## 3 Graph Neural Networks for Next-Generation Networks
### Link Scheduling
#### 3.2.3 Intrusive Detection  
As Industrial IoT (IIoT) networks increasingly permeate diverse sectors like home, industry, healthcare, and agriculture, the application of learning algorithms has become paramount for enhancing communication processes and real-time analytics. Yet, the rapid expansion of IoT devices brings substantial security concerns. The absence of robust security policies and standardization for IIoT networks exposes these systems to a high risk of malicious attacks. In this scenario, GNN emerges as a promising solution for next-generation IoT/IIoT networks. GNN is one of the potential tools for data representation and processing, enabling effective modeling and analysis of complex relationships within access networks. By leveraging GNN capabilities, it becomes possible to bolster real-time analytics and, consequently, improve the management and protection of the network and devices. \begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**Ref.** & **Models** & **Dataset** & **Baselines** & **Prediction Horizon** & **Performance** \\ \hline
[68] & GNN & Unpublished & ARIMA, HW, LSTM & 30 min & MAE: 0.79 \\ \hline
[69] & GNN, RNN, Attention mechanism & Telecom Italia & HA, ARIMA, MLP, LSTM, CNN-LSTM & 10 min & MAE: 30.93 \\ \hline
[71] & GCN, GRU & Unpublished & HA, GCN, Attention GCN, DCRNN, Graph WaveNet & 15 min & MAE: 21.7, RMSE: 47.2 \\ \hline
[72] & Transfer learning, Attention mechanism, CNNs, and GCN & Telecom Italia & LSRM, STGCN, DCRNN & 1 h & MAE: 55.46, RMSE: 116.92 \\ \hline
[73] & GCN, Gated Linear Unit & Unpublished & HW, ARIMA, LSTM & 15 min & RMSE: \(3.91\times 10^{5}\) \\ \hline
[77] & GCN, GRU & Unpublished & ARIMA, LSTM, GNN & 5 s & MAE: \(2.96\times 10^{4}\) \\ \hline
[78] & GNN, GAT & Telecom Italia & GNN, GRU & 10 min & MAE: 25.75, MAPE: 0.13, RMSE: 35.94 \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Summary of application of GNN-based models for traffic prediction. Intrusions are characterized by a sequence of suspicious and benign interactions between networks or processes in a host system. Thus, depending on where the detection takes place, Intrusion Detection Systems (IDS) can be divided into two broad categories, which are network-based intrusions (NIDS) and network host-based intrusions (HIDS) [80]. NIDS consistently monitor and analyze network traffic to detect network attacks. They can effectively detect malicious activities and alert network administrators to take action and mitigate security threats. In this subsection, we focus on the application of GNN to both NIDS and HIDS. However, given our interest in the application of GNN within Next-generation networks, our primary emphasis is on GNN-based strategies for NIDS, as briefly summarized in Table 4.  
As depicted in Figure 5, conventional ML/Deep learning (DL) models typically rely on statistical features from each network flow for training, without considering the topological structure. In contrast, GNNs incorporate topological information along with network flow features, which enables them to model spatial relationships and dependencies between nodes (for example, traffic). This feature becomes particularly beneficial when the network data's structure is complex and non-Euclidean. GNN is capable of handling dynamic topologies where nodes and edges can fluctuate over time. Additionally, GNN can detect subtle patterns in the graph structure data. For instance, GNNs can identify abnormal communication patterns between certain nodes, a capability that outperforms traditional ML/DL models. [PERSON] et al. [81] propose to detect with an End-to-end (E2E) data-driven approach using the GCN model. The experiment results showed that GCN performs better than the logistic regression model. Addressing the potential issue of overfitting with GNN models, [PERSON] et al. [82] introduce an approach termed Inferential SIR-GN.