Defending Network Intrusion Detection Systems Based on Graph Neural Networks Against Structural Adversarial Attacks
cs.CR
Submitted: 2026-08-25
Updated: 2026-08-25
Comments: In Proceedings of 2025 23rd International Symposium on Network Computing and Applications (NCA), Lisbon, Portugal, 2025
DOI: 10.1109/NCA67271.2025.00043
Code: https://github.com/dimgalli/defending-gnn-nids
License: http://creativecommons.org/licenses/by/4.0/
The gist: Graph Neural Networks (GNNs) represent a promising solution for Machine Learning (ML) based Network Intrusion Detection Systems (NIDS), thanks to their ability to leverage both network flow features
Terminology
Abstract
Graph Neural Networks (GNNs) represent a promising solution for Machine Learning (ML) based Network Intrusion Detection Systems (NIDS), thanks to their ability to leverage both network flow features and topological patterns. While GNN classifiers demonstrate superior robustness against feature-based adversarial attacks compared to other ML detectors, they remain vulnerable to structural adversarial attacks, where an attacker perturbs the underlying network graph topology by injecting edges or inserting nodes. Such attacks pose a realistic and severe threat, undermining the reliability of GNN-based NIDS in practical deployments. While countermeasures have been proposed in the literature, they often rely on assumptions that are unrealistic in real-world cybersecurity scenarios. In this paper, we propose a defense framework based on adversarial training to strengthen GNN-based NIDS against structural attacks. We generate adversarial samples by strategically replacing the source and destination nodes in benign network flows, thereby efficiently mimicking edge injection attacks. We evaluate our approach on two widely used datasets (CTU-13 and TON-IoT) using E-GraphSAGE as the base GNN classifier. Experimental results show that our approach produces hardened detectors with superior detection performance on clean graphs and enhanced robustness against structural adversarial attacks.
Sources
- Problem space structural adversarial attacks for Network Intrusion Detection Systems based on Graph Neural Networks
- REAL-IoT: Characterizing GNN Intrusion Detection Robustness under Practical Adversarial Attack
- Explaining and Harnessing Adversarial Examples
- Kitsune: An Ensemble of Autoencoders for Online Network Intrusion Detection
- Adversarial Examples on Graph Data: Deep Insights into Attack and Defense
- Topology Attack and Defense for Graph Neural Networks: An Optimization Perspective
- Intriguing properties of neural networks
- Towards Deep Learning Models Resistant to Adversarial Attacks
- Bag of Tricks for Adversarial Training
- On the Effectiveness of Adversarial Training on Malware Classifiers
Related papers
- SoK: AI-Augmented Binary Reversing
- Relaxed Sender Anonymity for CBDC Interbank Settlement: A Zero-Knowledge Approach on Permissioned EVM
- Calibration-Family Overfit: Why Trusted Sabotage Monitors Don't Transfer Across Lineages
- Estimating the Social Cost of Corporate Data Breaches
- Efficient Fuzzy PSI under One-Sided Assumptions
- Sealing the Audit-Runtime Gap for LLM Skills