Incremental-learning-based graph neural networks on edge-forwarding devices for network intrusion detection

Graph neural networks have become one of the research hotspots for network intrusion detection due to their natural suitability for representing computer networks. However, most of the related research on training GNNs is centralized, and this approach involves long-distance transmission and dumping of network data, so it is inefficient to perform, has the potential for privacy leakage, and introduces an additional transmission burden to the network. To address these challenges, this paper investigates the feasibility of offloading both graph neural networks' training and inference phases to edge-forwarding devices such as switches. We propose a distributed framework that aggregates residual computational resources from edge-forwarding devices into a micro-computing network. This framework then migrates GNN execution to edge-forwarding devices through a hybrid parallelism paradigm, thus locally detecting network anomalies to reduce network data transmission significantly. Meanwhile, to address the problem of computational and memory constraints of edge-forwarding devices, we propose a novel attention heatmap-driven memoryless incremental learning algorithm that learns network features and detects anomalies with minimal resources while avoiding catastrophic forgetting. Finally, we implement and verify the feasibility of the above framework and algorithm using a general-purpose embedded system and open-source software. The experiments show that although each edge-forwarding device's computational and memory load is light, the framework performs similarly to traditional approaches. To the best of our knowledge, this is the first approach that offloads a graph neural network model to edge-forwarding devices.