Temporal-Spatial Attention Graph Neural Network for Detecting Address Resolution Protocol Attacks in Industrial Internet of Things

Due to the low security of devices in Industrial Internet of Things (IIoT) systems, the network is highly vulnerable to potential threats. Among these threats, the Address Resolution Protocol (ARP) attack is a common attack method employed by hackers. Many existing studies have focused on using network traffic data for ARP attack detection. However, they overlook the fact that network traffic data exists in a non-Euclidean space. To address the challenges posed by non-Euclidean space, we adopt graph-based methods instead of Convolutional Neural Networks (CNNs). To detect ARP attacks, we propose a Temporal-Spatial Attention Graph Neural Network (TSAGNN) for detecting ARP attacks. Network traffic inherently contains rich temporal relationships, and our graph construction method combines both temporal graph and spatial graph, enabling us to capture information from both dimensions simultaneously. Furthermore, the introduction of attention mechanisms allows the model to focus on the most representative and critical nodes in the graph, thereby improving both the accuracy and efficiency of the training process. Experimental results show the effectiveness of our approach.