Graph neural networks for network intrusion detection systems: a comprehensive survey, taxonomy, and empirical evaluation

Graph neural networks (GNNs) have emerged as a transformative paradigm for intrusion detection systems (IDSs), addressing limitations of traditional flat-data approaches that fail to capture complex network structures and attack patterns. This survey systematically reviews GNN-driven IDS solutions and introduces a comprehensive taxonomy spanning problem domain specialization, graph construction, feature encoding, learning paradigms, and evaluation methodologies. We analyze existing literature across seven key dimensions, examining node- and edge-level detection tasks, static versus dynamic graph models, and supervised, semi-supervised, and unsupervised learning settings. The review critically evaluates well-known GNN architectures across diverse network environments such as IoT, smart grids, and vehicular networks. To strengthen the quantitative component, we conduct a leakage-controlled study using the UNSW-NB15 dataset and perform a comprehensive performance evaluation of ten representative IDS baselines. Empirical results reveal that graph-based IDS models offer stronger practical advantages in detection rate stability, inference efficiency, and near-real-time applicability compared to conventional tree-based models. These findings suggest that the value of GNN-based IDS should be assessed not solely through aggregate accuracy but also through operational metrics such as detection rate, running time, scalability, and graph construction feasibility.