PaperlayerView exact revision on arXiv

Source-linked AI summary

Defending Network Intrusion Detection Systems Based on Graph Neural Networks Against Structural Adversarial Attacks

Dimitri Galli, Andrea Venturi, Dario Stabili, Mauro Andreolini, Mirco Marchetti

arXiv:2608.24454v1cs.CR

TL;DR

GNN-based NIDS benefit from topology but remain vulnerable to structural adversarial attacks, while existing defenses may rely on unrealistic assumptions or costly procedures. The paper uses adversarial training with endpoint replacement in benign flows and evaluates it on CTU-13 and TON-IoT using E-GraphSAGE. The resulting hardened detectors improve robustness against structural attacks while retaining or slightly improving clean-graph performance.

  • Problem

    GNN-based NIDS remain vulnerable to structural attacks, and existing defenses often depend on unrealistic assumptions, costly computation, or limited NIDS-specific evaluation.

  • Method

    The framework adversarially trains GNN-based NIDS using benign flows whose source and destination endpoints are replaced to emulate structural edge injections.

  • Results

    Across CTU-13 and TON-IoT, hardened E-GraphSAGE detectors improve robustness against diverse structural attacks while maintaining or slightly improving clean detection performance.

  • Takeaways & Limitations

    Low-degree-node perturbations provide an efficient and practical way to strengthen GNN-based NIDS against realistic structural threats without costly perturbation-generation procedures.

Abstract

from arXiv · show

Graph Neural Networks (GNNs) represent a promising solution for Machine Learning (ML) based Network Intrusion Detection Systems (NIDS), thanks to their ability to leverage both network flow features and topological patterns. While GNN classifiers demonstrate superior robustness against feature-based adversarial attacks compared to other ML detectors, they remain vulnerable to structural adversarial attacks, where an attacker perturbs the underlying network graph topology by injecting edges or inserting nodes. Such attacks pose a realistic and severe threat, undermining the reliability of GNN-based NIDS in practical deployments. While countermeasures have been proposed in the literature, they often rely on assumptions that are unrealistic in real-world cybersecurity scenarios. In this paper, we propose a defense framework based on adversarial training to strengthen GNN-based NIDS against structural attacks. We generate adversarial samples by strategically replacing the source and destination nodes in benign network flows, thereby efficiently mimicking edge injection attacks. We evaluate our approach on two widely used datasets (CTU-13 and TON-IoT) using E-GraphSAGE as the base GNN classifier. Experimental results show that our approach produces hardened detectors with superior detection performance on clean graphs and enhanced robustness against structural adversarial attacks.

I. INTRODUCTION

GNN-based NIDS combine flow information with network topology but remain vulnerable to structural attacks. The paper proposes adversarial training that generates realistic topology perturbations and improves robustness while preserving clean-graph performance.

  • GNN-based NIDS model hosts as nodes and communication flows as edges, combining flow-level information with network topology for detection.
  • Structural adversarial attacks manipulate graph topology, and small perturbations can sharply degrade GNN detection performance in realistic cybersecurity scenarios.
  • Existing structural-attack defenses may require prior attack knowledge or expensive computation, limiting their practicality for real-time NIDS deployment.
  • The proposed defense uses adversarial training with synthetic flows formed by replacing benign-flow endpoints with low-degree nodes to emulate injected benign edges.
  • Across CTU-13 and TON-IoT experiments, hardened classifiers improved performance against structural perturbations by up to 90% while maintaining high clean detection performance.

A. ML-based NIDS

ML-based NIDS classify network traffic, while GNN-based systems represent communications as graphs to capture relational and topological patterns. This topology dependence improves contextual detection but creates exposure to structural attacks that can cause near-complete evasion with minimal changes.

  • ML-based NIDS detect malicious operations from packets or summarized network flows using supervised or unsupervised learning.
  • Traditional classifiers process samples independently, limiting detection of multi-step attacks that depend on relationships across connections and hosts.
  • GNNs combine netflow attributes with structural features, producing stronger detection performance than traditional ML detectors in clean and adversarial settings.
  • GNN-based NIDS represent endpoints as nodes and netflows as edges, enabling edge classification through message passing and neighborhood aggregation.
  • Structural attacks pose a greater threat than feature attacks because minimal topology perturbations can sometimes enable near-complete evasion.

D. Adversarial Defenses

Existing defenses against structural attacks face practical limitations involving attack knowledge, computational cost, or clean-data performance. The paper instead applies adversarial training directly to benign netflows, perturbing topology without changing classifier architecture or removing legitimate components.

  • Few structural-attack countermeasures have been designed or evaluated specifically for NIDS, leaving a gap between general graph defenses and operational constraints.
  • Preprocessing defenses may require prior knowledge of attack strategies and can remove legitimate graph components needed to represent network topology.
  • Model-based defenses add computational overhead and latency, while adaptive attacks may still exploit specialized architectures.
  • Adversarial training must preserve protocol compliance, feature consistency, and temporal dependencies, and may reduce clean-data performance or generalize poorly to unseen attacks.
  • The proposed method perturbs benign-netflow topology directly without altering the classifier architecture or removing legitimate components.
  • Structural perturbations preserve original flow features and maintain network constraints.

A. Attacker Model

The attacker is an externally located, partially informed adversary that controls a limited number of compromised hosts and seeks undetected, effective malicious operations. The defender has detailed system knowledge and can generate and train on adversarial flows.

  • The attacker is outside the monitored network and has already compromised one enterprise host through vulnerabilities or weak authentication.
  • The attacker seeks to evade detection while preserving the full effectiveness of malicious operations.
  • The attacker operates in a gray-box setting without detailed model, feature, graph, training-data, or prediction access.
  • The attacker controls limited compromised hosts but cannot access core infrastructure or perturb graph features directly.
  • Evaluated threats include benign-edge injection, malicious-edge injection, and adding nodes through external communication or host compromise.
  • The defender has full NIDS and network knowledge, historical labeled traffic, and the ability to replace endpoints and expand training with adversarial flows.

IV. PROPOSED DEFENSE STRATEGY

The defense uses adversarial training in two stages: clean-data warm-up followed by continued training with structurally manipulated benign flows. It models network traffic as flow graphs and uses low-degree endpoints to create adversarial structural examples.

  • Overview: The framework hardens GNN-based NIDS through adversarial training tailored to structural adversarial attacks.Training-based defenses incorporate carefully perturbed samples to reshape classifier decision boundaries.
  • A. Warming Up: The warm-up phase trains the GNN exclusively on clean network data to learn stable benign–malicious decision boundaries.The classifier is trained on untouched flow graphs for a fixed number of epochs before adversarial examples are introduced.
  • A. Warming Up: The strategy selects low-degree nodes as replacement endpoints for benign communications, generating adversarial structural flows that emulate injected edges.In the illustrated graph, nodes C and D each have degree 1 and are the least connected vertices.
  • Graph construction: The flow graph represents network endpoints as nodes and netflows as labeled, feature-attributed edges.Each flow contains source and destination endpoints, traffic statistics, and a binary ground-truth label.

B. Hardening

During hardening, the model continues from warm-up weights while progressively adding manipulated benign flows. Endpoint replacement preserves traffic features while creating new graph edges, with perturbation intensity bounded to limit distortion.

  • B. Hardening: Hardening continues from the warm-up model and progressively expands training with manipulated flows rather than restarting from scratch.The number of perturbed samples increases gradually so the classifier can refine its decision boundaries.
  • B. Hardening: ϵ_t controls the number of perturbed benign samples and increases every T epochs during hardening.Perturbation intensities are bounded to maintain realistic network conditions and avoid excessive distortion.
  • B. Hardening: Each adversarial flow replaces both original endpoints while leaving the feature vector x_i unchanged.This preserves the original traffic attributes while modifying structural information.
  • B. Hardening: Replacement endpoints are selected from nodes below the first percentile of the original graph’s total-degree distribution.Relocating benign edges from low-degree nodes to random vertices simulates practical edge injection attacks.
  • B. Hardening: The original and generated flows form an expanded dataset and graph used to train the hardened GNN with warm-up weights.The expanded graph G⋆ is trained using supervised loss after adversarial augmentation.

V. TESTBED

The evaluation uses CTU-13 and TON-IoT, two labeled network-flow benchmarks covering enterprise and IoT traffic. Threat-specific datasets combine benign flows with malicious variants under an imbalanced 10:1 ratio and an 80:20 train–test split.

  • Datasets: The testbed uses CTU-13 and TON-IoT, publicly available benchmarks whose labeled netflows can be converted into graph representations.Together they cover diverse cyberattacks and structural patterns for evaluating GNN-based NIDS robustness.
  • Datasets: CTU-13 contains thirteen medium-sized enterprise traffic scenarios with benign activity and botnet-specific malicious traffic.Each scenario covers several hours of network traffic.
  • Datasets: TON-IoT provides heterogeneous IoT data, while this study uses its flow records containing multiple cyberattack types.The broader dataset includes system logs, raw telemetry, and network traces.
  • Preprocessing: Preprocessing retains endpoints and more than 30 statistical attributes, merges benign flows, and groups malicious flows by threat variant.Malicious variants with too few records are discarded.
  • Dataset construction: Each threat-specific dataset combines benign flows with one malicious subset using a 10:1 benign-to-malicious ratio and an 80:20 training–test split.The ratio is intended to reflect class imbalance in operational networks.

B. Detector

The detector is an ensemble of threat-specific E-GraphSAGE classifiers operating on edge-attributed flow graphs. Baseline and hardened models are compared under a 100-epoch clean warm-up followed by 100 epochs of adversarial training with capped perturbation intensity.

  • B. Detector: E-GraphSAGE extends GraphSAGE for edge classification in network intrusion detection.It converts endpoints into nodes and netflows into edges carrying statistical features.
  • B. Detector: E-GraphSAGE generates edge embeddings that combine edge features with local-neighborhood information.Its inductive design supports embeddings for previously unseen nodes at inference time.
  • B. Detector: The detector is organized as an ensemble of binary classifiers, with one specialized E-GraphSAGE model for each malicious class.All classifiers use the original work’s hyperparameters for consistency.
  • Experimental setup: Hardened classifiers train for 100 warm-up epochs and 100 additional epochs on adversarially augmented data.The second phase starts from the warm-up loss and model weights.
  • Experimental setup: The perturbation intensity starts at 1, increases by 1 every 20 epochs, and is capped at 5.The cap limits structural distortion and protects clean performance.
  • Experimental setup: Perturbed benign records are injected into the training set to form an expanded graph for hardening E-GraphSAGE models.Source and destination endpoints are replaced with low-degree nodes before graph construction.

VI. EXPERIMENTAL RESULTS

The experiments compare baseline and hardened E-GraphSAGE models on clean graphs and against realistic structural attacks using standard detection metrics and Detection Rate.

  • Evaluation Design: The evaluation measures clean performance and adversarial robustness in separate scenarios.Clean inputs assess standard operating performance, while structural attacks assess resilience under graph perturbations.
  • Clean Performance: The clean scenario tests whether both classifiers detect trained malicious variants without worsening performance on unperturbed inputs.This condition is treated as necessary for practical NIDS deployment.
  • Adversarial Robustness: The robustness scenario uses C2xB, C2xM, and add node attacks as representative structural perturbations.These attacks are described as realistic and effective against state-of-the-art GNN detectors.
  • Metrics: Clean-data evaluation reports F1-score, Precision, and Recall, while adversarial robustness is measured with Detection Rate.A positive detection denotes a malicious sample.

A. Clean Performance

On clean flow graphs, E-GraphSAGE achieves strong detection performance, while adversarial-robustness experiments show that hardened models withstand structural attacks better than clean-trained baselines.

  • Clean Performance: Nearly all clean-performance values exceed 0.9, indicating strong detection by E-GraphSAGE.For CTU-13 Neris, F1-scores are 0.880 for the baseline and 0.891 for the hardened detector.
  • Clean Performance: Average F1-score is 0.962 versus 0.959 on CTU-13 and 0.995 versus 0.994 on TON-IoT for hardened versus baseline classifiers.The hardened models generally improve F1-score, although Precision can decrease slightly.
  • Adversarial Robustness: The robustness plots report Detection Rate against increasing perturbation steps for C2xB, C2xM, and add node attacks.For C2xB and C2xM, steps count injected perturbed flows; for add node attacks, steps count injected nodes.
  • Adversarial Robustness: Baseline classifiers trained on clean data are highly vulnerable to all evaluated structural attacks.This observation is presented as empirical motivation for the defense and validation of the experimental setup.
  • Adversarial Robustness: C2xB is the most damaging attack in nearly all scenarios, whereas add node attacks affect E-GraphSAGE only beyond 100 injected nodes.C2xM Detection Rate can increase after a perturbation threshold because many malicious samples create easier-to-identify topological patterns.
  • Adversarial Robustness: Menti under C2xB improves from 0.027 baseline average DR to 0.926 hardened average DR, an absolute improvement of nearly 90%.The averages cover all perturbation steps.
  • Adversarial Robustness: Hardened classifiers consistently outperform baselines under high-intensity perturbations, but none achieves perfect detection.The reported results therefore show substantial robustness gains while leaving room for improvement.

VII. CONCLUSION

The paper concludes that structural adversarial training hardens GNN-based NIDS against realistic attacks while preserving, and often slightly improving, clean-input performance.

  • Conclusion: GNN-based NIDS capture relational patterns through graph-structured traffic representations but remain vulnerable to structural adversarial attacks.Existing countermeasures are described as constrained by unrealistic assumptions or prohibitive computational costs.
  • Conclusion: The proposed defense selectively perturbs benign netflow endpoints to emulate realistic edge-injection attacks.E-GraphSAGE is evaluated on CTU-13 and TON-IoT.
  • Conclusion: Hardened detectors show significantly improved resilience against diverse structural attacks without compromising unperturbed-input performance.Clean performance is slightly improved in many scenarios.
  • Conclusion: The method is presented as an efficient, practical defense that does not require pre-existing adversarial data or costly perturbation-generation procedures.Its adversarial flows focus on low-degree node replacement.
Loading 2608.24454v1…