the system's ability to detect attacks effectively. To address this limitation, our research makes several key contributions: (1) Emphasize the significance of edge features for enhancing GNN for multi-class intrusion detection, (2) Utilize port information, which is essential for identifying attacks but often overlooked during training, (3) Reorganize features embedded within the graph. By doing this, the graph can represent close to the actual network, which is the node showing endpoint identification information such as IP addresses and ports; the edge contains information related to flow such as Duration, Number of Packet/s, and Length....; (4) Compared to traditional methods, our experiments demonstrate significant performance improvements on both CIC-IDS-2017 (98.32%) and UNSW-NB15 (96.71%) datasets.

An Automated Alert Cross-Verification System with Graph Neural Networks for IDS Events

Discovering Attack Scenarios Via Intrusion Alert Correlation Using Graph Convolutional Networks

ASA: Adversary Situation Awareness Via Heterogeneous Graph Convolutional Networks.

Ignnvd: A Novel Software Vulnerability Detection Model Based on Integrated Graph Neural Networks

Industrial control network security situation awareness based on improved C-SVC

Incremental Update Intrusion Detection for Industry 5.0 Security: A Graph Attention Network-Enabled Approach

Data-Driven Intrusion Detection for Intelligent Internet of Vehicles: A Deep Convolutional Neural Network-Based Method

A Survey on Graph Neural Networks for Intrusion Detection Systems: Methods, Trends and Challenges

An Enhanced Hybrid Intrusion Detection Based on Crow Search Analysis Optimizations and Artificial Neural Network

An Expert System Based on Network Security Event Correlation

Artificial Neural Network Model for Intrusion Detection System

DualAC2NN: Revisiting and Alleviating Alert Fatigue from the Detection Perspective

A Network Traffic Intrusion Detection Method for Industrial Control Systems Based on Deep Learning

Unveiling the potential of Graph Neural Networks for robust Intrusion Detection

A Vulnerability-Driven Approach to Active Alert Verification

Effective In-vehicle Intrusion Detection via Multi-view Statistical Graph Learning on CAN Messages

Enhanced Anomaly Detection in Industrial Control Systems aided by Machine Learning

Enhancing Multi-Class Attack Detection in Graph Neural Network through Feature Rearrangement

Intrusion Detection System for Autonomous Vehicles Using Non-Tree Based Machine Learning Algorithms

A Novel Wireless Network Intrusion Detection Method Based on Adaptive Synthetic Sampling and an Improved Convolutional Neural Network

Edge-featured multi-hop attention graph neural network for intrusion detection system