Optimizing Network Intrusion Detection Performance with GNN-Based Feature Selection
Source abstract
Abstract
The rapid evolution of AI-driven cybersecurity solutions has led to increasingly complex network infrastructures, which in turn increases their exposure to sophisticated threats. This study proposes a Graph Neural Network (GNN)-based feature selection strategy specifically tailored for Network Intrusion Detection Systems (NIDS). By modeling feature correlations and leveraging their topological relationships, this method addresses challenges such as feature redundancy and class imbalance. Experimental analysis using the KDDTest+ dataset demonstrates that the proposed model achieves 98.5% detection accuracy, showing notable gains in both computational efficiency and minority class detection. Compared to conventional machine learning methods, the GNN-based approach exhibits a superior capability to adapt to the dynamics of evolving cyber threats. The findings support the feasibility of deploying GNNs for scalable, real-time anomaly detection in modern networks. Furthermore, key predictive features, notably f35 and f23, are identified and validated through correlation analysis, thereby enhancing the model’s interpretability and effectiveness.
Source: openalex_inverted_index · Quality: baseline
Research context
OpenAlex topics: Network Security and Intrusion Detection
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
References (20)
Show source-provided references
1. A survey of graph-based deep learning for anomaly detection in distributed systems10.1109/TKDE.2023.3282898 ↗
2. Geometric deep learning: going beyond Euclidean data10.1109/MSP.2017.2693418 ↗
3. Enhancing multi-class attack detection in graph neural network through feature rearrangement10.3390/electronics13122404 ↗
4. Threatrace: detecting and tracing host-based threats in node level through provenance graph learning10.1109/TIFS.2022.3208815 ↗
5. Neural network based intrusion detection system for critical infrastructures
6. Deep learning-based intrusion detection systems: a systematic review10.1109/ACCESS.2021.3097247 ↗
7. Incremental update intrusion detection for industry 5.0 security: a graph attention network-enabled approach10.1109/TCE.2023.3331907 ↗
8. Graph neural networks for intrusion detection: a survey10.1109/ACCESS.2023.3275789 ↗
9. A comprehensive survey on graph neural networks10.1109/TNNLS.2020.2978386 ↗
10. A comprehensive survey on graph anomaly detection with deep learning10.1109/TKDE.2021.3118815 ↗
11. Anomal-E: a self-supervised network intrusion detection system based on graph neural networks10.1016/j.knosys.2022.110030 ↗
12. Correlation-based advanced feature analysis for wireless sensor networks10.1007/s11227-023-05739-6 ↗
13. Performance analysis of intrusion detection systems using a feature-selection method on the UNSW-NB15 dataset10.1186/s40537-020-00379-6 ↗
14. Particle swarm optimization and feature selection for intrusion detection system10.1007/s12046-020-1308-5 ↗
15. Optimizing IoT intrusion detection system: feature selection versus feature extraction in machine learning10.1186/s40537-024-00892-y ↗
16. Avila · Foundations and practice of security · 2022 · 9310.1007/978-3-031-08147-7_7 ↗
17. CPS-IoT-PPDNN: a new explainable privacy preserving DNN for resilient anomaly detection in Cyber-Physical Systems-enabled IoT networks10.1016/j.chaos.2024.115939 ↗
18. Xaiensembletl-iov: a new explainable artificial intelligence ensemble transfer learning for zero-day botnet attack detection in the internet of vehicles
19. Anomaly detection analysis based on correlation of features in graph neural network10.1007/s11042-023-15635-z ↗
20. Biometric methods for advanced strategic data sharing protocols