BS-GAT: a network intrusion detection system based on graph neural network for edge computing

Abstract The emergence of Edge Computing has led to an increasingly intricate and widespread issue of network infiltration in Edge Computing devices. Therefore, it is crucial to explore intelligent, automated, and resilient methods for network intrusion detection. Graph neural network-based techniques for network intrusion detection have been proposed by many scholars recently. However, the graph construction methods of these approaches cannot fully adapt to real network intrusion datasets, leading to problems such as overfitting and insufficient graph information mining. Furthermore, the methods employed in the model training phase are relatively limited, failing to consider the characteristic presence of grouping within networks. These shortcomings result in a lack of high accuracy in intrusion detection systems, especially in multi-class classification scenarios. This research suggests a graph neural network technique based on behavior similarity employing a graph attention network (BS-GAT) to handle the aforementioned problem. To address overfitting and inadequate graph information mining, a behavioral similarity-based graph creation method is first presented through an analysis of real datasets. Subsequently, the inclusion of edge behavioral relationship weights into the GAT leverages the relationship between data flow and graph structural information, enhancing the performance of the trained model. In the final stage, experiments were executed using the most recent datasets to assess the effectiveness of the proposed behavior similarity-based graph attention network in network intrusion detection. The findings indicate that the proposed approach is highly effective and significantly outperforms existing solutions. In binary classification, recall, precision, f1-score, and accuracy all exceed 99%. For multi-class performance, the recognition accuracy exceeds 93%, the weighted recall surpasses 91%, and the weighted f1-score exceeds 92%, showing a substantial improvement in multi-class recognition effectiveness.