A Hub-Centric Graph Neural Network for Scalable Intrusion Detection

Abstract: Intrusion detection is a critical component of modern cybersecurity, particularly as network traffic continues to increase in scale and complexity. Traditional machine learning methods have achieved promising results but often fail to capture the relational dependencies among network entities. Graph Neural Networks (GNNs) offer an effective framework for learning from graph-structured data, enabling the modeling of such relationships. However, applying GNNs directly to large-scale intrusion datasets poses scalability challenges due to the vast number of nodes and potential interconnections. In this study, we propose a hub-centric graph construction approach where Internet Protocol (IP) addresses act as hub nodes, and all traffic records associated with the same IP are connected to the hub. This strategy reduces graph density and enhances scalability without significant loss of structural information. The proposed GNN model, implemented using a four-layer SAGEConv architecture, achieved an accuracy of 80% on the UNSW-NB15 dataset [1]. Although traditional models such as Random Forest reached a higher accuracy of 96%, the GNN demonstrated stronger relational learning and better generalization to complex, non-linear, and previously unseen attack patterns. Keywords: Graph Neural Network, Intrusion Detection, Cybersecurity, UNSW-NB15, Hub Node