# Automating Botnet Detection with Graph Neural Networks

arXiv: https://arxiv.org/abs/2003.06344 · HTML: https://mlsanity.com/paper/2003.06344/

## Key facts

- Cited by 23 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 13 Mar 2020.

## Built on by (most cited first, 23 of 23)

- [A Survey of Machine Unlearning](https://mlsanity.com/paper/2209.02299/) (2022)
- [E-GraphSAGE: A Graph Neural Network based Intrusion Detection System for IoT](https://mlsanity.com/paper/2103.16329/) (2021)
- [Formalizing and Estimating Distribution Inference Risks](https://mlsanity.com/paper/2109.06024/) (2021)
- [LTE4G: Long-Tail Experts for Graph Neural Networks](https://mlsanity.com/paper/2208.10205/) (2022)
- [Anomal-E: A Self-Supervised Network Intrusion Detection System based on Graph Neural Networks](https://mlsanity.com/paper/2207.06819/) (2022)
- [Graph-based Deep Learning for Communication Networks: A Survey](https://mlsanity.com/paper/2106.02533/) (2021)
- [Towards Private Learning on Decentralized Graphs with Local Differential Privacy](https://mlsanity.com/paper/2201.09398/) (2022)
- [Unveiling the potential of Graph Neural Networks for robust Intrusion Detection](https://mlsanity.com/paper/2107.14756/) (2021)
- [Graph-based Solutions with Residuals for Intrusion Detection: the Modified E-GraphSAGE and E-ResGAT Algorithms](https://mlsanity.com/paper/2111.13597/) (2021)
- [A Survey on Malware Detection with Graph Representation Learning](https://mlsanity.com/paper/2303.16004/) (2023)
- [Use of Graph Neural Networks in Aiding Defensive Cyber Operations](https://mlsanity.com/paper/2401.05680/) (2024)
- [Applying Self-supervised Learning to Network Intrusion Detection for Network Flows with Graph Neural Network](https://mlsanity.com/paper/2403.01501/) (2024)
- [XG-BoT: An Explainable Deep Graph Neural Network for Botnet Detection and Forensics](https://mlsanity.com/paper/2207.09088/) (2022)
- [XG-NID: Dual-Modality Network Intrusion Detection using a Heterogeneous Graph Neural Network and Large Language Model](https://mlsanity.com/paper/2408.16021/) (2024)
- [GNN-Geo: A Graph Neural Network-based Fine-grained IP geolocation Framework](https://mlsanity.com/paper/2112.10767/) (2021)
- [NetFlowGen: Leveraging Generative Pre-training for Network Traffic Dynamics](https://mlsanity.com/paper/2412.20635/) (2024)
- [Self-Supervised Learning of Graph Representations for Network Intrusion Detection](https://mlsanity.com/paper/2509.16625/) (2025)
- [An LLM-based Agentic Framework for Accessible Network Control](https://mlsanity.com/paper/2509.20600/) (2025)
- [S-Mixup: Structural Mixup for Graph Neural Networks](https://mlsanity.com/paper/2308.08097/) (2023)
- [Integrating Graph Neural Networks with Scattering Transform for Anomaly Detection](https://mlsanity.com/paper/2404.10800/) (2024)
- [GTCN-G: A Residual Graph-Temporal Fusion Network for Imbalanced Intrusion Detection](https://mlsanity.com/paper/2510.07285/) (2025)
- [Enhanced Feature Extraction for IoT Network Intrusion Detection Using GNNs and KAN](https://mlsanity.com/paper/2607.02981/) (2026)
- [Graph Classification via Network Usable Information: From Representation Evaluation to Structure Selection](https://mlsanity.com/paper/2607.03587/) (2026)

## Abstract (arXiv)

Botnets are now a major source for many network attacks, such as DDoS attacks and spam. However, most traditional detection methods heavily rely on heuristically designed multi-stage detection criteria. In this paper, we consider the neural network design challenges of using modern deep learning techniques to learn policies for botnet detection automatically. To generate training data, we synthesize botnet connections with different underlying communication patterns overlaid on large-scale real networks as datasets. To capture the important hierarchical structure of centralized botnets and the fast-mixing structure for decentralized botnets, we tailor graph neural networks (GNN) to detect the properties of these structures. Experimental results show that GNNs are better able to capture botnet structure than previous non-learning methods when trained with appropriate data, and that deeper GNNs are crucial for learning difficult botnet topologies. We believe our data and studies can be useful for both the network security and graph learning communities.