Cited by 37Network Security and Intrusion DetectionInternet Traffic Analysis and Secure E-votingAdversarial Robustness in Machine Learning

Optimizing IoT Intrusion Detection—A Graph Neural Network Approach with Attribute-Based Graph Construction

Open access
Ngo, Tien, Yin, Jiao, Ge, Yong-Feng, Wang, Hua·2025·Information

Abstract

The inherent complexity and heterogeneity of the Internet of Things (IoT) ecosystem present significant challenges for developing effective intrusion detection systems. While graph deep-learning-based methods have shown promise in cybersecurity applications, existing approaches primarily construct graphs based on physical network connections, which may not effectively capture node representations. This paper proposes a Top-K Similarity Graph Framework (TKSGF) for IoT network intrusion detection. Instead of relying on physical links, the TKSGF constructs graphs based on Top-K attribute similarity, ensuring a more meaningful representation of node relationships. We employ GraphSAGE as the Graph Neural Network (GNN) model to effectively capture node representations while maintaining scalability. Furthermore, we conducted extensive experiments to analyze the impact of graph directionality (directed vs. undirected), different K values, and various GNN architectures and configurations on detection performance. Evaluations on binary and multi-class classification tasks using the NF-ToN IoT and NF-BoT IoT datasets from the Machine-Learning-Based Network Intrusion Detection System (NIDS) benchmark demonstrated that our proposed framework consistently outperformed traditional machine learning methods and existing graph-based approaches, achieving superior classification accuracy and robustness.

Integrity signals

Registry

Crossref · 10.3390/info16060499

Cites

50 of 50 references verified0 citation errors · 0 not checkable

Statistics

Recomputing p-values needs the paper’s full text.

Claims the paper makes

We couldn’t retrieve this paper’s full text, so its claims and self-check weren’t run. The registry and citation checks still apply.

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

Cites

Flagged first, then by citations

1 of the 51 references couldn’t be matched to a known paper.

Cited by

Sorted by citations

Authors
Ngo, T., Yin, J., Ge, Y.-F., & Wang, H.
Affiliations
Victoria University (AU)
Corresponding author
Yin, Jiao
Venue
Information
Publisher
MDPI AG
Published
2025-06-16
Volume
16
Issue
6
Pages
499
ISSN
2078-2489 (ISSN-L)
OpenAlex
W4411345181
Cited by
37
References
51
Citations by year
2026: 27 · 2025: 10
FWCI
15.53
Type
journal article
Language
en
Open access
Locations
  • Information (publishedVersion, cc-by)
  • DOAJ (DOAJ: Directory of Open Access Journals) (submittedVersion, cc-by-sa)
Topics
  • Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
  • Physical Sciences › Computer Science › Artificial Intelligence › Internet Traffic Analysis and Secure E-voting
  • Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
Keywords
IoT intrusion detection, graph neural networks, GraphSAGE, network intrusion detection, node representation learning

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review