# Leveraging Graph Neural Networks for Attack Detection in IoT Systems

Ramzi Rezki, Youakim Badr, Samia Bouzefrane, Fabrice Mourlin, Méziane Yacoub

► To cite this version:

Ramzi Rezki, Youakim Badr, Samia Bouzefrane, Fabrice Mourlin, Méziane Yacoub. Leveraging Graph Neural Networks for Attack Detection in IoT Systems. 20th International Conference on Availability, Reliability and Security (ARES 2025), UGent, Aug 2025, Gand, Belgium. pp.259-274, 10.1007/978-3-032-00639-4_15 . hal-05308797

HAL Id: hal-05308797

https://hal.science/hal-05308797v1

Submitted on 10 Oct 2025

**HAL** is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
# Leveraging Graph Neural Networks for Attack Detection in IoT Systems

REZKI Ramzi¹[0009-0007-4449-8591], BADR Youakim²[0000-0002-8976-7894], BOUZEFRANE Samia¹[0000-0002-0979-1289], MOURLIN Fabrice³[0000-0003-0427-2516], and YACOUB Meziane¹[0000-0003-4031-1527]

¹ National Conservatory of Arts and Crafts, France

² The Pennsylvania State University, USA yzb61@psu.edu

³ Université de Paris-Est Creteil fabrice.mourlin@u-pec.fr

**Abstract.** The increasing interconnectivity of Internet-of-Things (IoT) has exposed them to diverse cyber threats and adversarial attacks, distributed denial-of-service (DDoS) attacks, spoofing and man-in-the-middle intrusions, malware injections, ransomware, and adversarial machine learning exploits. To detect these attacks, this research leverages Graph Neural Networks (GNNs) for intrusion detection and attack analysis by exploiting the graph's intrinsic structure of communication networks and sessions. We propose advanced GNN-based models that extract high-dimensional features from IoT networks and enable in-depth analysis of packets. By representing IoT networks as graphs, GNNs effectively capture the intricate interactions and dependencies among network components. The proposed models were trained on three distinct datasets, namely ToN-IoT, NF-BoT-IoT, and GraSecIoT, to perform detection tasks, including binary classification to differentiate normal from malicious behavior and multi-class classification to identify one or more underlying attacks. The experimental results validate the effectiveness of graph neural networks in detecting malicious activities and categorizing attack types, thereby offering a robust solution for securing IoT environments.

**Keywords:** Cyber security · IoT · Machine learning · GNN · Attack detection

## 1 Introduction

Internet of things Systems (IoT) integrate computational intelligence with physical processes, enabling real-time monitoring, automation, and control in critical infrastructures such as industrial control systems, autonomous vehicles, and healthcare devices. However, the growing interconnectivity and complexity of these systems have exposed them to sophisticated cyber-attacks that can compromise operational integrity, safety, and security. Furthermore, attack detection in IoT is challenging due to heterogeneity of communication protocols, scalability, resource constraints, dynamic topologies and complex interactions
which intricate dependencies among network components and between cyber
and physical processes. However, traditional attack detection methods, such as
signature-based or rule-based approaches, often struggle to adapt evolving attack
strategies, making them inadequate for securing modern IoT environments. In
addition, machine learning faces significant limitations in attack detection [1] for
IoT due to the dynamic nature of these environments, where devices frequently
join or leave networks, requiring models to adapt without constant retraining.
On the other hand, attackers continuously evolve their techniques, making it
difficult for static ML models to detect novel or previously unseen Attacks. The
heterogeneity of IoT systems, with diverse devices, protocols, and communication
standards, further complicates the development of a unified ML-based detection
system. While ML provides powerful tools, these challenges underscore the need
for ongoing research and development to enhance adaptability, generalization,
and integration in complex and evolving IoT environments.

This research aims to address the security challenges by leveraging Graph
Neural Networks for attack detection in IoT systems. We used the IP addresses
solely for modeling IoT networks as graphs and not as features in our study be-
cause in general, IP addresses are excluded in machine learning methods, as they
do not provide meaningful or significant information for model training, GNN
techniques provide a powerful framework for capturing the intricate interactions
and dependencies within network data. This approach enables high-dimensional
feature extraction from packet-level details, facilitating both binary classification
to detect the presence of attacks and multi-class classification to identify specific
attack types, and mainly address these challenges:

- Detecting and analyzing complex, dynamic, and distributed cyber-attacks:

Graph Neural Networks provide unique advantages for detecting attacks in IoT Systems by analyzing network packets. Unlike traditional machine learning methods, GNNs effectively model the complex relationships between network entities (nodes and edges) by leveraging the inherent graph structure of IoT. They excel in detecting distributed attacks (e.g., DDoS), propagated anomalies (e.g., malware), and abnormal behaviors by capturing spatial and temporal dependencies. GNNs also handle heterogeneous and partially labeled data, improving detection in dynamic network environments. However, their computational cost and vulnerability to adversarial attacks require optimizations to ensure scalability and robustness.

- **Imbalanced Data:** A major challenge in attack detection is the imbalanced data, collected from normal and abnormal behavior traffic in IoT environments. In fact, attacks are often rare events compared to normal operational states. The imbalance data leads to biases in machine learning training and evaluation, where trained models tend to favor the majority class (normal behavior) and perform poorly in detecting rare attack instances. As a result, the detection of new or sophisticated attacks become a challenge, as machine learning models at inference time fail to recognize less frequent attack patterns.
Hence, addressing these challenges requires novel techniques that can effectively consider the graph-based structure of IoT systems, manage imbalanced datasets, incorporate domain knowledge, and ensure that detection systems are lightweight yet accurate enough to function in real-world IoT environments.

## 2 Related work on attack detection

Several studies have explored the use of machine learning algorithms to detect cyber attacks in IoT environments. For instance, authors in [5] propose a distributed detection system based on machine learning techniques to detect and mitigate attacks in IoT systems. Unlike the widely-used NSL-KDD or KDD-CUP99 datasets [21], which are outdated and lack new attack types, the study utilizes the ToN-IoT dataset, which is derived from a large-scale, diverse IoT network. The dataset encompasses data from all layers of the IoT system cloud, fog, and edge. The Chi2 technique was used for feature selection, reducing the dataset to 20 features and evaluates various ML algorithms in both binary and multi-class classification tasks, concluding that the XGBoost approach outperforms others for each node in the model. In addition, authors in [14] introduce a specialized method for detecting Denial of Service attacks in IoT networks. This method models the network as a graph, where each IoT device is represented as a node and each connection between devices as an edge. The weight of an edge reflects the frequency of communications between two nodes. To extract meaningful features, the authors apply node2vec transformation, Moreover, a graph embedding algorithm introduced in [6], which generates vector representations that capture key network characteristics, Additionally, GNN is used in [10] where they proposed a novel data modeling approach that leverages a heterogeneous graph structure with Express Edges to improve the attack detection capabilities of machine learning models and introduce the first comprehensive performance benchmark of various heterogeneous graph neural network algorithm variants, evaluated across multiple network intrusion detection system datasets. The primary objective is to support CPS/IoT defenders in achieving superior attack detection effectiveness against evolving cyber attacks.

Furthermore, we find Graph-based techniques [16] enabling anomaly detection by identifying nodes or edges that deviate from the expected behavior of a graph. These methods can effectively detect a range of cybersecurity threats, such as fraud, malware incursions, and network attacks. However, certain areas warrant further exploration, such as employing graph-based algorithms to pre-filter alerts from firewalls and other cybersecurity systems. Such advancements could drastically reduce the workload for security analysts and strengthen the overall security framework.

In some other works like in [15], they compare three Deep learning algorithms which excel over classical machine learning in automatically extracting patterns and representations from raw data, making them highly suitable for detecting complex attacks. This study compares the performance of three deep learning models, Convolutional Neural Networks, Deep Neural Networks,
and Recurrent Neural Networks in IDS implementations using three datasets (NF-UNSW-NB15, NF-BoT-IoT, and NF-ToN-IoT). In [3], they introduced sine and cosine component cyclic encoding for temporal attributes and addressed data imbalance by combining the Synthetic Minority Over-sampling Technique (SMOTE) for oversampling with an improved version of the Tomek link removal technique for under-sampling using various machine learning and deep learning models. However, authors in [19] highlight the advantages of reinforcement learning (RL) based intrusion detection systems in addressing complex challenges, such as feature selection and resource constraints, which traditional machine learning methods struggle to solve. It compares RL with classical machine learning approaches, including support-vector machines, and convolutional neural networks, using datasets like KDD Cup99 and ISCX 2012. The methodology involves data exploration, model training, and evaluation, with a focus on the dueling double deep Q-networks architecture for RL. Findings reveal that RL, which learns through interactions with a stochastic environment, outperforms supervised learning methods that rely on historical data and suffer from model drift and limited generalization. Finally, authors in [20] propose a risk management framework to secure IoT applications in smart infrastructures during both design and runtime. At the design phase, a tailored risk management method is introduced, while the runtime phase leverages Anomaly Behavior Analysis (ABA) enabled by the Autonomic Computing paradigm and an intrusion detection system to identify and mitigate threats. Preliminary results demonstrate the framework's effectiveness in detecting threats and safeguarding IoT environments and services.

We propose our GNN-based attack detection as unified deep learning model capable of handling both binary and multi-class classification tasks with optimal performance, eliminating the need for separate models as in traditional machine learning approaches by using graph modeling for edge classification task.

# 3 Methodology

Before presenting the architecture of the Graph Neural Network employed in our study, we first examine the datasets used for training and evaluation, along with the preprocessing steps implemented to ensure data quality and consistency. Following this, we detail the procedure for constructing graphs from tabular data, explaining how nodes and edges are defined based on the intrinsic relationships between data points. This rigorous data structuring is essential for enabling effective learning with graph-based models.

## 3.1 Data Processing

To ensure consistency and improve the quality of the selected datasets, we employ several preprocessing techniques. For numerical values, Min-Max normalization was applied to scale features to a bounded range of values, typically [0,1], preserving the relationships between the data points while eliminating potential
issues caused by differing scales. This step was crucial to ensure that features
with larger ranges did not dominate those with smaller ranges during subsequent
analysis.

For categorical values, we utilized the one-hot encoding technique. This ap-
proach transforms categorical variables into binary vectors, where each unique
category is represented as a separate dimension. By applying one-hot encoding,
we were able to incorporate categorical data into our models without imposing
any ordinal relationships among the categories. Ensuring that both numerical

<figure><img src="image_2.png" /><figcaption>Fig. 1. Flow distribution by type (Normal/Attack)</figcaption></figure>

and categorical features were effectively prepared for analysis and modeling,
these preprocessing steps were applied to the various datasets Fig. 1:

- **ToN-IoT**: is a comprehensive cybersecurity dataset designed for evaluating machine learning models in detecting attacks within IoT environments [13]. Simulating a realistic telecommunications infrastructure, it includes network traffic data, telemetry from IoT sensors, and operating system logs from various connected devices. Each record in the dataset is labeled as normal or malicious, covering a range of cyber attacks such as DoS, DDoS, malware injection, and ransomware attacks.

- **Nf-BoT-IoT**: The original dataset was created at the Cyber Range Lab of UNSW Canberra to simulate a realistic network environment [9] comprising both legitimate and malicious IoT network traffic. It includes various attack types such as Denial of Service, reconnaissance, and information theft.

- **Grasec-IoT**: The dataset is a curated resource for cybersecurity research, focusing on detecting attacks in IoT network environments [8] captured from emulated IoT network. It includes network traffic data represented as graphs that illustrate device interactions, service relationships, and communication patterns. Each graph provides a snapshot of the network activity within a specific timeframe, allowing detailed analysis of attack behaviors. Dataset features with various attack scenarios are initiated by a botnet of virtual
machines controlled via a Kali virtual machine simulating attacks such as HTTP GET and POST floods, ICMP and TCP SYN floods, UDP floods, port scanning, and brute force attacks enabling researchers to evaluate and benchmark detection algorithms in realistic IoT environments.

## 3.2 Graph construction

To analyze network traffic and understand the communication patterns between devices within the network, we constructed a graph-based representation using the captured packet data to perform the task of graph's edge classification. In this graph, we used a sliding window approach to traverse the rows of a dataset in order to construct graphs where the nodes represent IP addresses vectors which will be updated within the GNN architecture to obtain a real structure embedding describing the node without dependence on the ip address value which is common practice in machine learning to exclude source and destination IP addresses during training to avoid the creation of dummy classifiers that rely solely on these easily identifiable features, and the edges indicate the presence of communication between the source and destination. Additionally, a feature vector is associated with each edge, containing comprehensive information about the packets and communications exchanged between the corresponding source and destination such as the protocol used (e.g., TCP, UDP, IoT protocols,...), specific flags present in the packet headers (e.g., SYN, ACK, FIN), the size of the data payload, and the timestamp of the communication. This representation provides a structured and detailed view of network interactions, enabling advanced analyses such as attack detection, traffic classification, and visualization of communication patterns. By incorporating edge features, the graph captures the contextual details of each interaction, offering deeper insights into the behavior and dynamics of the network. We can also justify our choice by: the IP

<figure><img src="image_3.png" /><figcaption>Fig. 2. Graph-based representation of well-known attacks from [22]</figcaption></figure>

address's position in the graph and its connections provide context. For instance, a source IP frequently communicating with a large number of destinations might indicate scanning behavior. In addition to that, destination IP under high traffic from many source IPs could indicate a DDoS attack as it is shown in the figure
2 and discussed in [22] where ML models can inadvertently learn highly specific flow-level features (e.g., average packet size) that are strongly correlated with certain attack signatures. However, this reliance on narrow feature correlations renders them susceptible to evasion through minor adversarial modifications such as variations in packet lengths, inter-arrival times, or port numbers a common tactic employed by attackers.

## 3.3 GNN-based architecture for attack detection

<figure><img src="image_4.png" /><figcaption>Fig. 3. GNN-based attack detection model</figcaption></figure>

The proposed GNN-based neural architecture in Fig. 3 is a graph neural network designed for edge classification tasks in complex graphs. It applies GraphSAGE layer [7] for effective node feature aggregation of one hop to avoid the over-smoothing of embeddings, the different steps of GNN are described in the Algorithm 1.

For a node v within the layer k, the embedding Graphsage of $h_v^{(k)}$ is updated:

$$h_v^{(k)} = \sigma (W^{(k)} \cdot \text{CONCAT} (h_v^{(k-1)}, \text{AGGREGATE}^{(k)} (\{h_u^{(k-1)}, \forall u \in \mathcal{N}(v)\})))$$

- $\mathcal{N}(v)$ : neighborhood of v.

- AGGREGATE : Function of aggregation (Mean, LSTM, or max-pooling).

- $W^{(k)}$ : learning weights of the layer k.

- $\sigma$ : activation function (ReLU, sigmoid, etc.).
<caption>**Algorithm 1:** Edge Classification GNN with GraphSAGE and GAT</caption>

**Input:** $X \in R^{N \times d_n}$: Node features
$E \in R^{M \times d_e}$: Edge features
$\text{edge\_index} \in R^{2 \times M}$: Edge connections
$\text{dh} \in R$: the number of neurons in the hidden layer
**Output:** Edge predictions $\hat{y} \in [0, 1]^M$
**Model Architecture:**
- conv1 $\leftarrow$ SAGEConv($d_n, d_h$)
- gat $\leftarrow$ GATConv($d_h, d_h$, heads = 4, concat = True)
- edge_mlp $\leftarrow$ Sequential(Linear($8d_h + d_e, 2d_h$), ReLU(), Dropout($p = 0.1$), Linear($2d_h, d_h$), ReLU(), Linear($d_h, \text{num\_classes}$))
**Forward Pass:**
begin
  $x \leftarrow$ ReLU(conv1($x, \text{edge\_index}$)); // First GraphSAGE layer
  $x \leftarrow$ gat($x, \text{edge\_index}$); // 4-head GAT layer
  ($src, dst$) $\leftarrow$ edge\_index; // Edge endpoints
  edge\_features $\leftarrow$ concat($x[\text{src}], x[\text{dst}], E$);
  //
  logits $\leftarrow$ edge_mlp($\text{edge\_features}$)
  \text{return} $\sigma$(logits); // Sigmoid/Softmax for binary/multiple classification
end

After obtaining node embedding from the previous layer of GraphSAGE, the model processes them through a **Graph Attention Network (GAT)** with 4 heads to compute importance scores for neighboring nodes:

$$h'_{i} = \text{CONCAT}_{k=1}^{K} \left( \sigma \left( \sum_{j \in \mathcal{N}(i)} \alpha_{ij}^{k} W^{k} h_{j} \right) \right)$$

The importance scores $\alpha_{ij}$ are then normalised by softmax:

$$\alpha_{ij} = \frac{\exp(\text{LeakyReLU}(a^T[\text{Wh}_i \| \text{Wh}_j]))}{\sum_{k \in \mathcal{N}(i)} \exp(\text{LeakyReLU}(a^T[\text{Wh}_i \| \text{Wh}_k]))}$$

- W: Shared weight matrix for linear transformation.

- a: Attention weight vector.

- $\|$: Concatenation operation.

- LeakyReLU: Activation function (typically with slope of 0.2 for negative inputs).

We hypothesize that augmenting our model with Graph Attention Networks will enable discriminative weighting of neighbor nodes through learned attention scores, thereby improving differentiation between attack types (e.g., DDoS vs. port scanning) based on their distinct topological signatures:

- DDoS attacks (uniform attention to many neighbors)
- Port scanning (focused attention on sequential ports)

- Brute force (repeated attention to same service)

For edge classification, the GNN-based model constructs edge features by concatenating embeddings of source and target nodes with edge-specific attributes. These features are passed through a multi-layer perceptron with ReLU activations and dropout layers [17] to enhance generalization and robustness. The proposed GNN-based model is trained using a weighted Cross Entropy Loss to address class imbalance, ensuring accurate classification across diverse edge classes. Additionally, the architecture benefits from careful weight initialization Xavier and optimization using the Adam optimizer, making it well-suited for real-world applications requiring reliable edge classification in graph-structured data.

The model is trained with an NVIDIA RTX 6000 Ada Generation GPU with a total memory capacity of 49GB using pytorch geometric to implement the different layers of GNN and MLP of classification with learning rate of 5.00E-03 and Batch size of 32 graphs for 50 epochs and dropout factor of 0.1 and finally, the window size of 10000 flows for constructing the graphs as mentioned in Table 1.

<table><caption>**Table 1.** Hyper-parameter settings</caption><thead><tr><td>Hyper-parameters</td><td>Values</td></tr></thead><tbody><tr><td>Learning rate</td><td>5.00E-03</td></tr><tr><td>Batch size</td><td>32</td></tr><tr><td>Epochs</td><td>50</td></tr><tr><td>Dropout factor</td><td>0.1</td></tr><tr><td>Window Size</td><td>10000</td></tr></tbody></table>

## 3.4 Evaluation Metrics

To evaluate the performance of our model, we use the metrics **Precision**, **Recall**, and **F1-Score**, **FPR** and the ROC-AUC curve, which are commonly employed in classification tasks. These metrics are defined as follows:

$$ \text{Precision} = \frac{\text{True Positives (TP)}}{\text{True Positives (TP)} + \text{False Positives (FP)}} \qquad (1) $$

A higher precision indicates fewer false positive predictions.

$$ \text{Recall} = \frac{\text{True Positives (TP)}}{\text{True Positives (TP)} + \text{False Negatives (FN)}} \qquad (2) $$

A higher recall indicates that more actual positive cases are captured.
The F1-Score is the harmonic mean of Precision and Recall. It provides a balance between these two metrics and is especially useful when the class distribution is imbalanced. The F1-Score is defined as:

$$F1\text{-}Score = 2 \cdot \frac{\text{Precision} \cdot \text{Recall}}{\text{Precision} + \text{Recall}} \qquad (3)$$

The False Positive Rate (FPR) measures the proportion of normal (benign) instances that are incorrectly classified as attacks. A lower FPR indicates better performance, as it means the model is making fewer incorrect alerts

$$\text{False Positive Rate (FPR)} = \frac{\text{False Positives (FP)}}{\text{False Positives (FP)} + \text{True Negatives (TN)}} \qquad (4)$$

The AUC-ROC value ranges from 0 to 1, where a value of 1 indicates perfect separation between the classes, and a value of 0.5 represents random guessing. These metrics collectively provide a comprehensive view of the model's performance, balancing the trade-offs between precision and recall.

# 4 Experiments and Results

In our work, we divided the dataset into three subsets using a 70-20-10 split. Specifically, 70% of the data was allocated for training the model, 10% was used for validation to tune hyperparameters and prevent overfitting, and the remaining 20% was reserved for testing to evaluate the final performance of the model. This division ensures a balanced approach, providing sufficient data for training while maintaining separate validation and test sets to assess the model's generalization ability accurately.

<table><caption>**Table 2.** Performance Comparison With and Without GAT in ToN-IoT dataset</caption><thead><tr><th rowspan="2"></th><th colspan="2">With GAT</th><th colspan="2">Without GAT</th></tr><tr><th>FPR</th><th>F1</th><th>FPR</th><th>F1</th></tr></thead><tbody><tr><td>Backdoor</td><td>0.05%</td><td>99.76%</td><td>0.18%</td><td>99%</td></tr><tr><td>Ddos</td><td>0.28%</td><td>96.62%</td><td>0.46%</td><td>95.45%</td></tr><tr><td>Dos</td><td>0.47%</td><td>96.56%</td><td>0.22%</td><td>97%</td></tr><tr><td>Injection</td><td>0.68%</td><td>80.30%</td><td>4.62%</td><td>78.10%</td></tr><tr><td>Mitm</td><td>0.61%</td><td>96.54%</td><td>0.67%</td><td>95.82%</td></tr><tr><td>Normal</td><td>0.02%</td><td>99.26%</td><td>0.05%</td><td>99%</td></tr><tr><td>Password</td><td>2.66%</td><td>87.31%</td><td>0.43%</td><td>74.64%</td></tr><tr><td>Ransomware</td><td>0.12%</td><td>99.02%</td><td>0.19%</td><td>98.24%</td></tr><tr><td>Scanning</td><td>0.23%</td><td>97.68%</td><td>0.35%</td><td>96.47%</td></tr><tr><td>XSS</td><td>0.56%</td><td>94.91%</td><td>0.94%</td><td>92.47%</td></tr><tr><td>Average</td><td>0.59%</td><td>95%</td><td>0.81%</td><td>92.62%</td></tr></tbody></table>
<table><caption>**Table 3.** Performance Comparison With and Without GAT in Grasec-IoT dataset</caption><thead><tr><th rowspan="2"></th><th colspan="2">With GAT</th><th colspan="2">Without GAT</th></tr><tr><th>FPR</th><th>F1</th><th>FPR</th><th>F1</th></tr></thead><tbody><tr><td>Http get flood</td><td>0.89%</td><td>96.74%</td><td>1.96%</td><td>97.20%</td></tr><tr><td>Icmp frag flood</td><td>0%</td><td>99.64%</td><td>0.33%</td><td>98.99%</td></tr><tr><td>Tcp flood</td><td>0.32%</td><td>83.88%</td><td>12.93%</td><td>66%</td></tr><tr><td>Udp flood</td><td>1.73%</td><td>88.50%</td><td>0.05%</td><td>0.19%</td></tr><tr><td>Port scan</td><td>0.04%</td><td>92.90%</td><td>0.03%</td><td>92.81%</td></tr><tr><td>Brute force</td><td>0.12%</td><td>97.17%</td><td>0.34%</td><td>97.41%</td></tr><tr><td>Normal</td><td>2.19%</td><td>97.43%</td><td>2.37%</td><td>97.64%</td></tr></tbody><tfoot><tr><td>Average</td><td>0.70%</td><td>93.75%</td><td>2.57%</td><td>78.60%</td></tr></tfoot></table>

<table><caption>**Table 4.** Performance Comparison With and Without GAT in Nf-BoT-IoT dataset</caption><thead><tr><th rowspan="2"></th><th colspan="2">With GAT</th><th colspan="2">Without GAT</th></tr><tr><th>FPR</th><th>F1</th><th>FPR</th><th>F1</th></tr></thead><tbody><tr><td>Reconnaissance</td><td>2.88%</td><td>94.86%</td><td>3.46%</td><td>95.18%</td></tr><tr><td>Benign</td><td>1.55%</td><td>63.32%</td><td>0.97%</td><td>67.19%</td></tr><tr><td>Ddos</td><td>6.57%</td><td>87.54%</td><td>6.61%</td><td>87.46%</td></tr><tr><td>Theft</td><td>0.28%</td><td>58.05%</td><td>0.28%</td><td>57.44%</td></tr></tbody><tfoot><tr><td>Average</td><td>2.82%</td><td>93%</td><td>2.83%</td><td>92.62%</td></tr></tfoot></table>

<figure><img src="image_5.png" /><figcaption>**Fig. 4.** Binary classification results</figcaption></figure>

The hypothesis of the section 3.3 about adding attention mechanism to our GNN model was validated through our experiments, as shown in the three results Table 2, 3 and Table 4. The integration of Graph Attention Networks (GAT) led to noticeable improvements in classification performance, confirming that the attention mechanism effectively assigns discriminative weights to neighboring nodes. Particularly confirmed in Table 2 and Table 4, where we observed a clear improvement in classification between DDoS and scanning attacks in terms of
F1-score, and FPR of btute force from 0.34% to 0.12% in Table 3, along with a reduction in the false positive rate (FPR), This enhancement allowed the model to better distinguish between attack types, which exhibit different topological patterns in the network structure.

<figure><img src="image_6.png" /><figcaption>Fig. 5. Multi-class classification result</figcaption></figure>

The results in Fig. 4 and Fig. 5 demonstrate that the proposed GNN-based
attack detection model consistently performs well in both binary and multi-class
classification across all datasets, particularly excelling in multi-class classification
on Grasec-IoT and binary classification on Nf-Bot-IoT.

5 Discussion

<figure><img src="image_7.png" /><figcaption>Fig. 6. The curve ROC-AUC for Nf-Bot-IoT in multi class classification</figcaption></figure>

As evidenced by the evaluation ROC-AUC curve in Fig. 6, Fig. 7 and Fig. 8,
the proposed model demonstrates effective discriminative capabilities between
<figure><img src="image_8.png" /><figcaption>Fig. 7. The curve ROC-AUC for Ton-IoT in multi class classification</figcaption></figure>

<figure><img src="image_9.png" /><figcaption>Fig. 8. The curve ROC-AUC for Grasec-IoT in multi class classification</figcaption></figure>

attack classes and normal traffic flows. While the ROC AUC scores consistently exceed 0.5 (surpassing random chance), the model maintains robust overall performance with a strong macro F1-score of 98% at least across the different datasets in binary classification and 92.5% for multi class classification.

Table 5 provides a comparative analysis of different works based on their F-1 scores for both binary and multi-class classification tasks. The models are trained and evaluated on Ton-IoT, Nf-Bot-IoT, and Grasec-IoT datasets.

Our proposed model achieves the highest F1-score across all datasets in binary classification:

- **Ton-IoT:** The GNN-based attack detection model reaches **99.08%**, surpassing the previous best 98.70% by [5]. It also significantly outperforms [3] with oversampling (90.09%).

- **Nf-Bot-IoT:** Our GNN-based attack detection model achieves **99.04%**, which is **24.34% higher** than [10] (74.70%).
- **Grasec-IoT:** Our GNN-based attack detection model achieves **98.76%**, providing the first reported results on this dataset.

Furthermore, our GNN-based attack detection model demonstrates superior performance in multi-class classification:

- **Ton-IoT:** When applying the SMOTE oversampling technique in conjunction with Tomek-link under-sampling, the performance improves further, achieving a score of 98.57%, significantly surpassing other algorithms. This enhancement can be attributed to the relatively high dimensionality and complexity of the network dataset in multi-class classification. Moreover, our F1-score of 95.35% exceeds the previous benchmark of 94.9% reported by [5], thanks to the integration of cross-validation and the SMOTE oversampling method [4].

- **Nf-Bot-IoT:** Our GNN-based attack detection model achieves **92.5%**, out-performing the other work by **10.5%**.

- **Grasec-IoT:** We achieve **96.14%**, with no prior results available for comparison.

<table><caption>**Table 5.** Comparative table with the F1-score metric</caption><thead><tr><th rowspan="2">Works</th><th colspan="3">Binary Classification</th><th colspan="3">Multi-class classification</th></tr><tr><th>Ton-IoT</th><th>Nf-Bot-IoT</th><th>Grasec-IoT</th><th>Ton-IoT</th><th>Nf-Bot-IoT</th><th>Grasec-IoT</th></tr></thead><tbody><tr><td>[15]</td><td>95%</td><td>98%</td><td>-</td><td>61%</td><td>82%</td><td>-</td></tr><tr><td>[10]</td><td>97.78%</td><td>74.70%</td><td>-</td><td>-</td><td>-</td><td>-</td></tr><tr><td>[3] + oversampling</td><td>90.09%(DNN)</td><td>-</td><td>-</td><td>98.57% (CNN)</td><td>-</td><td>-</td></tr><tr><td>[5]</td><td>98.70%</td><td>-</td><td>-</td><td>94.9%</td><td>-</td><td>-</td></tr><tr><td>[12]</td><td>98.91%</td><td>97%</td><td>-</td><td>87%</td><td>81%</td><td>-</td></tr><tr><td>Our study</td><td>99.08%</td><td>99.04%</td><td>98.76%</td><td>95.35%</td><td>92.5%</td><td>96.14%</td></tr></tbody></table>

Our work advances the state of the art in several key aspects. Unlike traditional methods, our graph construction uses a generalized modeling approach that is independent of IP addresses, making it adaptable to diverse network environments. For the model architecture, we combine GraphSAGE (for neighborhood aggregation), GAT (for attention-based node relationships), and an MLP (for final classification), enhancing feature learning. Additionally, we introduce novel structural embeddings that capture topological patterns and dynamic behaviors, significantly improving attack detection accuracy. We also contribute new IoT datasets, addressing the lack of realistic benchmarks in this domain. Experiments show that our model maintains consistent performance across different datasets and outperforms existing methods, proving its robustness in detecting sophisticated attacks.
# 6 Conclusion And Future work

In this paper, we explored the increasing connectivity challenges in IoT networks, highlighting their vulnerabilities to cyber-threats and attacks. To address these security challenges, we leverage Graph Neural Networks for attack detection, utilizing benchmark datasets to enable both binary and multi-class classification of attacks. We also elaborated a comprehensive review of traditional attack detection methods, including classical machine learning and deep learning techniques, where we identified key limitations such as difficulties in handling multi-class attacks, data imbalance, and lack of graph-based insights. We proposed a novel GNN-based neural architecture and graph construction technique for attack detection. Through extensive experimentation, we evaluated the performance of our GNN-based models against traditional models and demonstrate their outperformance in both binary and multi-class classifications. The experimental results underscore the potential of GNNs in enhancing cybersecurity by capturing intricate network relationships and attack patterns, making them a promising direction for future IoT and CPS security solutions. Future work will focus on investigating alternative embedding techniques for node representation to further improve classification performance. Moreover, we plan to expand our datasets by incorporating a diverse range of industrial and IoT protocols, thereby facilitating a more comprehensive analysis of network behavior. Finally, we will optimize the temporal window size to achieve a trade-off between rapid detection (small windows) and contextual awareness (large windows), ensuring both responsiveness to immediate attacks and comprehensive attack pattern analysis.

**Acknowledgments.** This work is supported by the French National Research Agency (ANR) as part of the GNADIS project ANR-23-IAS4-0002. The authors would like to express their sincere gratitude to their supervisors and the entire research team for their valuable guidance, support, and collaboration throughout this project.

**Disclosure of Interests.** The authors declare that they have no known competing financial interests or personal relationships that could have appeared to influence the work reported in this paper.

# References

1. Yi, Tao, Xingshu Chen, Yi Zhu, Weijing Ge, and Zhenhui Han. "Review on the application of deep learning in network attack detection." Journal of Network and Computer Applications 212 (2023): 103580.

2. Tan Ying, Steve Goddard, and Lance C. Pérez. "A prototype architecture for cyber-physical systems." ACM Sigbed Review 5, no. 1 (2008): 1-2.

3. Cao Zhong, Zhicai Zhao, Wenli Shang, Shan Ai, and Shen Shen. "Using the TON-IoT dataset to develop a new intrusion detection system for industrial IoT devices." Multimedia Tools and Applications (2024): 1-29.

4. Chawla Nitesh V., Kevin W. Bowyer, Lawrence O. Hall, and W. Philip Kegelmeyer. "SMOTE: synthetic minority over-sampling technique." Journal of artificial intelligence research 16 (2002): 321-357.
5. Gad Abdallah R., Mohamed Haggag, Ahmed A. Nashat, and Tamer M. Barakat. "A distributed intrusion detection system using machine learning for IoT based on ToN-IoT dataset." International Journal of Advanced Computer Science and Applications 13, no. 6 (2022).

6. Grover Aditya, and Jure Leskovec. "node2vec: Scalable feature learning for networks." In Proceedings of the 22nd ACM SIGKDD international conference on Knowledge discovery and data mining, pp. 855-864. 2016.

7. Hamilton Will, Zhitao Ying, and Jure Leskovec. "Inductive representation learning on large graphs." Advances in neural information processing systems 30 (2017).

8. Hamouche Djameleddine, Reda Kadri, Mohamed-Lamine Messai, and Hamida Seba. "(POSTER) A Graph Dataset for Security Enforcement in IoT Networks: GRASEC-IoT." In 2024 20th International Conference on Distributed Computing in Smart Systems and the Internet of Things (DCOSS-IoT), pp. 765-767. IEEE, 2024.

9. Koroniotis Nickolaos, Nour Moustafa, Elena Sitnikova, and Benjamin Turnbull. "Towards the development of realistic botnet dataset in the internet of things for network forensic analytics: Bot-IoT dataset." Future Generation Computer Systems 100 (2019): 779-796.

10. Li Hongwei, and Danai Chasaki. "Heterogeneous GNN with Express Edges for Intrusion Detection in Cyber-Physical Systems." In 2024 International Conference on Computing, Networking and Communications (ICNC), pp. 523-529. IEEE, 2024.

11. Liu Zhong, Dong-sheng Yang, Ding Wen, Wei-ming Zhang, and Wenji Mao. "Cyber-physical-social systems for command and control." IEEE Intelligent Systems 26, no. 4 (2011): 92-96.

12. Lo Wai Weng, Siamak Layeghy, Mohanad Sarhan, Marcus Gallagher, and Marius Portmann. "E-graphsage: A graph neural network based intrusion detection system for iot." In NOMS 2022-2022 IEEE/IFIP Network Operations and Management Symposium, pp. 1-9. IEEE, 2022.

13. Nour Moustafa. A new distributed architecture for evaluating AI-based security systems at the edge: Network TON-IoT datasets. In: Sustainable Cities and Society 72 (2021),p. 102994.

14. Paudel Ramesh, Timothy Muncy, and William Eberle. "Detecting dos attack in smart home IoT devices using a graph-based approach." In 2019 IEEE international conference on big data (big data), pp. 5249-5258. IEEE, 2019.

15. Bassam Noori Shaker, Bahaa Qasim Al-Musawi, and Mohammed Falih Hassan. A Comparative Study of IDS-Based Deep Learning Models for IoT Network. Paper presented at the: Proceedings of the 2023 International Conference on Advances in Artificial Intelligence and Applications. 2023, pp. 15-21.

16. Md Shariar Sozol, Golam Mostafa Saki, and Md Mostafizur Rahman. Anomaly Detection in Cybersecurity with Graph-Based Approaches. In:International Journal of Scientific Research in Engineering and Management (IJSREM) 8.8 (2024), pp. 1-7.

17. Srivastava Nitish, Geoffrey Hinton, Alex Krizhevsky, Ilya Sutskever, and Ruslan Salakhutdinov. "Dropout: a simple way to prevent neural networks from overfitting." The journal of machine learning research 15, no. 1 (2014): 1929-1958.

18. Veličković Petar, Guillem Cucurull, Arantxa Casanova, Adriana Romero, Pietro Lio, and Yoshua Bengio. "Graph attention networks." arXiv preprint arXiv:1710.10903 (2017).

19. Badr Youakim. "Enabling intrusion detection systems with dueling double deep Q-learning." Digital Transformation and Society 1, no. 1 (2022): 115-141.

20. Pacheco Jesus, Xiaoyang Zhu, Youakim Badr, and Salim Hariri. "Enabling risk management for smart infrastructures with an anomaly behavior analysis intrusion
detection system." In 2017 IEEE 2nd International Workshops on Foundations and Applications of Self* Systems (FAS* W), pp. 324-328. IEEE, 2017.

21. Bala Ritu, and Ritu Nagpal. "A review on kdd cup99 and nsl nsl-kdd dataset." International Journal of Advanced Research in Computer Science 10, no. 2 (2019).

22. Pujol-Perich David, José Suárez-Varela, Albert Cabellos-Aparicio, and Pere Barlet-Ros. "Unveiling the potential of graph neural networks for robust intrusion detection." ACM SIGMETRICS Performance Evaluation Review 49, no. 4 (2022): 111-117.