Source-linked AI summary
Unveiling the potential of Graph Neural Networks for robust Intrusion Detection
David Pujol-Perich, José Suárez-Varela, Albert Cabellos-Aparicio, Pere Barlet-Ros
TL;DR
Existing ML-based NIDS classify flows independently and are described as insufficiently robust to adversarial traffic changes. The paper represents flows and their relationships as graphs and develops a GNN for that information. It reports comparable CIC-IDS2017 accuracy and robustness to two tested attacks, while state-of-the-art ML models degrade by up to 50% in accuracy.
Problem
Method
Results
On CIC-IDS2017, the GNN achieves a weighted F1-score of 0.99, and under two tested attacks state-of-the-art ML models degrade in accuracy by up to 50% while the GNN remains robust.
Source: §1 · p. 2, §5.2 · p. 4, §7 · p. 5Takeaways & Limitations
The paper concludes that learning structural flow patterns can provide a more robust characterization of attacks because those patterns typically remain unchanged over time and across networks.
Source: §7 · p. 5Host nodes are initialized without identifiers such as IP addresses, so the model focuses on structural flow patterns rather than host identity.
Source: §4.2 · p. 3
Abstract
from arXiv · showhide
The last few years have seen an increasing wave of attacks with serious economic and privacy damages, which evinces the need for accurate Network Intrusion Detection Systems (NIDS). Recent works propose the use of Machine Learning (ML) techniques for building such systems (e.g., decision trees, neural networks). However, existing ML-based NIDS are barely robust to common adversarial attacks, which limits their applicability to real networks. A fundamental problem of these solutions is that they treat and classify flows independently. In contrast, in this paper we argue the importance of focusing on the structural patterns of attacks, by capturing not only the individual flow features, but also the relations between different flows (e.g., the source/destination hosts they share). To this end, we use a graph representation that keeps flow records and their relationships, and propose a novel Graph Neural Network (GNN) model tailored to process and learn from such graph-structured information. In our evaluation, we first show that the proposed GNN model achieves state-of-the-art results in the well-known CIC-IDS2017 dataset. Moreover, we assess the robustness of our solution under two common adversarial attacks, that intentionally modify the packet size and inter-arrival times to avoid detection. The results show that our model is able to maintain the same level of accuracy as in previous experiments, while state-of-the-art ML techniques degrade up to 50% their accuracy (F1-score) under these attacks. This unprecedented level of robustness is mainly induced by the capability of our GNN model to learn flow patterns of attacks structured as graphs.
1. INTRODUCTION
The paper argues that flow-by-flow ML-based NIDS are insufficiently robust for practical deployment and proposes using graph structure to capture relationships among flows. Its GNN achieves comparable CIC-IDS2017 accuracy to state-of-the-art ML and remains robust to tested feature-modifying attacks.
1. INTRODUCTION
- Rising malicious activity and its economic and privacy impacts motivate effective Network Intrusion Detection Systems.The passage reports a 2020 average data-breach cost of $3.86 million and estimates cyber attacks cost the U.S. economy $57–109 billion during 2016.Source: §1 · p. 1
- Existing ML-based NIDS often exceed 98% accuracy on popular IDS datasets, but insufficient robustness and generalization limit their practical adoption.The cited concerns include traffic changes, adversarial attacks, and traffic from other networks.Source: §1 · p. 1
- Host-connection graphs represent relationships among flows, and the proposed GNN uses a tailored message-passing architecture to learn from them.The graph representation is intended to capture structural flow patterns of attacks.Source: §1 · p. 1
- On CIC-IDS2017, the proposed model achieves accuracy similar to state-of-the-art ML techniques.The passage reports a weighted F1-score of 0.99.Source: §1 · pp. 1–2
- The GNN remained robust to tested feature-modifying attacks, while state-of-the-art ML benchmarks degraded by up to 50% in F1-score.The attacks modified packet size and inter-arrival times to evade detection.Source: §1 · p. 2
2. WHY GRAPH-BASED NIDS?
Traditional ML-based NIDS classify flows individually, while many attacks involve relationships across multiple flows. Graph representations can capture these structural patterns, which may remain intact when individual flow features are changed.
2. WHY GRAPH-BASED NIDS?
- Traditional ML-based NIDS build and label individual flow records, then train models to classify each flow independently.Flow records can include packet lengths, inter-arrival times, and duration.Source: §2 · p. 2
- Multi-flow attacks such as DDoS, port scans, and network scans involve patterns across flows that individual-flow inspection can hinder detecting.Examples include many sources connecting to one target in DDoS and one source connecting to many ports in a port scan.Source: §2 · p. 2, Figure 2 · p. 2
- Traditional models can learn flow features correlated with attacks, but simple changes to packet lengths, inter-arrival times, or ports can make them vulnerable.The passage suggests high reported accuracy on some attacks may reflect overfitting to training and validation data.Source: §2 · p. 2
- Graph representations capture relationships among flows and can represent attack patterns that typically remain unchanged under adversarial feature variation.The paper presents structural flow patterns as especially relevant to attacks involving multiple flows.Source: §2 · p. 2
3. BACKGROUND ON GNN
Message-Passing Neural Networks process graph data by repeatedly exchanging and aggregating messages among neighboring nodes, then updating node states. A readout function maps final node states to the model output.
3. BACKGROUND ON GNN
- GNNs are designed to learn from graph-structured data, and message passing is presented as a framework covering many state-of-the-art GNN models.The passage attributes generalization across graphs of different size and structure to message-passing architecture.Source: §3 · pp. 2–3
- At each message-passing iteration, nodes form messages from connected nodes’ hidden states, aggregate incoming messages, and update their own hidden states.Aggregation yields a fixed-size output regardless of the number of received messages.Source: §3 · p. 2
- After T iterations, a learnable readout function maps selected final node hidden states to the model output labels.Source: §3 · p. 3
4. PROPOSED GNN-BASED NIDS
The system represents traffic as host-connection graphs and applies a tailored GNN to learn from their heterogeneous host and flow nodes.
4.1 Host-Connection Graph Representation
- Each host-connection graph represents hosts and flows as nodes, linking each flow to its source and destination hosts.This connects flows that share hosts and enables the graph to represent upstream and downstream features separately.Source: §4.1 · p. 3
4.2 GNN model description
- Flow nodes let the GNN learn flow embeddings, while host nodes start with all-ones states to avoid encoding host identifiers.Flow features initialize flow states, which are zero-padded when needed to match the hidden-state length.Source: §4.1 · p. 3, §4.2 · p. 3
- At each message-passing iteration, type-specific functions compute messages on host-flow edges, mean aggregation combines them, and separate functions update host and flow states.The message functions are two-layer fully connected networks, and the update functions are GRUs.Source: §4.2 · pp. 3–4
- The readout maps final flow hidden states to predicted attack or benign classes, using a three-layer fully connected network and softmax output.Training uses categorical cross-entropy for multiclass classification; the model can also use binary cross-entropy for binary classification.Source: §4.2 · p. 4
5. EVALUATION
The evaluation compares the proposed GNN with ML-based NIDS on CIC-IDS2017 and tests robustness to packet-size and inter-arrival-time changes.
5.2 Experimental results of the NIDS
- 0.99 weighted F1-score: the proposed GNN achieves accuracy comparable to state-of-the-art ML methods over CIC-IDS2017.The comparison includes MLP, Ada-boost, Random Forest, and ID3; the table covers 11 attack classes plus benign traffic.Source: Table 1 · p. 4, §5.2 · p. 4
5.1 Dataset
- CIC-IDS2017 contains seven broad attack classes and 15 sub-classes; evaluation retains 12 sub-classes with more than 100 flow samples.Because malicious traffic is approximately 12% of flows, the authors randomly drop 90% of graphs containing only benign traffic.Source: §5.2 · p. 4, §5.1 · p. 4
5.3 Robustness Against Adversarial Attacks
- With attack-flow packet-size increments from [0, 200] bytes and inter-arrival-time increments from [0, 2] seconds, the GNN retains base accuracy while ML benchmarks decline, by up to 50% in the second test.Figure 4 presents packet-size variation on top and inter-arrival-time variation on the bottom.Source: §5.3 · pp. 4–5, Figure 4 · p. 5
- The authors attribute the GNN's robustness to its ability to capture structural flow patterns that remain unchanged when flow features vary.The evaluation tests attacks that alter packet size and inter-arrival times.Source: §5.3 · pp. 4–5
6. RELATED WORK
Related work spans traditional and deep-learning NIDS, while newer graph-based approaches model relationships among connections. The cited prior work does not establish robustness to adversarial flow-feature changes.
6. RELATED WORK
- Traditional NIDS research used K-nearest neighbors, Support Vector Machines, Random Forests, or combinations of these algorithms to classify network attacks.Surveys of this area include.Source: §6 · p. 5
- Deep-learning approaches included a system combining autoencoder embeddings with LSTM classification and work using CNNs to extract information from NIDS data.The LSTM system opportunistically exploited temporal dependencies in the data.Source: §6 · p. 5
- Prior graph-learning work modeled relationships among network connections for mobile-app malware detection [23], while [24] approached botnet detection assuming visibility of the full botnet topology.The cited works do not show robustness against adversarial changes such as packet size or inter-packet arrival times.Source: §6 · p. 5
- GNNs had also been explored for network modeling [25] [26], optimization [27], planning, and troubleshooting [29].The paper presents GNNs as a potential approach for network intrusion detection.Source: §6 · p. 5
7. CONCLUSIONS
The paper presents host-connection graphs and a GNN architecture for learning structural flow patterns alongside individual flow features. It reports comparable CIC-IDS2017 accuracy and robustness to two tested adversarial attacks, unlike state-of-the-art ML models, which degraded by up to 50%.
7. CONCLUSIONS
- The proposed host-connection graphs represent flow properties and relationships, and a novel GNN architecture is designed to learn and generalize over this graph-structured information.The paper argues that effective detection should capture structural attack patterns as well as individual flow features.Source: §7 · p. 5
- Up to 50% accuracy degradation affected state-of-the-art ML models under two tested attacks, while the proposed GNN was reported completely robust and comparably accurate on CIC-IDS2017.The attacks modified packet size and inter-arrival times on attack-related flows.Source: §7 · p. 5
- The authors attribute the robustness mainly to learning structural flow patterns, which they say typically remain unchanged over time and across networks.Source: §7 · p. 5