Network security remains a critical concern due to increasing threats and high traffic volumes. Intrusion Detection Systems (IDS) are essential for monitoring and mitigating such threats. While traditional machine learning methods struggle to capture complex relational features in network traffic, Graph Neural Network (GNN) offer promising alternatives. This study presents a comparative analysis of Graph Convolutional Network (GCN), Graph Attention Network (GAT), and Message Passing Neural Network (MPNN) on the NF-BoT-IoT which is severely imbalaced dataset as it has 95.7% benign traffic. Our experiments found that although MPNN and GAT achieve a higher accuracy of 99.68% accuracy while their macro F1-Score remained at only 0.5 and GCN achives a score of 0.17. This proves that while all models perform well in detecting benign traffic, class imbalance challenges hinder their ability to detect attack traffic accurately. This research provides crucial insights into GNN models performance under extreme class imbalance and sets benchmarks for developing robust NIDS for modern network environment.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

A Comparative Study of Graph Neural Networks for Robust Network Intrusion Detection Systems

  • Zunnun Narmawala,
  • Sweta Dargad

摘要

Network security remains a critical concern due to increasing threats and high traffic volumes. Intrusion Detection Systems (IDS) are essential for monitoring and mitigating such threats. While traditional machine learning methods struggle to capture complex relational features in network traffic, Graph Neural Network (GNN) offer promising alternatives. This study presents a comparative analysis of Graph Convolutional Network (GCN), Graph Attention Network (GAT), and Message Passing Neural Network (MPNN) on the NF-BoT-IoT which is severely imbalaced dataset as it has 95.7% benign traffic. Our experiments found that although MPNN and GAT achieve a higher accuracy of 99.68% accuracy while their macro F1-Score remained at only 0.5 and GCN achives a score of 0.17. This proves that while all models perform well in detecting benign traffic, class imbalance challenges hinder their ability to detect attack traffic accurately. This research provides crucial insights into GNN models performance under extreme class imbalance and sets benchmarks for developing robust NIDS for modern network environment.