From packets to predictions on GPU: Accelerated graph-based intrusion detection system

• From Packets to Predictions On GPU: accelerated Graph-based Intrusion Detection System Ahmed Salah Tawfik Ibrahim, Emilio Paolini, Filippo Cugini, Francesco Paolucci This manuscript presents an In-GPU GNN-based intrusion detection system. Below, we summarize the novel contributions introduced in this work: • End-to-End In-GPU Pipeline - Problem: CPU-side graph construction and host-device memory transfers dominate prediction latency in GNN-based IDS pipelines, hindering real-time deployment. - New contribution: We redesign node aggregation and adjacency generation as CUDA kernels and execute both graph construction and GNN inference entirely on the GPU. This eliminates copy overheads and exploits thread-level parallelism to reduce end-to-end latency while preserving detection accuracy. • Reduced Memory Requirements - Problem: Previous GNN-based intrusion detection systems are memory-hungry. - New contribution: In this version, this problem is mitigated by exploiting the sparse properties of the input graph to reduce the memory size required for the system to run. • Optimized Memory Access Pattern - Problem: GPU memory accesses patterns are typically not considered. - New contribution: Accesses to GPU global memory are optimized achieving better performance and lower execution time especially after reducing the memory requirements. Graph Neural Networks (GNNs) are effective in detecting cyberattacks thanks to their ability to model network traffic, capturing structural relationships within the network. However, the high latency of the graph construction phase directly translates into higher overall prediction time, posing a challenge to real-time deployment. Therefore, an optimized GPU-accelerated framework that leverages the structural properties of the traffic graph is proposed in this work. It builds upon the notion of a precomputed adjacency matrix that gets modified by each graph instance. GPU threads are further used to construct the nodes, achieving an end-to-end graph generation and inference fully within the GPU. The sparsity of the graph and the coalesced memory access pattern within the GPU threads are further exploited to optimize the process. This allows the GPU to build large graphs much faster than the CPU without affecting the classification accuracy. This speedup is prominent for large graphs of 700 packets with the GPU being almost 4.3 times faster, highlighting the effectiveness of the proposed approach in real-time deployments.