E-GraphSAGE: A Graph Neural Network based Intrusion Detection System for IoT

Wai Weng Lo; Siamak Layeghy; Mohanad Sarhan; Marcus Gallagher; Marius Portmann

Source-linked AI summary

E-GraphSAGE: A Graph Neural Network based Intrusion Detection System for IoT

Wai Weng Lo, Siamak Layeghy, Mohanad Sarhan, Marcus Gallagher, Marius Portmann

arXiv:2103.16329v8Mar 30, 2021cs.NIcs.AIcs.CRcs.LG

TL;DR

Existing ML-based NIDSs may overlook interrelations among flow records, despite flow data naturally forming graphs and sophisticated attacks requiring a global traffic view. The paper proposes E-GraphSAGE, which combines edge features with topological information for edge-level intrusion detection, and evaluates it across four benchmark datasets. E-GraphSAGE matches or outperforms state-of-the-art classifiers across binary and multiclass tasks, with reported F1-scores of 1.0 on NF-ToN-IoT and 0.97 on NF-BoT-IoT.

Problem
Existing ML-based NIDSs often treat flow records independently, limiting their ability to capture global traffic patterns needed for sophisticated IoT attacks.
Method
E-GraphSAGE is a GNN-based NIDS that combines network-flow edge features with topological information and performs edge classification.
Results
E-GraphSAGE at least matches and usually outperforms state-of-the-art ML-based NIDS approaches across binary and multiclass classification on four benchmark datasets; its F1-scores are 1.0 on NF-ToN-IoT and 0.97 on NF-BoT-IoT.
Takeaways & Limitations
The evaluation demonstrates the potential of GNNs for IoT network intrusion detection using flow-based data.

Abstract

from arXiv · show

This paper presents a new Network Intrusion Detection System (NIDS) based on Graph Neural Networks (GNNs). GNNs are a relatively new sub-field of deep neural networks, which can leverage the inherent structure of graph-based data. Training and evaluation data for NIDSs are typically represented as flow records, which can naturally be represented in a graph format. In this paper, we propose E-GraphSAGE, a GNN approach that allows capturing both the edge features of a graph as well as the topological information for network intrusion detection in IoT networks. To the best of our knowledge, our proposal is the first successful, practical, and extensively evaluated approach of applying GNNs on the problem of network intrusion detection for IoT using flow-based data. Our extensive experimental evaluation on four recent NIDS benchmark datasets shows that our approach outperforms the state-of-the-art in terms of key classification metrics, which demonstrates the potential of GNNs in network intrusion detection, and provides motivation for further research.

I. INTRODUCTION

The paper proposes E-GraphSAGE, a GNN-based IoT NIDS that represents flow data as graphs to combine edge features with network topology for malicious-flow detection. It evaluates the approach on four benchmark datasets and reports performance against state-of-the-art methods.

IoT attacks are increasing in frequency and sophistication, motivating NIDSs that monitor traffic at strategic network points.
Flow-based network data maps communication endpoints to graph nodes and traffic flows to graph edges, preserving edge features and topology.
Existing ML-based NIDSs often process flow records independently, limiting global traffic-pattern analysis for sophisticated attacks.
E-GraphSAGE was extensively evaluated on four benchmark IoT NIDS datasets and outperformed state-of-the-art classifiers on key metrics.
E-GraphSAGE incorporates edge features and topological patterns, supporting edge classification for detecting malicious network flows.

II. RELATED WORK

Related work includes sequential, ensemble, graph-embedding, GCN, and graph-representation approaches to intrusion detection. The paper distinguishes E-GraphSAGE through edge classification, inductive learning, and evaluation across four benchmark datasets.

A transductive graph-embedding approach cannot classify samples containing graph nodes unseen during training, limiting practical NIDS use.
E-GraphSAGE uses inductive learning to avoid the unseen-node limitation identified in traditional transductive graph embedding.
Some graph representation methods use edge features only to improve node representations, rather than for the edge classification required by NIDSs.
Prior ML-based NIDS studies commonly evaluate on one to three benchmark datasets, whereas E-GraphSAGE uses four datasets.The authors associate the broader evaluation with greater confidence in robustness and generalization across network scenarios.
E-GraphSAGE leverages edge features through edge embeddings to detect individual attack flows while also using network structure.

A. Graph Neural Networks (GNN)

GNNs represent network hosts as nodes and communication flows as edges, enabling aggregation of neighborhood information to produce embeddings. GraphSAGE samples neighbors and iteratively aggregates their information across graph-convolution layers.

GNNs model objects as graph nodes and relationships as graph edges, allowing network hosts and flows to be represented structurally.
GNNs are motivated for NIDS because network flow data can be encoded directly as graphs, unlike approaches relying on cumbersome hand-engineered graph features.
B. GraphSAGE: GraphSAGE uniformly randomly samples a fixed-size neighborhood subset to limit space and time complexity independently of graph structure and batch size.
B. GraphSAGE: The number of GraphSAGE layers K determines how many hops of node information are aggregated, while differentiable aggregator functions combine neighbor information.
B. GraphSAGE: At each iteration, sampled neighborhood information is aggregated into a vector representing the node at the current layer.
B. GraphSAGE: GraphSAGE aggregates topological and node features from k-hop neighborhoods using methods such as mean, pooling, or LSTM-based aggregation.
B. GraphSAGE: The final node representation z_v is the embedding at layer K and can be passed to a sigmoid or softmax layer for node classification.

IV. E-GRAPHSAGE

E-GraphSAGE extends GraphSAGE for IoT intrusion detection by incorporating flow edge features and topological information, producing edge embeddings for classifying network flows.

Traditional GraphSAGE focuses on node features, whereas E-GraphSAGE incorporates edge features to enable edge classification of benign and attack flows.
NIDS flow datasets provide flow information as edge features, making intrusion detection an edge-classification problem in the graph representation.
Algorithm 1 takes a graph, edge features, constant node features, depth K, weight matrices, a non-linearity, and differentiable aggregators as inputs, and outputs edge embeddings.
E-GraphSAGE is introduced as both a model extending GraphSAGE for edge embedding and classification and an NIDS application.

1) Edge Embedding:

E-GraphSAGE modifies GraphSAGE to aggregate sampled edge information and output edge embeddings, preserving topological and flow-feature information for network-flow classification.

E-GraphSAGE changes GraphSAGE’s message passing to sample and aggregate edge information, then produces edge rather than node embeddings.
Because the datasets contain flow features but not node features, E-GraphSAGE uses the provided edge features and initializes node features with constant one vectors.
The neighborhood aggregator computes embeddings from sampled neighborhood edges at layer k instead of using the standard GraphSAGE node aggregator.
The modified aggregation includes edge features so topological and edge information are collected from each node’s k-hop neighborhood.
For each edge uv, the final edge embedding is calculated by concatenating the final node embeddings of its two endpoints.

2) Time and Space Complexity:

E-GraphSAGE’s cost is dominated by loops over k-hop neighbor edges, while mini-batch sampling uses fixed-size edge neighborhoods to improve training efficiency and reduce memory consumption.

The loops over k-hop neighbor edges are the most time-consuming part of E-GraphSAGE.
The full-neighborhood time and space complexity depend on the number of nodes, sampled neighbor edges, layers, and hidden-feature dimension.
Mini-batch E-GraphSAGE samples a fixed-size set of edge neighbors to improve training efficiency and reduce memory consumption.
The per-batch complexity formulation uses the sampled edge sets E_i for layers i from 1 through K.

B. E-GraphSAGE NIDS

E-GraphSAGE constructs network graphs from flow records, aggregates edge features over graph neighborhoods, and classifies flows through learned edge embeddings. The architecture combines graph topology with flow-level information for supervised benign-versus-attack detection.

1) Network Graph Construction:: Flow records are converted into graphs by mapping communication endpoints to nodes and network flows to edges with associated edge features.The architecture uses source and destination IP addresses and L4 ports to identify endpoints, while remaining flow fields become edge features.
1) Network Graph Construction:: Original source IP addresses are randomly remapped to private-range addresses to avoid making source identity an unintended attack label.The mapping uses randomly assigned addresses from 172.16.0.1 to 172.31.0.1.
1) Network Graph Construction:: Because flow fields are assigned to edges, nodes are featureless and receive an all-one feature vector whose dimensionality depends on the number of edge features.This initialization supplies node inputs while retaining flow information on graph edges.
2) E-GraphSAGE Training:: Two E-GraphSAGE layers aggregate edge-feature information across a two-hop neighborhood using mean aggregation and full neighborhood sampling.The mean function computes the element-wise mean of sampled neighboring edge features.
2) E-GraphSAGE Training:: Concatenated node embeddings form 256-dimensional edge embeddings, which pass through softmax classification for network-flow labels.The model uses 128 hidden units per layer and creates edge embeddings by concatenating two node embeddings.

3) Edge Classification:

The model is evaluated by classifying unseen test flows on four publicly available NIDS datasets using standard binary and multiclass metrics. The datasets include original proprietary formats and NetFlow-translated variants, with strongly imbalanced benign and attack classes.

3) Edge Classification:: Unseen test flows are converted to graphs, processed by trained E-GraphSAGE layers, and classified by comparing softmax probabilities with true labels.Classification metrics are then computed from the predictions and labels.
3) Edge Classification:: The evaluation uses four publicly available datasets: ToN-IoT, BoT-IoT, NF-ToN-IoT, and NF-BoT-IoT.The original ToN-IoT and BoT-IoT datasets use proprietary formats, while the variants use a common NetFlow format and feature set.
3) Edge Classification:: BoT-IoT contains 477 benign flows (0.01%) and 3,668,045 attack flows (99.99%), totaling 3,668,522 flows.The dataset includes six attack types and 47 features.
3) Edge Classification:: ToN-IoT contains 796,380 benign flows (3.56%) and 21,542,641 attack flows (96.44%), totaling 22,339,021 flows.This evaluation uses only the dataset’s network-traffic component and its 44 network-flow features.
3) Edge Classification:: Binary experiments distinguish attack from benign traffic, while multiclass experiments identify the attack class using standard classification metrics.The metrics are defined using true positives, true negatives, false positives, and false negatives.

A. Binary Classification Results

E-GraphSAGE was evaluated for binary and multiclass intrusion detection across four IoT benchmark dataset families, with performance varying between original and NetFlow representations. It generally matched or exceeded state-of-the-art classifiers, while generic NetFlow features reduced multiclass performance.

70% of flow records were used for training and 30% for testing and evaluation across the datasets.
Binary classification: E-GraphSAGE’s binary classifier performed well across Accuracy, Precision, F1-Score, Recall, and FAR, with F1-Score used for state-of-the-art comparisons because the datasets were highly imbalanced.
Binary classification: E-GraphSAGE outperformed the best reported binary classifiers on ToN-IoT and BoT-IoT, while achieving F1-scores of 1.0 on NF-ToN-IoT and 0.97 on NF-BoT-IoT, matching state-of-the-art results.
Multiclass classification: For multiclass BoT-IoT, the original representation achieved a weighted Detection Rate of 99.99% and weighted F1-Score of 1.00, compared with 78.16% and 0.81 for NF-BoT-IoT.
Multiclass classification: ToN-IoT multiclass results reached a weighted average Detection Rate of 86.78% and F1-Score of 0.87, although performance varied significantly across traffic classes.
Cross-dataset comparison: Across binary and multiclass classification, E-GraphSAGE at least matched and usually outperformed state-of-the-art ML-based NIDS approaches across four benchmark datasets.

VII. CONCLUSIONS AND FUTURE WORK

The paper proposes E-GraphSAGE for IoT intrusion detection using both edge features and network-flow topology, and reports strong results across four benchmark datasets. It identifies future work in runtime efficiency and explainability.

E-GraphSAGE captures edge features and topological patterns in network-flow graphs to detect malicious network flows.
Evaluation on four IoT NIDS benchmark datasets showed that the E-GraphSAGE-based NIDS overall outperformed state-of-the-art ML-based classifiers.
Future work will investigate neighborhood sampling to improve runtime, including non-uniform sampling, and explainable GNN methods such as GNNExplainer.