## 3 Graph Neural Networks for Next-Generation Networks
### Link Scheduling
#### 3.2.3 Intrusive Detection
This technique is designed to generalize unseen data within large graphs while prioritizing node structural similarity, thereby enhancing the robustness of GNNs in intrusion detection scenarios. In another GNN-based NIDS approach, [PERSON] et al. [83] focus on revealing the relationships between flows using a GNN model. They add new nodes to represent each flow GNN model. Specifically, for each flow, there are three nodes: the source host node, the destination host node, and the flow node, and the proposed graph includes heterogeneous elements (i.e., hosts and flows). Subsequently, a message-passing algorithm is proposed to efficiently learn from the host connection graph. The performance of their model was compared with some advanced ML models using the CIC-IDS2017 dataset, showing superior results in terms of the F1 score. Moreover, [PERSON] et al. [84] provide an anomaly detection solution within IoT systems by employing a GNN-based model. \begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Ref.** & **Learning** & **Target** & **Models** & **Dataset** & **Performance** \\ \hline
[81] & Supervised & Node & GCN & - & Acc: 99.51\%, 99.03\% \\ \hline
[82] & Supervised & Node & Inferential SIR-GN & CAIDA + synthetic data & F1: 97.85–99.78\% \\ \hline
[83] & Supervised & Node & GNN, GRU & CIC-IDS2017 & F1: 99\% \\ \hline
[84] & Supervised & Node & Graph network & CTU-13 + synthetic data & ACC: 96\% \\ \hline
[85] & Supervised & Edge & E-GraphSAGE, GraphSAGE & BoT-IoT, ToN-IoT, NF-BoT-IoT, NF-ToN-IoT & F1: 100\%, 99\%, 97\%, 100\% \\ \hline
[86] & Supervised & Node & E-GraphSAGE, GAT & UNSW-NB15, CIC-Darknet2020, ToN-IoT, CSE-CIC-IDS2018 & F1: 99.5\%, 92.32\%, 99.88\%, 96.5\% \\ \hline
[87] & Supervised & Node & GDN, GAT & SWaT, WADI & Acc: 99\%, 98\% \\ \hline
[88] & Semi-supervised & Node & GCN & CTU-13, Honeypot dataset & F1: 98.27\%, 98.22\% \\ \hline
[89] & Semi-supervised & Edge & GNN, Autoencoder, Attention mechanism & LANL2015, CERT, PicoDomain & F1: 89.28\%, 91.28\%, 92.68\% \\ \hline
[90] & Supervised & Node & GIN, GNNExplainer & - & F1: 99.52\%, 99.47\% \\ \hline
[91] & Supervised & Node & DB-GNNExplainer & - & F1: 99.14\% \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Summary of application of GNN-based models for IDS. They propose a multi-agent system based on GNN, where each agent is implemented using a GNN that can learn the representation of physical networks. Such an approach helps to explore the collaboration of intelligent agents to efficiently detect the intrusion. [PERSON] et al. (2018) also use the GNN for IoT network intrusion detection, called _E-GraphSAGE_. E-GraphSAGE enables the collection of information on flow-based features and topological patterns to learn the patterns of network flows and hence to support the detection of malicious edges. Using four benchmark datasets, the simulation results show that the E-GraphSAGE performs better than ML-based classifiers such as XGBoost. Similarly, [PERSON] and [PERSON] (2018) extend E-GraphSAGE by proposing an edge-based residual graph attention network (E-ResGAT). E-ResGAT uses an attention mechanism supporting edge features and embedding residual learning to enhance malicious traffic detection. The obtained results show that E-ResGAT outperforms the original model E-GraphSAGE. In the same direction, [PERSON] and [PERSON] (2018) propose a structure learning approach in combination with GNN and use an attention mechanism called _GDN_. The novelty of their approach lies in using a distance metric to discern the relationships between nodes, primarily by selecting the top-K closest ones as the neighbor dependencies. Subsequently, a graph attention convolution is utilized to encapsulate the process of information propagation. Experiments on two real-world sensor datasets show that GDN can handle high-dimensional time-series data and outperform baseline models. In addition, [PERSON] and [PERSON] (2019) introduce a lateral movement (LM) detection system called _HetGLM_.