# Graph-based Solutions with Residuals for Intrusion Detection: the Modified E-GraphSAGE and E-ResGAT Algorithms

arXiv: https://arxiv.org/abs/2111.13597 · HTML: https://mlsanity.com/paper/2111.13597/

## Key facts

- Cited by 12 papers in the map (data through 14 Oct 2026).
- Builds on 10 of its 28 references that are in the map.
- First posted on arXiv 26 Nov 2021.

## Builds on (most cited first, 10 of 10)

- [Deep Residual Learning for Image Recognition](https://mlsanity.com/paper/1512.03385/) (2015)
- [Adam: A Method for Stochastic Optimization](https://mlsanity.com/paper/1412.6980/) (2014)
- [PyTorch: An Imperative Style, High-Performance Deep Learning Library](https://mlsanity.com/paper/1912.01703/) (2019)
- [Graph Attention Networks](https://mlsanity.com/paper/1710.10903/) (2017)
- [Inductive Representation Learning on Large Graphs](https://mlsanity.com/paper/1706.02216/) (2017)
- [Fast and Accurate Deep Network Learning by Exponential Linear Units (ELUs)](https://mlsanity.com/paper/1511.07289/) (2015)
- [Discriminative Embeddings of Latent Variable Models for Structured Data](https://mlsanity.com/paper/1603.05629/) (2016)
- [E-GraphSAGE: A Graph Neural Network based Intrusion Detection System for IoT](https://mlsanity.com/paper/2103.16329/) (2021)
- [Automating Botnet Detection with Graph Neural Networks](https://mlsanity.com/paper/2003.06344/) (2020)
- [Graph-based Deep Learning for Communication Networks: A Survey](https://mlsanity.com/paper/2106.02533/) (2021)

## Built on by (most cited first, 12 of 12)

- [Anomal-E: A Self-Supervised Network Intrusion Detection System based on Graph Neural Networks](https://mlsanity.com/paper/2207.06819/) (2022)
- [Graph Neural Network-based Android Malware Classification with Jumping Knowledge](https://mlsanity.com/paper/2201.07537/) (2022)
- [Use of Graph Neural Networks in Aiding Defensive Cyber Operations](https://mlsanity.com/paper/2401.05680/) (2024)
- [Investigation and rectification of NIDS datasets and standardized feature set derivation for network attack detection with graph neural networks](https://mlsanity.com/paper/2212.13994/) (2022)
- [Efficient Network Representation for GNN-based Intrusion Detection](https://mlsanity.com/paper/2310.05956/) (2023)
- [EG-ConMix: An Intrusion Detection Method based on Graph Contrastive Learning](https://mlsanity.com/paper/2403.17980/) (2024)
- [PPT-GNN: A Practical Pre-Trained Spatio-Temporal Graph Neural Network for Network Security](https://mlsanity.com/paper/2406.13365/) (2024)
- [BS-GAT Behavior Similarity Based Graph Attention Network for Network Intrusion Detection](https://mlsanity.com/paper/2304.07226/) (2023)
- [Problem space structural adversarial attacks for Network Intrusion Detection Systems based on Graph Neural Networks](https://mlsanity.com/paper/2403.11830/) (2024)
- [NIDS Neural Networks Using Sliding Time Window Data Processing with Trainable Activations and its Generalization Capability](https://mlsanity.com/paper/2410.18658/) (2024)
- [CONTINUUM: Detecting APT Attacks through Spatial-Temporal Graph Neural Networks](https://mlsanity.com/paper/2501.02981/) (2025)
- [A Quantitative Analysis of Graph Representation Strategies for Cyber Attack Detection](https://mlsanity.com/paper/2610.04019/) (2026)

## Abstract (arXiv)

The high volume of increasingly sophisticated cyber threats is drawing growing attention to cybersecurity, where many challenges remain unresolved. Namely, for intrusion detection, new algorithms that are more robust, effective, and able to use more information are needed. Moreover, the intrusion detection task faces a serious challenge associated with the extreme class imbalance between normal and malicious traffics. Recently, graph-neural network (GNN) achieved state-of-the-art performance to model the network topology in cybersecurity tasks. However, only a few works exist using GNNs to tackle the intrusion detection problem. Besides, other promising avenues such as applying the attention mechanism are still under-explored. This paper presents two novel graph-based solutions for intrusion detection, the modified E-GraphSAGE, and E-ResGATalgorithms, which rely on the established GraphSAGE and graph attention network (GAT), respectively. The key idea is to integrate residual learning into the GNN leveraging the available graph information. Residual connections are added as a strategy to deal with the high-class imbalance, aiming at retaining the original information and improving the minority classes' performance. An extensive experimental evaluation of four recent intrusion detection datasets shows the excellent performance of our approaches, especially when predicting minority classes.