## 3 Graph Neural Networks for Next-Generation Networks
### Link Scheduling
#### 3.2.3 Intrusive Detection
This system constructs a heterogeneous graph consisting of users, devices, processes, and files. LM detection is redefined as an anomaly link detection task within this heterogeneous graph. The model utilizes meta-paths within the graph to profile each network entity and identify authentication activities that deviate from benign behavior. While a few benign samples are required as input, the model benefits from the use of semi-supervised learning, allowing for more efficient detection of lateral movement. Despite the performance of the abovementioned works, they are based on the supervised GNN model, where labeling data is often difficult and time-consuming. To handle this issue, semi-supervised learning can be used as an alternative solution. It exploits abundant unlabeled data in combination with a small amount of labeled data ([PERSON] et al., 2019). In this, [PERSON] et al. (2019) propose a novel bot detection framework, namely _Bot-AHGCN_. Bot-AHGCN models fine-grained network flow objects into a heterogeneous graph and transforms the bot detection problem into a semi-supervised node classification task on the graph. The node is one flow entity from the 6-tuple (IP_src, IP_dst, port, protocol, request, response), and edges are actions between flow entities such as _access_ or _connect_. The black-box nature of GNN models poses a challenge to both the trust and understanding of the final results. This may raise several questions for the operator, such as the following: On what information do the models base their decisions on when determining whether a node is abnormal? Is the information learned by the model comprehensible? To address these concerns, researchers propose explainable GNN models for botnet detection ([PERSON] et al., 2019; [PERSON] et al., 2020). Specifically, [PERSON] et al. (2020) develop an automated botnet detector and a forensic tool called _XG-BoT_. To overcome the limitations of the GCN regarding the number of layers,  
Figure 5: (**a**) Scheme of Conventional machine learning-based NIDS using network flow. (**b**) Graph-based representation of some known attacks, \(a_{n}\) nodes refer to the attackers, \(v_{n}\) nodes represent the targets, and \(f_{n}\) nodes represent the different flows. XG-BoT integrates group-reversible residual connections with the Graph Isomorphism Network (GIN). To enhance comprehensibility further, it offers explanations via GNNExplainer [93] and saliency maps. GNNExplainer underscores the subgraph structure and node-level features pertinent to the final prediction. Using the dataset proposed in [81], the simulation results demonstrate that XG-BoT achieved state-of-the-art performance in terms of the F1-score. Similarly, [PERSON] et al. [91] propose an interpretive method for GNN-based botnet detection called _BD-GNNExplainer_. This method first employs a GNN model to detect a botnet attack; next, BD-GNNExplainer identifies the most informative edges that are heavily focused on during the training process of the GNN models. Finally, an interpretability score is assigned by comparing the identified edges with the ground truth. The proposed approach aids not only in accurately identifying threats but also in understanding the reasoning behind these identifications. The results show that a model with better classification performance is not necessarily more interpretable.