# Efficient Network Representation for GNN-based Intrusion Detection

arXiv: https://arxiv.org/abs/2310.05956 · HTML: https://mlsanity.com/paper/2310.05956/

## Key facts

- Cited by 2 papers in the map (data through 14 Oct 2026).
- Builds on 7 of its 19 references that are in the map.
- First posted on arXiv 11 Sep 2023.

## Builds on (most cited first, 7 of 7)

- [E-GraphSAGE: A Graph Neural Network based Intrusion Detection System for IoT](https://mlsanity.com/paper/2103.16329/) (2021)
- [Message passing all the way up](https://mlsanity.com/paper/2202.11097/) (2022)
- [ResGCN: Attention-based Deep Residual Modeling for Anomaly Detection on Attributed Networks](https://mlsanity.com/paper/2009.14738/) (2020)
- [Unveiling the potential of Graph Neural Networks for robust Intrusion Detection](https://mlsanity.com/paper/2107.14756/) (2021)
- [Graph-based Solutions with Residuals for Intrusion Detection: the Modified E-GraphSAGE and E-ResGAT Algorithms](https://mlsanity.com/paper/2111.13597/) (2021)
- [Machine learning on knowledge graphs for context-aware security monitoring](https://mlsanity.com/paper/2105.08741/) (2021)
- [A Machine Learning Smartphone-based Sensing for Driver Behavior Classification](https://mlsanity.com/paper/2202.01893/) (2022)

## Built on by (most cited first, 2 of 2)

- [Self-Supervised Learning of Graph Representations for Network Intrusion Detection](https://mlsanity.com/paper/2509.16625/) (2025)
- [GTCN-G: A Residual Graph-Temporal Fusion Network for Imbalanced Intrusion Detection](https://mlsanity.com/paper/2510.07285/) (2025)

## Abstract (arXiv)

The last decades have seen a growth in the number of cyber-attacks with severe economic and privacy damages, which reveals the need for network intrusion detection approaches to assist in preventing cyber-attacks and reducing their risks. In this work, we propose a novel network representation as a graph of flows that aims to provide relevant topological information for the intrusion detection task, such as malicious behavior patterns, the relation between phases of multi-step attacks, and the relation between spoofed and pre-spoofed attackers activities. In addition, we present a Graph Neural Network (GNN) based framework responsible for exploiting the proposed graph structure to classify communication flows by assigning them a maliciousness score. The framework comprises three main steps that aim to embed nodes features and learn relevant attack patterns from the network representation. Finally, we highlight a potential data leakage issue with classical evaluation procedures and suggest a solution to ensure a reliable validation of intrusion detection systems performance. We implement the proposed framework and prove that exploiting the flow-based graph structure outperforms the classical machine learning-based and the previous GNN-based solutions.