# Multi-stage Attack Detection and Prediction Using Graph Neural Networks: An IoT Feasibility Study

arXiv: https://arxiv.org/abs/2404.18328 · HTML: https://mlsanity.com/paper/2404.18328/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 2 of its 18 references that are in the map.
- First posted on arXiv 28 Apr 2024.

## Builds on (most cited first, 2 of 2)

- [Semi-Supervised Classification with Graph Convolutional Networks](https://mlsanity.com/paper/1609.02907/) (2016)
- [Federated TON_IoT Windows Datasets for Evaluating AI-based Security Applications](https://mlsanity.com/paper/2010.08522/) (2020)

## Abstract (arXiv)

With the ever-increasing reliance on digital networks for various aspects of modern life, ensuring their security has become a critical challenge. Intrusion Detection Systems play a crucial role in ensuring network security, actively identifying and mitigating malicious behaviours. However, the relentless advancement of cyber-threats has rendered traditional/classical approaches insufficient in addressing the sophistication and complexity of attacks. This paper proposes a novel 3-stage intrusion detection system inspired by a simplified version of the Lockheed Martin cyber kill chain to detect advanced multi-step attacks. The proposed approach consists of three models, each responsible for detecting a group of attacks with common characteristics. The detection outcome of the first two stages is used to conduct a feasibility study on the possibility of predicting attacks in the third stage. Using the ToN IoT dataset, we achieved an average of 94% F1-Score among different stages, outperforming the benchmark approaches based on Random-forest model. Finally, we comment on the feasibility of this approach to be integrated in a real-world system and propose various possible future work.