# Anomal-E: A Self-Supervised Network Intrusion Detection System based on Graph Neural Networks

arXiv: https://arxiv.org/abs/2207.06819 · HTML: https://mlsanity.com/paper/2207.06819/

## Key facts

- Cited by 27 papers in the map (data through 14 Oct 2026).
- Builds on 17 of its 38 references that are in the map.
- First posted on arXiv 14 Jul 2022.

## Builds on (most cited first, 17 of 17)

- [Inductive Representation Learning on Large Graphs](https://mlsanity.com/paper/1706.02216/) (2017)
- [How Powerful are Graph Neural Networks?](https://mlsanity.com/paper/1810.00826/) (2018)
- [A Comprehensive Survey on Graph Neural Networks](https://mlsanity.com/paper/1901.00596/) (2019)
- [node2vec: Scalable Feature Learning for Networks](https://mlsanity.com/paper/1607.00653/) (2016)
- [Graph Neural Networks: A Review of Methods and Applications](https://mlsanity.com/paper/1812.08434/) (2018)
- [Deep Graph Infomax](https://mlsanity.com/paper/1809.10341/) (2018)
- [A Comprehensive Survey of Graph Embedding: Problems, Techniques and Applications](https://mlsanity.com/paper/1709.07604/) (2017)
- [Towards the Development of Realistic Botnet Dataset in the Internet of Things for Network Forensic Analytics: Bot-IoT Dataset](https://mlsanity.com/paper/1811.00701/) (2018)
- [E-GraphSAGE: A Graph Neural Network based Intrusion Detection System for IoT](https://mlsanity.com/paper/2103.16329/) (2021)
- [Interpretable and Efficient Heterogeneous Graph Convolutional Network](https://mlsanity.com/paper/2005.13183/) (2020)
- [NetFlow Datasets for Machine Learning-based Network Intrusion Detection Systems](https://mlsanity.com/paper/2011.09144/) (2020)
- [Towards a Standard Feature Set for Network Intrusion Detection System Datasets](https://mlsanity.com/paper/2101.11315/) (2021)
- [Automating Botnet Detection with Graph Neural Networks](https://mlsanity.com/paper/2003.06344/) (2020)
- [Bi-CLKT: Bi-Graph Contrastive Learning based Knowledge Tracing](https://mlsanity.com/paper/2201.09020/) (2022)
- [Graph-based Solutions with Residuals for Intrusion Detection: the Modified E-GraphSAGE and E-ResGAT Algorithms](https://mlsanity.com/paper/2111.13597/) (2021)
- [On Generalisability of Machine Learning-based Network Intrusion Detection Systems](https://mlsanity.com/paper/2205.04112/) (2022)
- [Variational Co-embedding Learning for Attributed Network Clustering](https://mlsanity.com/paper/2104.07295/) (2021)

## Built on by (most cited first, 27 of 27)

- [Deep transfer learning for intrusion detection in industrial control networks: A comprehensive review](https://mlsanity.com/paper/2304.10550/) (2023)
- [Applying Self-supervised Learning to Network Intrusion Detection for Network Flows with Graph Neural Network](https://mlsanity.com/paper/2403.01501/) (2024)
- [Survey of Graph Neural Network for Internet of Things and NextG Networks](https://mlsanity.com/paper/2405.17309/) (2024)
- [Incremental Causal Graph Learning for Online Cyberattack Detection in Cyber-Physical Infrastructures](https://mlsanity.com/paper/2507.14387/) (2025)
- [PhoGAD: Graph-based Anomaly Behavior Detection with Persistent Homology Optimization](https://mlsanity.com/paper/2401.10547/) (2024)
- [PPT-GNN: A Practical Pre-Trained Spatio-Temporal Graph Neural Network for Network Security](https://mlsanity.com/paper/2406.13365/) (2024)
- [Towards a graph-based foundation model for network traffic analysis](https://mlsanity.com/paper/2409.08111/) (2024)
- [Self-Supervised Transformer-based Contrastive Learning for Intrusion Detection Systems](https://mlsanity.com/paper/2505.08816/) (2025)
- [Self-Supervised Learning of Graph Representations for Network Intrusion Detection](https://mlsanity.com/paper/2509.16625/) (2025)
- [Q-AGNN: Quantum-Enhanced Attentive Graph Neural Network for Intrusion Detection](https://mlsanity.com/paper/2603.22365/) (2026)
- [Online Self-Supervised Deep Learning for Intrusion Detection Systems](https://mlsanity.com/paper/2306.13030/) (2023)
- [3D-IDS: Doubly Disentangled Dynamic Intrusion Detection](https://mlsanity.com/paper/2307.11079/) (2023)
- [X-CBA: Explainability Aided CatBoosted Anomal-E for Intrusion Detection System](https://mlsanity.com/paper/2402.00839/) (2024)
- [Integrating Graph Neural Networks with Scattering Transform for Anomaly Detection](https://mlsanity.com/paper/2404.10800/) (2024)
- [Understanding the Robustness of Graph Neural Networks against Adversarial Attacks](https://mlsanity.com/paper/2406.13920/) (2024)
- [AutoGraphAD: Unsupervised network anomaly detection using Variational Graph Autoencoders](https://mlsanity.com/paper/2511.17113/) (2025)
- [Anomaly Detection in Cooperative Vehicle Perception Systems under Imperfect Communication](https://mlsanity.com/paper/2501.17329/) (2025)
- [Poster: Enhancing GNN Robustness for Network Intrusion Detection via Agent-based Analysis](https://mlsanity.com/paper/2506.20806/) (2025)
- [A Survey of Heterogeneous Graph Neural Networks for Cybersecurity Anomaly Detection](https://mlsanity.com/paper/2510.26307/) (2025)
- [Evaluating Tabular Representation Learning for Network Intrusion Detection](https://mlsanity.com/paper/2605.02519/) (2026)
- [GESR: Graph-Based Edge Semantic Reconstruction for Stealthy Communication Detection with Benign-Only Training](https://mlsanity.com/paper/2605.07536/) (2026)
- [Learning Feature Encoder with Synthetic Anomalies for Weakly Supervised Graph Anomaly Detection](https://mlsanity.com/paper/2605.11749/) (2026)
- [Timestamp-Aware Spatio-Temporal Graph Contrastive Learning for Network Intrusion Detection](https://mlsanity.com/paper/2606.17109/) (2026)
- [Enhanced Feature Extraction for IoT Network Intrusion Detection Using GNNs and KAN](https://mlsanity.com/paper/2607.02981/) (2026)
- [Concept drift mitigation through community and spectral graph analysis for the detection of cyberattacks in network traffic](https://mlsanity.com/paper/2609.09442/) (2026)
- [A Multi Method Importance and Performance Efficiency Analysis of Topological Metrics for Natural Visibility Graph Based Cyber Attack Detection](https://mlsanity.com/paper/2610.02342/) (2026)
- [A Quantitative Analysis of Graph Representation Strategies for Cyber Attack Detection](https://mlsanity.com/paper/2610.04019/) (2026)

## Abstract (arXiv)

This paper investigates Graph Neural Networks (GNNs) application for self-supervised network intrusion and anomaly detection. GNNs are a deep learning approach for graph-based data that incorporate graph structures into learning to generalise graph representations and output embeddings. As network flows are naturally graph-based, GNNs are a suitable fit for analysing and learning network behaviour. The majority of current implementations of GNN-based Network Intrusion Detection Systems (NIDSs) rely heavily on labelled network traffic which can not only restrict the amount and structure of input traffic, but also the NIDSs potential to adapt to unseen attacks. To overcome these restrictions, we present Anomal-E, a GNN approach to intrusion and anomaly detection that leverages edge features and graph topological structure in a self-supervised process. This approach is, to the best our knowledge, the first successful and practical approach to network intrusion detection that utilises network flows in a self-supervised, edge leveraging GNN. Experimental results on two modern benchmark NIDS datasets not only clearly display the improvement of using Anomal-E embeddings rather than raw features, but also the potential Anomal-E has for detection on wild network traffic.