Optimizing IoT Intrusion Detection—A Graph Neural Network Approach with Attribute-Based Graph Construction
Open accessAbstract
The inherent complexity and heterogeneity of the Internet of Things (IoT) ecosystem present significant challenges for developing effective intrusion detection systems. While graph deep-learning-based methods have shown promise in cybersecurity applications, existing approaches primarily construct graphs based on physical network connections, which may not effectively capture node representations. This paper proposes a Top-K Similarity Graph Framework (TKSGF) for IoT network intrusion detection. Instead of relying on physical links, the TKSGF constructs graphs based on Top-K attribute similarity, ensuring a more meaningful representation of node relationships. We employ GraphSAGE as the Graph Neural Network (GNN) model to effectively capture node representations while maintaining scalability. Furthermore, we conducted extensive experiments to analyze the impact of graph directionality (directed vs. undirected), different K values, and various GNN architectures and configurations on detection performance. Evaluations on binary and multi-class classification tasks using the NF-ToN IoT and NF-BoT IoT datasets from the Machine-Learning-Based Network Intrusion Detection System (NIDS) benchmark demonstrated that our proposed framework consistently outperformed traditional machine learning methods and existing graph-based approaches, achieving superior classification accuracy and robustness.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Detectors that achieve >99% accuracy on a single dataset routinely lose 10-20 percentage points when transferred cross-dataset.
“detectors that achieve >99% accuracy on a single dataset routinely lose 10-20 percentage points when transferred cross-dataset”
From Agentic AI and Large Language Models for Autonomous IoT Cybersecurity: A Systematic Survey, Taxonomy, and Research Roadmap (2026) · cites this paper as [64]
Cites
Inductive Representation Learning on Large Graphs
Hamilton, W. L., Ying, R., & Leskovec, J. (2017) · arXiv · doi:10.48550/arxiv.1706.02216 · Cited by 10,639 · see citing works
Ahmad, Z., Khan, A. S., Shiang, C. W., Abdullah, J., & Ahmad, F. (2020) · Transactions on Emerging Telecommunications Technologies · doi:10.1002/ett.4150 · Cited by 1,313 · see citing works
Li, Y., & Liu, Q. (2021) · Energy Reports · doi:10.1016/j.egyr.2021.08.126 · Cited by 732 · see citing works
Recent advancements and challenges of Internet of Things in smart agriculture: A survey
Sinha, B. B., & Dhanalakshmi, R. (2021) · Future Generation Computer Systems · doi:10.1016/j.future.2021.08.006 · Cited by 591 · see citing works
The Internet of Things (IoT) in healthcare: Taking stock and moving forward
Rejeb, A., Rejeb, K., Treiblmaier, H., Appolloni, A., Alghamdi, S., Alhasawi, Y., & Iranmanesh, M. (2023) · Internet of Things · doi:10.1016/j.iot.2023.100721 · Cited by 490 · see citing works
E-GraphSAGE: A Graph Neural Network based Intrusion Detection System for IoT
Lo, W. W., Layeghy, S., Sarhan, M., Gallagher, M. R., & Portmann, M. (2022) · IEEE/IFIP Network Operations and Management Symposium (NOMS) · doi:10.1109/noms54207.2022.9789878 · Cited by 463 · see citing works
NetFlow Datasets for Machine Learning-Based Network Intrusion Detection Systems
Sarhan, M., Layeghy, S., Moustafa, N., & Portmann, M. (2021) · Lecture notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering · doi:10.1007/978-3-030-72802-1_9 · Cited by 445 · see citing works
CNN-LSTM: Hybrid Deep Neural Network for Network Intrusion Detection System
Halbouni, A. H., Gunawan, T. S., Habaebi, M. H., Halbouni, M., Kartiwi, M., & Ahmad, R. B. (2022) · IEEE Access · doi:10.1109/access.2022.3206425 · Cited by 425 · see citing works
A federated graph neural network framework for privacy-preserving personalization
Wu, C., Wu, F., Lyu, L., Qi, T., Huang, Y., & Xie, X. (2022) · Nature Communications · doi:10.1038/s41467-022-30714-9 · Cited by 385 · see citing works
RTIDS: A Robust Transformer-Based Approach for Intrusion Detection System
Wu, Z., Zhang, H., Wang, P., & Sun, Z. (2022) · IEEE Access · doi:10.1109/access.2022.3182333 · Cited by 356 · see citing works
An Enhanced AI-Based Network Intrusion Detection System Using Generative Adversarial Networks
Park, C.-H., Lee, J., Kim, Y., Park, J., Kim, H., & Hong, D. (2022) · IEEE Internet of Things Journal · doi:10.1109/jiot.2022.3211346 · Cited by 319 · see citing works
Design and Development of RNN Anomaly Detection Model for IoT Networks
Ullah, I., & Mahmoud, Q. H. (2022) · IEEE Access · doi:10.1109/access.2022.3176317 · Cited by 292 · see citing works
Graph Attention Networks: A Comprehensive Review of Methods and Applications
Vrahatis, A. G., Lazaros, K., & Kotsiantis, S. B. (2024) · Future Internet · doi:10.3390/fi16090318 · Cited by 286 · see citing works
A systematic literature review for network intrusion detection system (IDS)
Abdulganiyu, O. H., Ait Tchakoucht, T., & Saheed, Y. K. (2023) · International Journal of Information Security · doi:10.1007/s10207-023-00682-2 · Cited by 279 · see citing works
A brief study of Wannacry Threat: Ransomware Attack 2017
Mohurle, S., & Patil, M. (2017) · International Journal of Advanced Research in Computer Science · doi:10.26483/ijarcs.v8i5.4021 · Cited by 276 · see citing works
Graph Neural Networks for Intrusion Detection: A Survey
Bilot, T., Madhoun, N. E., Agha, K. A., & Zouaoui, A. (2023) · IEEE Access · doi:10.1109/access.2023.3275789 · Cited by 267 · see citing works
Kheddar, H. (2025) · Information Fusion · doi:10.1016/j.inffus.2025.103347 · Cited by 214 · see citing works
An Evaluation of Machine Learning Methods to Detect Malicious SCADA Communications
Beaver, J. M., Hink, R. B., & Buckner, M. A. (2013) · International Conference on Machine Learning and Applications · doi:10.1109/icmla.2013.105 · Cited by 197 · see citing works
An improved anomaly detection model for IoT security using decision tree and gradient boosting
Douiba, M., Benkirane, S., Guezzaz, A., & Azrour, M. (2022) · The Journal of Supercomputing · doi:10.1007/s11227-022-04783-y · Cited by 194 · see citing works
Munikoti, S., Agarwal, D., Das, L., Halappanavar, M. M., & Natarajan, B. (2023) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2023.3283523 · Cited by 180 · see citing works
Mohy-eddine, M., Guezzaz, A., Benkirane, S., & Azrour, M. (2023) · Multimedia Tools and Applications · doi:10.1007/s11042-023-14795-2 · Cited by 144 · see citing works
Mehmood, A., Mukherjee, M., Ahmed, S. H., Song, H. H., & Malik, K. M. (2018) · The Journal of Supercomputing · doi:10.1007/s11227-018-2413-7 · Cited by 132 · see citing works
Internet of Things for sustainable railway transportation: Past, present, and future
Singh, P., Elmi, Z., Meriga, V. K., Pasha, J., & Dulebenets, M. A. (2022) · Cleaner Logistics and Supply Chain · doi:10.1016/j.clscn.2022.100065 · Cited by 131 · see citing works
Datasets are not enough: Challenges in labeling network traffic
Guerra, J. L., Catania, C. A., & Veas, E. E. (2022) · Computers & Security · doi:10.1016/j.cose.2022.102810 · Cited by 115 · see citing works
A Reliable Network Intrusion Detection Approach Using Decision Tree with Enhanced Data Quality
Guezzaz, A., Benkirane, S., Azrour, M., & Khurram, S. (2021) · Security and Communication Networks · doi:10.1155/2021/1230593 · Cited by 114 · see citing works
A knowledge graph-based data representation approach for IIoT-enabled cognitive manufacturing
Liu, M., Li, X., Li, J., Liu, Y., Zhou, B., & Bao, J. (2022) · Advanced Engineering Informatics · doi:10.1016/j.aei.2021.101515 · Cited by 112 · see citing works
Xu, R., Wu, G., Wang, W., Gao, X., He, A., & Zhang, Z. (2024) · Computer Networks · doi:10.1016/j.comnet.2024.110495 · Cited by 108 · see citing works
Yin, J., Tang, M., Cao, J., & Wang, H. (2020) · Knowledge-Based Systems · doi:10.1016/j.knosys.2020.106529 · Cited by 101 · see citing works
Self-citationYu, Y., Zeng, X., Xue, X., & Ma, J. (2022) · IEEE Transactions on Intelligent Transportation Systems · doi:10.1109/tits.2022.3190432 · Cited by 101 · see citing works
Deng, X., Zhu, J., Pei, X., Zhang, L., Ling, Z., & Xue, K. (2022) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2022.3213807 · Cited by 94 · see citing works
IoT Botnet Attack Detection Based on Optimized Extreme Gradient Boosting and Feature Selection
Alqahtani, M., Mathkour, H. I., & Ismail, M. M. B. (2020) · Sensors · doi:10.3390/s20216336 · Cited by 87 · see citing works
PC-GAIN: Pseudo-label conditional generative adversarial imputation networks for incomplete data
Wang, Y., Li, D., Li, X., & Yang, M. (2021) · Neural Networks · doi:10.1016/j.neunet.2021.05.033 · Cited by 79 · see citing works
Learning Decentralized Wireless Resource Allocations With Graph Neural Networks
Wang, Z., Eisen, M., & Ribeiro, A. (2022) · IEEE Transactions on Signal Processing · doi:10.1109/tsp.2022.3163626 · Cited by 74 · see citing works
Intrusion Detection in IoT Systems Using Denoising Autoencoder
Alrayes, F. S., Zakariah, M., Amin, S. U., Khan, Z. I., & Helal, M. (2024) · IEEE Access · doi:10.1109/access.2024.3451726 · Cited by 70 · see citing works
A new concatenated Multigraph Neural Network for IoT intrusion detection
Altaf, T., Wang, X., Ni, W., Yu, G., Liu, R. P., & Braun, R. (2023) · Internet of Things · doi:10.1016/j.iot.2023.100818 · Cited by 58 · see citing works
Eid, A. M., Soudan, B., Nassif, A. B., & Injadat, M. (2024) · Neural Computing and Applications · doi:10.1007/s00521-024-09439-x · Cited by 53 · see citing works
INS-GNN: Improving graph imbalance learning with self-supervision
Juan, X., Zhou, F., Wang, W., Jin, W., Tang, J., & Wang, X. (2023) · Information Sciences · doi:10.1016/j.ins.2023.118935 · Cited by 38 · see citing works
An Empirical Study of the GraphSAGE and Word2vec Algorithms for Graph Multiclass Classification
Hajibabaee, P., Malekzadeh, M., Heidari, M., Zad, S., Uzuner, Ö., & Jones, J. H. (2021) · IEEE Annual Information Technology, Electronics and Mobile Communication Conference (IEMCON) · doi:10.1109/iemcon53756.2021.9623238 · Cited by 37 · see citing works
Insider threat detection using supervised machine learning algorithms
Manoharan, P., Yin, J., Wang, H., Zhang, Y., & Ye, W. (2024) · Telecommunication Systems · doi:10.1007/s11235-023-01085-3 · Cited by 34 · see citing works
Self-citationOptimizing random forests to detect intrusion in the Internet of Things
Majidian, Z., TaghipourEivazi, S., Arasteh, B., & Ghaffari, A. (2024) · Computers & Electrical Engineering · doi:10.1016/j.compeleceng.2024.109860 · Cited by 29 · see citing works
Graph-based data management system for efficient information storage, retrieval and processing
Aldwairi, M., Jarrah, M., Mahasneh, N., & Al‐khateeb, B. (2022) · Information Processing & Management · doi:10.1016/j.ipm.2022.103165 · Cited by 29 · see citing works
An Intrusion Detection System for Imbalanced Dataset Based on Deep Learning
Mbow, M., Koide, H., & Sakurai, K. (2021) · International Symposium on Computing and Networking · doi:10.1109/candar53791.2021.00013 · Cited by 28 · see citing works
Optimising insider threat prediction: Exploring BiLSTM networks and sequential features
Manoharan, P., Hong, W., Yin, J., Wang, H., Zhang, Y., & Ye, W. (2024) · Data Science and Engineering · doi:10.1007/s41019-024-00260-z · Cited by 22 · see citing works
Self-citationA heterogeneous graph-based semi-supervised learning framework for access control decision-making
Yin, J., Chen, G., Hong, W., Cao, J., Wang, H., & Miao, Y. (2024) · World Wide Web · doi:10.1007/s11280-024-01275-2 · Cited by 22 · see citing works
Self-citationHamidouche, M., Popko, E. A., & Ouni, B. (2023) · International Conference on the Internet of Things (IoT) · doi:10.1145/3627050.3627053 · Cited by 17 · see citing works
Masked Graph Neural Networks for Unsupervised Anomaly Detection in Multivariate Time Series
Xu, K., Li, Y., Li, Y., Xu, L., Li, R., & Dong, Z. (2023) · Sensors · doi:10.3390/s23177552 · Cited by 13 · see citing works
Cybersecurity Applications in Software: Data-Driven Software Vulnerability Assessment and Management
Yin, J., Tang, M., Cao, J., You, M., & Wang, H. (2022) · Springer eBooks · doi:10.1007/978-3-031-09640-2_17 · Cited by 10 · see citing works
Self-citationSPORT: A Subgraph Perspective on Graph Classification with Label Noise
Yin, N., Shen, L., Chen, C., Hua, X., & Luo, X. (2024) · ACM Transactions on Knowledge Discovery from Data · doi:10.1145/3687468 · Cited by 7 · see citing works
SViG: A Similarity-Thresholded Approach for Vision Graph Neural Networks
Elsharkawi, I., Sharara, H., & Rafea, A. (2025) · IEEE Access · doi:10.1109/access.2025.3531691 · Cited by 5 · see citing works
Ngo, T., Yin, J., Ge, Y.-F., Zhou, C., & Cao, J. (2025) · Lecture notes in computer science · doi:10.1007/978-981-96-5597-7_7 · Cited by 4 · see citing works
Self-citation
Flagged first, then by citations
1 of the 51 references couldn’t be matched to a known paper.
Cited by
Sorted by citations
Semantic Knowledge Graph Framework for Intelligent Threat Identification in IoT
Yan, L., Wang, Q., & Liu, C. (2025) · International Conference on Information Science, Parallel and Distributed Systems (ISPDS) · doi:10.1109/ispds67367.2025.11390883 · Cited by 14 · see citing works
Ponnumani, R., Vasudeva, N., Elumalai, T., Kaliyaperumal, P., Balusamy, B., & Benedetto, F. (2026) · Computers & Electrical Engineering · doi:10.1016/j.compeleceng.2026.110949 · Cited by 12 · see citing works
Zhang, Y., Wang, Y., & Gao, L. (2025) · Ad Hoc Networks · doi:10.1016/j.adhoc.2025.104082 · Cited by 6 · see citing works
Lightweight and Energy-Aware Intrusion Detection for Industrial IoT Using TinyML and Edge AI
Nassef, L., Alghamdi, I., Chaabane, S. B., Abbas, Q., Alawad, W. M., Albalawi, O. H., Alqaisi, O. I., & Fakieh, B. (2026) · Scientific Reports · doi:10.1038/s41598-026-50690-0 · Cited by 4 · see citing works
Chen, L., Zhu, H., & Han, S. (2025) · Axioms · doi:10.3390/axioms14070504 · Cited by 3 · see citing works
Ansah, P., John, C. S., Tetarave, S. K., & Kalaimannan, E. (2025) · International Journal of Data Science and Analytics · doi:10.1007/s41060-025-00922-9 · Cited by 3 · see citing works
Nageshwaran, V., & Ezekiel, S. (2026) · Electronics · doi:10.3390/electronics15122740 · Cited by 4 · see citing works
A Survey of IPv6 Address Scanning Technologies
Ma, Y., Chen, L., & Wang, Z. (2025) · Information · doi:10.3390/info16090727 · Cited by 2 · see citing works
Hayouni, H., & Jbali, F. (2025) · Security and Privacy · doi:10.1002/spy2.70163 · Cited by 2 · see citing works
Morshedi, R., & Matinkhah, S. M. (2025) · Complexity · doi:10.1155/cplx/9693472 · Cited by 2 · see citing works
Bala, T. J., Nag, A., Prabha, C., Biswas, S., Bairagi, A. K., Al‐Maitah, M., Chowdhury, M., & El‐Shafai, W. (2026) · Defence Technology · doi:10.1016/j.dt.2026.06.002 · Cited by 2 · see citing works
GRAPH NEURAL NETWORK-BASED INTRUSION DETECTION FOR IOT: PERFORMANCE AND COMPARATIVE ANALYSIS
Bondar, O. (2025) · ГРААЛЬ НАУКИ · doi:10.36074/grail-of-science.18.07.2025.058 · Cited by 1 · see citing works
Zhao, X., He, M., Yang, L., Zhao, J., & Wang, X. (2026) · IEEE Transactions on Network Science and Engineering · doi:10.1109/tnse.2026.3664905 · Cited by 1 · see citing works
Luo, Q. (2026) · International Seminar on Artificial Intelligence, Networking and Information Technology (AINIT) · doi:10.1109/ainit70033.2026.11558083 · Cited by 1 · see citing works
Osei-Wusu, F., Appiah, O., Mensah, P. K., Nimbe, P., & Donkoh, E. K. (2026) · Concurrency and Computation Practice and Experience · doi:10.1002/cpe.70817 · Cited by 1 · see citing works
Yilmaz, A. R., Daş, R., Özdem, M., & Canberk, B. (2026) · Computer Networks · doi:10.1016/j.comnet.2026.112632 · Cited by 1 · see citing works
Leakage-Safe Multi-View Graph Construction for Robust Intrusion Detection in Edge-IIoT Networks
Dey, S., & Quaium, A. (2025) · International Conference on Next Generation Computing, Communication, Systems and Security · doi:10.1145/3777555.3777572
MSG-VA: multi-scale graph visual analytics for real-time network threat detection
Badawood, D. Y. (2026) · Journal of Umm Al-Qura University for Engineering and Architecture · doi:10.1007/s43995-025-00284-0
Poornimha, J., & Rani, P. R. P. (2025) · International Conference on Communication, Computing and Industry 4.0 (C2I4) · doi:10.1109/c2i666499.2025.11366969
Priya, B. V., Prasad, K. R., & Senthil, M. (2026) · International Conference on Smart Electronic Devices and Intelligent Systems (ICSEDIS) · doi:10.1109/icsedis68157.2026.11518270
Quantum-Enhanced Hybrid Variational Neural Network for IoT Intrusion Detection
Shrivastava, A., Khan, N. R., Singhal, A., Kumar, L., Bindal, A. K., & Verma, S. (2026) · International Conference Big Data and Machine Learning · doi:10.1109/icbdml68582.2026.11544431
Learning User–Resource Interactions for Dynamic Access Control Based on Graph–Transformer Fusion
You, M., Yin, J., Ge, Y.-F., Wang, K., & Wang, H. (2026) · Communications in computer and information science · doi:10.1007/978-981-95-9877-9_13
Self-citationRezk, M., Harb, H., Bennis, I., Bindel, S., & Abouaïssa, A. (2026) · International Wireless Communications and Mobile Computing Conference (IWCMC) · doi:10.1109/iwcmc69287.2026.11580099
Kovtun, V. V. (2026) · Scientific Reports · doi:10.1038/s41598-026-62265-0
T-HFAM IDS: A low-latency machine learning framework for adaptive threat detection in IoT networks
Rawat, R., Rawat, H., Rawat, A., & Rajavat, A. (2026) · Array · doi:10.1016/j.array.2026.101100
Wang, Z., Lin, P., Zou, S., Yuan, X., & Liu, L. (2026) · Discover Computing · doi:10.1007/s10791-026-10526-x
Lin, D., Liu, W., & Wang, M. (2026) · Computer Networks · doi:10.1016/j.comnet.2026.112760
Ramyadevi, M. P. (2026) · International Journal Of Engineering And Computer Science · doi:10.18535/ijecs.v15i09.5703
КОСТЮК, Ю. В., Molchanova, E., СКЛАДАННИЙ, П. М., Sokolov, V., & Khorolska, K. (2026) · Information · doi:10.3390/info17100958
Kalaichelvi, N., Kamatchy, B., Arivazhagan, P., Rajangam, S., Punitha, V., & G.S.Geethamani (2026) · International Conference on Soft Computing for Security Applications (ICSCSA) · doi:10.1109/icscsa69367.2026.11708276
Juaita, A. A. Z., Anggriani, K., & Vatresia, A. (2026) · International Conference on Information Technology and Computing (ICITCOM) · doi:10.1109/icitcom70739.2026.11714415
Sheela Sobana Rani, K., Chinnaiyan, R., Dhannya, J., Preeya, A., V, Raja, S. P., & Kumari, M. (2026) · Sustainable Computing Informatics and Systems · doi:10.1016/j.suscom.2026.101493
Watile, S. S., Thakare, P. D., Chinte, S. P., Pogaku, D., & Danwe, S. (2026) · EPJ Web of Conferences · doi:10.1051/epjconf/202639101011
Kavitha, A., & Karthika, S. (2026) · International Conference on Next-Gen Intelligent Computing and Applications (ICONICA) · doi:10.1109/iconica70605.2026.11736855
Javed, M., Ghani, M. U., Khan, H. M., Khan, F. M., Nawaz, M. H., Farid, M., Alsayaydeh, J. A. J., & Izzuddin, T. A. (2026) · Pervasive and Mobile Computing · doi:10.1016/j.pmcj.2026.102302
KIPONGO, J., Esenogho, E., & Swart, T. G. (2026) · Array · doi:10.1016/j.array.2026.101370
Abdulwahhab, A. R., Salleh, M. F. M., Akbar, M. F., & Abdullah, M. N. (2026) · Boletim da Sociedade Paranaense de Matemática · doi:10.5269/bspm.81405
- Authors
- Ngo, T., Yin, J., Ge, Y.-F., & Wang, H.
- Affiliations
- Victoria University (AU)
- Corresponding author
- Yin, Jiao
- Venue
- Information
- Publisher
- MDPI AG
- Published
- 2025-06-16
- Volume
- 16
- Issue
- 6
- Pages
- 499
- ISSN
- 2078-2489 (ISSN-L)
- OpenAlex
- W4411345181
- Cited by
- 37
- References
- 51
- Citations by year
- 2026: 27 · 2025: 10
- FWCI
- 15.53
- Type
- journal article
- Language
- en
- Open access
- gold
- doi.org
- Licence
- Locations
- Information (publishedVersion, cc-by)
- DOAJ (DOAJ: Directory of Open Access Journals) (submittedVersion, cc-by-sa)
- Topics
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Computer Science › Artificial Intelligence › Internet Traffic Analysis and Secure E-voting
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Keywords
- IoT intrusion detection, graph neural networks, GraphSAGE, network intrusion detection, node representation learning
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review