# E-GraphSAGE: A Graph Neural Network based Intrusion Detection System for IoT

arXiv: https://arxiv.org/abs/2103.16329 · HTML: https://mlsanity.com/paper/2103.16329/

## Key facts

- Cited by 56 papers in the map (data through 14 Oct 2026).
- Builds on 13 of its 34 references that are in the map.
- First posted on arXiv 30 Mar 2021.

## Builds on (most cited first, 13 of 13)

- [Inductive Representation Learning on Large Graphs](https://mlsanity.com/paper/1706.02216/) (2017)
- [Neural Message Passing for Quantum Chemistry](https://mlsanity.com/paper/1704.01212/) (2017)
- [A Comprehensive Survey on Graph Neural Networks](https://mlsanity.com/paper/1901.00596/) (2019)
- [UMAP: Uniform Manifold Approximation and Projection for Dimension Reduction](https://mlsanity.com/paper/1802.03426/) (2018)
- [node2vec: Scalable Feature Learning for Networks](https://mlsanity.com/paper/1607.00653/) (2016)
- [Graph Neural Networks: A Review of Methods and Applications](https://mlsanity.com/paper/1812.08434/) (2018)
- [Geometric deep learning: going beyond Euclidean data](https://mlsanity.com/paper/1611.08097/) (2016)
- [GNNExplainer: Generating Explanations for Graph Neural Networks](https://mlsanity.com/paper/1903.03894/) (2019)
- [A Comprehensive Survey of Graph Embedding: Problems, Techniques and Applications](https://mlsanity.com/paper/1709.07604/) (2017)
- [Towards the Development of Realistic Botnet Dataset in the Internet of Things for Network Forensic Analytics: Bot-IoT Dataset](https://mlsanity.com/paper/1811.00701/) (2018)
- [NetFlow Datasets for Machine Learning-based Network Intrusion Detection Systems](https://mlsanity.com/paper/2011.09144/) (2020)
- [Automating Botnet Detection with Graph Neural Networks](https://mlsanity.com/paper/2003.06344/) (2020)
- [An Experimental Analysis of Attack Classification Using Machine Learning in IoT Networks](https://mlsanity.com/paper/2101.12270/) (2021)

## Built on by (most cited first, 30 of 56)

- [Financial Fraud Detection using Quantum Graph Neural Networks](https://mlsanity.com/paper/2309.01127/) (2023)
- [Graph Neural Networks in IoT: A Survey](https://mlsanity.com/paper/2203.15935/) (2022)
- [Anomal-E: A Self-Supervised Network Intrusion Detection System based on Graph Neural Networks](https://mlsanity.com/paper/2207.06819/) (2022)
- [Joint Edge-Model Sparse Learning is Provably Efficient for Graph Neural Networks](https://mlsanity.com/paper/2302.02922/) (2023)
- [Graph-based Solutions with Residuals for Intrusion Detection: the Modified E-GraphSAGE and E-ResGAT Algorithms](https://mlsanity.com/paper/2111.13597/) (2021)
- [AnoShift: A Distribution Shift Benchmark for Unsupervised Anomaly Detection](https://mlsanity.com/paper/2206.15476/) (2022)
- [Graph Neural Network-based Android Malware Classification with Jumping Knowledge](https://mlsanity.com/paper/2201.07537/) (2022)
- [On Generalisability of Machine Learning-based Network Intrusion Detection Systems](https://mlsanity.com/paper/2205.04112/) (2022)
- [Use of Graph Neural Networks in Aiding Defensive Cyber Operations](https://mlsanity.com/paper/2401.05680/) (2024)
- [Applying Self-supervised Learning to Network Intrusion Detection for Network Flows with Graph Neural Network](https://mlsanity.com/paper/2403.01501/) (2024)
- [XG-BoT: An Explainable Deep Graph Neural Network for Botnet Detection and Forensics](https://mlsanity.com/paper/2207.09088/) (2022)
- [ZOOMER: Boosting Retrieval on Web-scale Graphs by Regions of Interest](https://mlsanity.com/paper/2203.12596/) (2022)
- [Survey of Graph Neural Network for Internet of Things and NextG Networks](https://mlsanity.com/paper/2405.17309/) (2024)
- [Network Intrusion Detection System in a Light Bulb](https://mlsanity.com/paper/2210.03254/) (2022)
- [A Comparison of Graph Neural Networks for Malware Classification](https://mlsanity.com/paper/2303.12812/) (2023)
- [XG-NID: Dual-Modality Network Intrusion Detection using a Heterogeneous Graph Neural Network and Large Language Model](https://mlsanity.com/paper/2408.16021/) (2024)
- [Multi-Modal Data-Enhanced Foundation Models for Prediction and Control in Wireless Networks: A Survey](https://mlsanity.com/paper/2601.03181/) (2026)
- [Investigation and rectification of NIDS datasets and standardized feature set derivation for network attack detection with graph neural networks](https://mlsanity.com/paper/2212.13994/) (2022)
- [Efficient Network Representation for GNN-based Intrusion Detection](https://mlsanity.com/paper/2310.05956/) (2023)
- [EG-ConMix: An Intrusion Detection Method based on Graph Contrastive Learning](https://mlsanity.com/paper/2403.17980/) (2024)
- [PPT-GNN: A Practical Pre-Trained Spatio-Temporal Graph Neural Network for Network Security](https://mlsanity.com/paper/2406.13365/) (2024)
- [Network Anomaly Traffic Detection via Multi-view Feature Fusion](https://mlsanity.com/paper/2409.08020/) (2024)
- [Towards a graph-based foundation model for network traffic analysis](https://mlsanity.com/paper/2409.08111/) (2024)
- [Self-Supervised Learning of Graph Representations for Network Intrusion Detection](https://mlsanity.com/paper/2509.16625/) (2025)
- [Q-AGNN: Quantum-Enhanced Attentive Graph Neural Network for Intrusion Detection](https://mlsanity.com/paper/2603.22365/) (2026)
- [AHEAD: A Triple Attention Based Heterogeneous Graph Anomaly Detection Approach](https://mlsanity.com/paper/2208.08200/) (2022)
- [CAFIN: Centrality Aware Fairness inducing IN-processing for Unsupervised Representation Learning on Graphs](https://mlsanity.com/paper/2304.04391/) (2023)
- [3D-IDS: Doubly Disentangled Dynamic Intrusion Detection](https://mlsanity.com/paper/2307.11079/) (2023)
- [X-CBA: Explainability Aided CatBoosted Anomal-E for Intrusion Detection System](https://mlsanity.com/paper/2402.00839/) (2024)
- [Integrating Graph Neural Networks with Scattering Transform for Anomaly Detection](https://mlsanity.com/paper/2404.10800/) (2024)

## Abstract (arXiv)

This paper presents a new Network Intrusion Detection System (NIDS) based on Graph Neural Networks (GNNs). GNNs are a relatively new sub-field of deep neural networks, which can leverage the inherent structure of graph-based data. Training and evaluation data for NIDSs are typically represented as flow records, which can naturally be represented in a graph format. In this paper, we propose E-GraphSAGE, a GNN approach that allows capturing both the edge features of a graph as well as the topological information for network intrusion detection in IoT networks. To the best of our knowledge, our proposal is the first successful, practical, and extensively evaluated approach of applying GNNs on the problem of network intrusion detection for IoT using flow-based data. Our extensive experimental evaluation on four recent NIDS benchmark datasets shows that our approach outperforms the state-of-the-art in terms of key classification metrics, which demonstrates the potential of GNNs in network intrusion detection, and provides motivation for further research.