Pith. sign in

REVIEW 4 major objections 6 minor 51 references

An edge-first GraphSAGE model with selective kernels, gated fusion and KAN classifiers beats prior GNN intrusion detectors on four IoT NetFlow benchmarks.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · grok-4.5

2026-07-12 05:39 UTC pith:5PW6AZF2

load-bearing objection Solid empirical GNN+KAN assembly for IoT NetFlow IDS that beats the usual graph baselines; useful incremental work, not a foundational advance. the 4 major comments →

arxiv 2607.02981 v1 pith:5PW6AZF2 submitted 2026-07-03 cs.CR cs.AI

Enhanced Feature Extraction for IoT Network Intrusion Detection Using GNNs and KAN

Long Zhao , Shixun Ji , Bin Cheng , Bin He This is my paper
classification cs.CR cs.AI
keywords graph neural networksKolmogorov-Arnold Networksnetwork intrusion detectionInternet of Thingsselective kernel attentionedge embeddingsNetFlowGraphSAGE
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

IoT networks are sparse, heterogeneous and constantly changing, so ordinary graph neural nets either ignore the edges that actually carry the traffic or fail to adapt when traffic scales and attack patterns shift. The authors claim that three targeted changes fix this: multi-scale selective-kernel attention that re-weights edge messages of different receptive fields, a gated fusion step that builds richer edge embeddings from neighbouring nodes, and a Kolmogorov-Arnold Network that replaces a plain MLP as the final classifier. On four recent NetFlow IoT datasets the resulting SKGFusionKAN model improves weighted F1 over strong GNN baselines in both binary and multiclass settings, with the clearest gains on harder multi-attack problems. A sympathetic reader cares because the method is inductive, edge-centric and explicitly designed for the topology and class-imbalance realities of IoT traffic, so it can be dropped onto new devices without full retraining.

Core claim

SKGFusionKAN, an edge-oriented three-stage pipeline that augments GraphSAGE with multi-scale selective-kernel attention, gated node-to-edge fusion and a KAN classifier, consistently outperforms representative GNN intrusion-detection baselines on four NetFlow IoT benchmarks for both binary and multiclass attack recognition.

What carries the argument

SKGFusionKAN: selective-kernel attention re-weights multi-scale edge messages inside GraphSAGE aggregation; a subsequent gated fusion produces the final edge embedding; a Kolmogorov-Arnold Network then maps that embedding to class probabilities.

Load-bearing premise

That building completely separate train and test graphs after a chronological or session-level split, together with constant node features and IP remapping, removes label leakage and still reflects real IoT topology drift.

What would settle it

Re-run the same four-dataset protocol with a purely random edge split that allows topological leakage between train and test; if SKGFusionKAN’s multiclass F1 advantage over E-GraphSAGE and Anomal-E disappears, the central claim fails.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

  • Edge-centric NIDS can treat flows as first-class citizens rather than node attributes, improving detection of low-frequency IoT attacks.
  • Selective-kernel attention supplies a practical multi-scale mechanism for heterogeneous traffic without hand-tuned receptive fields.
  • KAN classifiers can replace MLPs at the decision stage of GNN pipelines when nonlinear, imbalanced boundaries dominate.
  • Inductive GraphSAGE-style backbones remain usable on continuously evolving IoT topologies without full retraining.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The same selective-kernel + gated-fusion stack could be swapped into other edge-labelled graph tasks such as fraud detection or industrial control-system monitoring.
  • If class-weighted loss is insufficient for the rarest attacks, few-shot or cost-sensitive graph losses become the natural next architectural layer.
  • A deployment study measuring latency and memory on actual edge devices would test whether the O(E D^{2}) complexity is acceptable for resource-constrained IoT gateways.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The manuscript proposes SKGFusionKAN, an edge-oriented GNN pipeline for IoT NetFlow intrusion detection. It extends GraphSAGE with multi-scale selective-kernel attention (SKAtten) for adaptive aggregation of edge-derived neighborhood information, adds a gated fusion module that produces refined edge embeddings from adjacent node representations, and replaces a conventional MLP head with a Kolmogorov–Arnold Network (KAN) classifier. The method is evaluated on four public NetFlow IoT benchmarks (NF-BoT-IoT, NF-ToN-IoT and their v2 variants) for both binary and multiclass tasks, with ablations of SKAtten, gated fusion and KAN, and is compared against GAT, E-GraphSAGE, Anomal-E and SCENE. The authors report consistent gains in weighted precision/recall/F1, release code, and discuss inductive learning and efficiency limitations.

Significance. If the reported gains hold under stricter multi-seed and leakage-controlled evaluation, the work supplies a concrete, reproducible architectural recipe (edge-centric SKGraphSAGE + gated fusion + KAN) that improves over several recent GNN-based NIDS baselines on standard IoT NetFlow corpora. Strengths include public code and preprocessing scripts, explicit ablations isolating each component (Table VI), a clear three-stage pipeline (Algorithm 1, Fig. 1), and an honest discussion of rare-class failures and the absence of system-level latency measurements. The contribution is incremental rather than foundational, but it is a useful empirical demonstration of combining selective-kernel attention and KAN for edge-centric IoT intrusion detection.

major comments (4)
  1. §IV (Experimental Results) and Tables II–III: Binary F1 scores sit near saturation (e.g., 99.96 % on NF-BoT-IoT-v2) and absolute gaps versus E-GraphSAGE/Anomal-E are often <0.5 points; multiclass gains are clearer but still modest on NF-ToN-IoT (F1 62.30 vs. 61.38). No standard deviations, multiple random seeds, or statistical significance tests are reported. For a claim of “consistent outperformance,” at least mean±std over several seeds (or a paired test) is needed so that small numerical differences can be interpreted reliably.
  2. §III-A and §IV (data-split paragraph): The authors state that the train/test split is applied “chronologically or strictly at the session level prior to graph construction” and that two disjoint graphs are built. The manuscript never specifies which of the four datasets actually use chronological versus session-level splitting, nor how session boundaries are defined for NetFlow records. Because residual IP/port leakage is a known risk in graph NIDS, a short protocol table (split type per dataset, number of nodes/edges in train vs. test graphs, confirmation that no IP appears in both) is load-bearing for the inductive claim.
  3. Tables IV–V and the multiclass discussion: Several rare classes (MitM, ransomware, scanning, XSS on NF-ToN-IoT) remain near-random (F1 <15 %). The paper correctly attributes this to imbalance and feature overlap, yet the central claim that KAN supplies “superior nonlinear modeling … essential for detecting intricate, low-frequency attacks” is only weakly supported by the ablation (w/o KAN drops F1 by ~0.9 points on NF-ToN-IoT). Either a cost-sensitive or few-shot experiment, or a tempered claim that restricts the KAN benefit to the weighted aggregate, is required.
  4. §IV-B Baselines: Comparison is limited to four GNN-style methods. The authors acknowledge that tree-based and Transformer IDS baselines are left for future work. Given that the datasets are the standard NF-IoT corpora on which XGBoost/RF often remain competitive, at least one strong non-GNN baseline (or a citation of published numbers under the same feature set) is needed to substantiate the broader claim of “state-of-the-art” performance for IoT NIDS.
minor comments (6)
  1. Eq. (2) uses ⊙ for what appears to be a linear transformation after concatenation; standard GraphSAGE notation uses matrix multiplication. Clarify whether W^k is applied element-wise or as a dense layer.
  2. Fig. 3 caption mentions “depth-2 convolutions and full neighborhood sampling,” but the text never states whether sampling is full or neighborhood-sampled; reconcile.
  3. Table I(b) formatting of the NF-ToN-IoT row is cramped (class counts run together); improve readability.
  4. §III-D complexity analysis O(E·D²+N·D²) is stated but never compared with measured wall-clock time or memory of the released code; a short runtime table would strengthen the efficiency discussion already flagged as future work.
  5. Minor typos: “MULTCLASS” in Table III header; “improve the ability of model” (§III-C); inconsistent hyphenation of “multi-scale”/“multiscale”.
  6. References [18] and [20] are arXiv preprints of KAN; if a peer-reviewed version now exists, cite it.

Circularity Check

0 steps flagged

No circularity: purely empirical architecture + held-out evaluation; no derivation reduces a claimed result to its own inputs by construction.

full rationale

SKGFusionKAN is an engineering composition (GraphSAGE + selective-kernel attention from SKNet + gated fusion + KAN classifier) whose central claim is empirical outperformance on four public NetFlow IoT NIDS benchmarks under a chronological/session-level train/test split performed before graph construction. Equations (1)–(10) and Algorithm 1 define the forward pass; they do not encode any target metric as a free parameter that is later “predicted.” Ablations and baselines are run on the same held-out graphs; performance numbers are therefore not forced by construction or by a self-citation uniqueness theorem. External components (GraphSAGE, SKNet, KAN) are cited from independent literature and used as standard building blocks, not as load-bearing self-justifications. The paper is therefore free of the six circularity patterns; any residual concerns (leakage risk, rare-class weakness, binary saturation) are ordinary experimental limitations, not circular reductions.

Axiom & Free-Parameter Ledger

6 free parameters · 4 axioms · 3 invented entities

The central empirical claim rests on a handful of architectural and training choices that are free parameters, on standard graph-construction assumptions for NetFlow, and on three invented modules that have no independent existence outside this paper.

free parameters (6)
  • SKGraphSAGE depth K = 2
    Empirically fixed at 2 to balance capacity and over-smoothing; not derived.
  • hidden dimension = 128
    Chosen as 128 as a practical trade-off; free design choice.
  • number of B-spline basis functions in KAN = 10
    Set to 10 for nonlinear flexibility; free hyper-parameter.
  • learning rate / optimizer = 0.001
    Adam 0.001 selected as a “stable standard setting.”
  • training epochs per dataset = 300/500
    300 or 500 epochs chosen for convergence; free.
  • class-weighting scheme for Cross-Entropy = inverse frequency
    Inverse-frequency weights used to combat imbalance; design choice that directly affects minority-class metrics.
axioms (4)
  • domain assumption NetFlow 5-tuple (src/dst IP+port) plus remaining fields can be faithfully mapped to a static undirected graph with constant node features and edge attributes without destroying attack semantics.
    Stated in §III-A and Fig. 2; foundational for every subsequent GNN layer.
  • domain assumption A chronological or session-level train/test split performed before graph construction yields two completely disjoint graphs and eliminates topological leakage.
    Explicitly claimed in §IV; if violated the reported inductive gains are inflated.
  • ad hoc to paper Selective-kernel attention (multi-scale convolutions + Softmax weighting) is a valid inductive bias for heterogeneous IoT edge features.
    Imported from SKNet vision literature and asserted without theoretical justification for network traffic (§III-B).
  • ad hoc to paper Kolmogorov–Arnold Networks with B-splines provide superior nonlinear modeling for low-frequency IoT attacks compared with an MLP of matched capacity.
    Claimed in §III-D and supported only by the ablation; treated as given for the final classifier.
invented entities (3)
  • SKGraphSAGE no independent evidence
    purpose: GraphSAGE backbone augmented with selective-kernel attention over edge features for multi-scale aggregation.
    Defined in §III-B and Algorithm 1; no prior independent existence.
  • gated fusion module for edge embeddings no independent evidence
    purpose: Post-aggregation refinement that produces a single edge representation from the two endpoint node embeddings via a learned sigmoid gate.
    Introduced in §III-C; distinct from the earlier attention step.
  • SKGFusionKAN no independent evidence
    purpose: End-to-end three-stage pipeline that feeds the gated edge embeddings into a KAN classifier for binary/multiclass NIDS.
    The overall model name and contribution of the paper; exists only here.

pith-pipeline@v1.1.0-grok45 · 25888 in / 3254 out tokens · 30872 ms · 2026-07-12T05:39:13.356790+00:00 · methodology

0 comments
read the original abstract

Recent advancements in the Internet of Things (IoT) emphasize the urgent need for advanced network security, as IoT networks feature dynamic topologies, imbalanced traffic, and complex attack patterns. Unlike general IT networks, IoT environments exhibit extreme heterogeneity and sparse topologies. Traditional GNN-based intrusion detection methods often struggle to efficiently model node and edge features or capture fine-grained anomalies in such settings. To address this, we propose SKGFusionKAN, a novel IoT-tailored approach enhancing GraphSAGE with a multi-scale selective kernel attention mechanism. This enables adaptive extraction of node and edge features under diverse traffic conditions. Specifically, our edge-oriented message passing strengthens information propagation, while selective kernel attention adaptively weights edge-derived information from different scales to handle heterogeneity. We also introduce a gated fusion process to dynamically integrate multi-scale features, improving robustness against evolving attacks. Finally, we leverage Kolmogorov-Arnold Networks (KAN) for classification, offering superior nonlinear modeling capabilities essential for detecting intricate, low-frequency attacks. To our knowledge, this work presents a comprehensive integration of GNNs and KAN with dedicated architectural innovations for IoT intrusion detection. Extensive experiments on four NIDS benchmarks show that SKGFusionKAN consistently outperforms state-of-the-art approaches in binary and multiclass tasks, demonstrating its potential for IoT security.

Figures

Figures reproduced from arXiv: 2607.02981 by Bin Cheng, Bin He, Long Zhao, Shixun Ji.

Figure 1
Figure 1. Figure 1: Overview of the architecture for the proposed SKGFusionKAN model. [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Transforming NetFlow data into graph-based structures. [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: A graph is shown on the left, while the right displays the SKGraph [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: Performance comparison of SKGFusionKAN and baseline methods. [PITH_FULL_IMAGE:figures/full_fig_p011_4.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

51 extracted references · 5 linked inside Pith

  1. [1]

    Explainable artificial intelligence for intrusion detection in IoT networks: A deep learning based approach,

    B. Sharma, L. Sharma, C. Lal, and S. Roy, “Explainable artificial intelligence for intrusion detection in IoT networks: A deep learning based approach,”Expert Syst. Appl., vol. 238, p. 121751, 2024

    2024

  2. [2]

    Deep learning enabled intrusion detec- tion system for industrial IoT environment,

    H. Nandanwar and R. Katarya, “Deep learning enabled intrusion detec- tion system for industrial IoT environment,”Expert Syst. Appl., vol. 249, p. 123808, 2024

    2024

  3. [3]

    Real- time collaborative intrusion detection system in uav networks using deep learning,

    H. Jalil Hadi, Y . Cao, S. Li, Y . Hu, J. Wang, and S. Wang, “Real- time collaborative intrusion detection system in uav networks using deep learning,”IEEE Internet of Things Journal, vol. 11, no. 20, pp. 33 371– 33 391, 2024

    2024

  4. [4]

    Detecting zero-day attack with federated learning using autonomously extracted anomalies in IoT,

    T. Ohtani, R. Yamamoto, and S. Ohzahata, “Detecting zero-day attack with federated learning using autonomously extracted anomalies in IoT,” inProc. 2024 IEEE 21st Consum. Commun. Netw. Conf., 2024, pp. 356– 359

    2024

  5. [5]

    Auditable and verifiable federated learning based on blockchain- enabled decentralization,

    A. P. Kalapaaking, I. Khalil, X. Yi, K.-Y . Lam, G.-B. Huang, and N. Wang, “Auditable and verifiable federated learning based on blockchain- enabled decentralization,”IEEE Trans. Neural Netw. Learn. Syst., vol. 36, no. 1, pp. 102–115, 2025

    2025

  6. [6]

    Fully decentralized multiagent commu- nication via causal inference,

    H. Wang, Y . Yu, and Y . Jiang, “Fully decentralized multiagent commu- nication via causal inference,”IEEE Trans. Neural Netw. Learn. Syst., vol. 34, no. 12, pp. 10 193–10 202, 2023

    2023

  7. [7]

    Big-IDS: A decentralized multi agent reinforcement learning approach for distributed intrusion detection in big data networks,

    F. Louati, F. B. Ktata, and I. Amous, “Big-IDS: A decentralized multi agent reinforcement learning approach for distributed intrusion detection in big data networks,”Cluster Comput., vol. 27, no. 5, pp. 6823–6841, 2024

    2024

  8. [8]

    Modern netflow network dataset with labeled attacks and detection methods,

    M. Komisarek, M. Pawlicki, T. Simic, D. Kavcnik, R. Kozik, and M. Chora ´s, “Modern netflow network dataset with labeled attacks and detection methods,” inProc. 18th Int. Conf. Availability Rel. Security, 2023, pp. 1–8

    2023

  9. [9]

    Iotforge pro: A security testbed for generating intrusion dataset for industrial iot,

    P. Kumar, S. Mullick, R. Das, A. Nandi, and I. Banerjee, “Iotforge pro: A security testbed for generating intrusion dataset for industrial iot,” IEEE Internet of Things Journal, vol. 12, no. 7, pp. 8453–8460, 2025

    2025

  10. [10]

    Ma- chine learning-based network intrusion detection optimization for cloud computing environments,

    J. Kumar Samriya, S. Kumar, M. Kumar, H. Wu, and S. Singh Gill, “Ma- chine learning-based network intrusion detection optimization for cloud computing environments,”IEEE Trans. Consum. Electron., vol. 70, no. 4, pp. 7449–7460, 2024

    2024

  11. [11]

    Feature engineering in machine learning-based intrusion detection systems for ot networks,

    A. Howe and M. Papa, “Feature engineering in machine learning-based intrusion detection systems for ot networks,” inProc. 2023 IEEE Int. Conf. Smart Comput., 2023, pp. 361–366

    2023

  12. [12]

    A taxonomy of machine-learning-based intrusion detection systems for the internet of things: A survey,

    A. Jamalipour and S. Murali, “A taxonomy of machine-learning-based intrusion detection systems for the internet of things: A survey,”IEEE Internet of Things Journal, vol. 9, no. 12, pp. 9444–9466, 2022

    2022

  13. [13]

    A robust deep learning-based approach for network traffic classification using CNNs and RNNs,

    A. Jenefa, S. Sam, V . Nair, B. G. Thomas, A. S. George, R. Thomas, and A. D. Sunil, “A robust deep learning-based approach for network traffic classification using CNNs and RNNs,” inProc. 2023 4th Int. Conf. Signal Process. Commun., 2023, pp. 106–110

    2023

  14. [14]

    Hybrid-cnn intrusion detection framework for can networks in connected and autonomous vehicles,

    O. Agbo, M. Hefeida, and A. S. El-Wakeel, “Hybrid-cnn intrusion detection framework for can networks in connected and autonomous vehicles,”IEEE Internet of Things Journal, vol. 12, no. 17, pp. 36 353– 36 369, 2025

    2025

  15. [15]

    EE-GCN: A graph convolutional network based intrusion detection method for IIoT,

    P. Xu, G. Lu, Y . Li, and C. Xu, “EE-GCN: A graph convolutional network based intrusion detection method for IIoT,” inProc. 2023 5th Int. Conf. Nat. Lang. Process., 2023, pp. 338–344

    2023

  16. [16]

    A comprehensive survey on graph neural networks,

    Z. Wu, S. Pan, F. Chen, G. Long, C. Zhang, and P. S. Yu, “A comprehensive survey on graph neural networks,”IEEE Trans. Neural Netw. Learn. Syst., vol. 32, no. 1, pp. 4–24, 2021

    2021

  17. [17]

    Network intrusion detec- tion with edge-directed graph multi-head attention networks,

    X. Li, J. Zhang, Y . Yuan, and C. Zhou, “Network intrusion detec- tion with edge-directed graph multi-head attention networks,” 2023, arXiv:2310.17348

    Pith/arXiv arXiv 2023

  18. [18]

    Kan: Kolmogorov-arnold networks,

    Z. Liu, Y . Wang, S. Vaidya, F. Ruehle, J. Halverson, M. Solja ˇci´c, T. Y . Hou, and M. Tegmark, “Kan: Kolmogorov-arnold networks,” 2024, arXiv:2404.19756

    Pith/arXiv arXiv 2024

  19. [19]

    Selective kernel networks,

    X. Li, W. Wang, X. Hu, and J. Yang, “Selective kernel networks,” in Proc. IEEE/CVF Conf. Comput. Vis. Pattern Recognit., 2019, pp. 510– 519

    2019

  20. [20]

    Activation Space Selectable Kolmogorov-Arnold Networks,

    Z. Yang, J. Zhang, X. Luo, Z. Lu, and L. Shen, “Activation Space Selectable Kolmogorov-Arnold Networks,” 2024,arXiv:2408.08338

    Pith/arXiv arXiv 2024

  21. [21]

    A com- pendium on network and host based intrusion detection systems,

    K. Rahul-Vigneswaran, P. Poornachandran, and K. P. Soman, “A com- pendium on network and host based intrusion detection systems,” in Proc. 1st Int. Conf. Data Sci., Mach. Learn. Appl., 2020, pp. 23–30

    2020

  22. [22]

    A novel wrapped feature selection framework for developing power system intrusion detection based on machine learning methods,

    Y . Han, Y . Wang, Y . Cao, Z. Geng, and Q. Zhu, “A novel wrapped feature selection framework for developing power system intrusion detection based on machine learning methods,”IEEE Trans. Syst., Man, Cybern.: Syst., vol. 53, no. 11, pp. 7066–7076, 2023

    2023

  23. [23]

    An effective intrusion detection approach using SVM with na ¨ıve bayes feature embedding,

    J. Gu and S. Lu, “An effective intrusion detection approach using SVM with na ¨ıve bayes feature embedding,”Comput. Secur., vol. 103, p. 102158, 2021

    2021

  24. [24]

    A naive bayesian network intrusion detection algorithm based on principal component analysis,

    X. Han, L. Xu, M. Ren, and W. Gu, “A naive bayesian network intrusion detection algorithm based on principal component analysis,” inProc. 7th Int. Conf. Inf. Technol. Med. Educ. (ITME), 2015, pp. 325–328

    2015

  25. [25]

    A survey of random forest based methods for intrusion detection systems,

    P. A. A. Resende and A. C. Drummond, “A survey of random forest based methods for intrusion detection systems,”ACMComput. Surveys, vol. 51, no. 3, pp. 1–36, 2018

    2018

  26. [26]

    Per- formance evaluation of learning models for intrusion detection system using feature selection,

    B. Kaushik, R. Sharma, K. Dhama, A. Chadha, and S. Sharma, “Per- formance evaluation of learning models for intrusion detection system using feature selection,”J. Comput. Virol. Hack. Tech., vol. 19, no. 4, pp. 529–548, 2023

    2023

  27. [27]

    A comprehensive intrusion detection framework using boosting algorithms,

    I. F. Kilincer, F. Ertam, and A. Sengur, “A comprehensive intrusion detection framework using boosting algorithms,”Comput. Electr. Eng., vol. 100, p. 107869, 2022. 14

    2022

  28. [28]

    Machine learning and deep learning,

    C. Janiesch, P. Zschech, and K. Heinrich, “Machine learning and deep learning,”Electronic Markets, vol. 31, no. 3, pp. 685–695, 2021

    2021

  29. [29]

    CapsRule: Explainable deep learning for classifying network attacks,

    S. Mahdavifar and A. A. Ghorbani, “CapsRule: Explainable deep learning for classifying network attacks,”IEEE Trans. Neural Netw. Learn. Syst., vol. 35, no. 9, pp. 12 434–12 448, 2024

    2024

  30. [30]

    CNN-based network intrusion detection against denial-of-service attacks,

    J. Kim, J. Kim, H. Kim, M. Shim, and E. Choi, “CNN-based network intrusion detection against denial-of-service attacks,”Electronics, vol. 9, no. 6, p. 916, 2020

    2020

  31. [31]

    Network intrusion detection based on LSTM and feature embedding,

    H. Gwon, C. Lee, R. Keum, and H. Choi, “Network intrusion detection based on LSTM and feature embedding,” 2019,arXiv:1911.11552

    Pith/arXiv arXiv 2019

  32. [32]

    Dygra-edge: A dynamic gradient-regulated attention network for real- time intrusion detection on industrial iot-edge nodes,

    J. Liu, K. He, X. Zong, B. Ning, H. Shi, Y . Sun, D. Pan, and B. Sen, “Dygra-edge: A dynamic gradient-regulated attention network for real- time intrusion detection on industrial iot-edge nodes,”IEEE Internet of Things Journal, vol. 12, no. 24, pp. 55 618–55 629, 2025

    2025

  33. [33]

    Efficient and privacy-preserving network intrusion detection based on federated learning in sdn-enabled iiot network,

    T. Hu, Q. Chen, Y . Hu, S. Hou, H. Yan, P. Yi, and Z. Cui, “Efficient and privacy-preserving network intrusion detection based on federated learning in sdn-enabled iiot network,”IEEE Internet of Things Journal, vol. 12, no. 20, pp. 41 904–41 923, 2025

    2025

  34. [34]

    Adversarial attacks on neural networks for graph data,

    D. Z ¨ugner, A. Akbarnejad, and S. G ¨unnemann, “Adversarial attacks on neural networks for graph data,” inProc. 24th ACM SIGKDD Int. Conf. Knowl. Discov. Data Min., 2018, pp. 2847–2856

    2018

  35. [35]

    Reconstructed graph neural network with knowledge distillation for lightweight anomaly detection,

    X. Zhou, J. Wu, W. Liang, K. I.-K. Wang, Z. Yan, L. T. Yang, and Q. Jin, “Reconstructed graph neural network with knowledge distillation for lightweight anomaly detection,”IEEE Trans. Neural Netw. Learn. Syst., vol. 35, no. 9, pp. 11 817–11 828, 2024

    2024

  36. [36]

    Automating botnet detection with graph neural networks,

    J. Zhou, Z. Xu, A. M. Rush, and M. Yu, “Automating botnet detection with graph neural networks,” 2020,arXiv:2003.06344

    Pith/arXiv arXiv 2020

  37. [37]

    Towards network anomaly detection using graph embedding,

    Q. Xiao, J. Liu, Q. Wang, Z. Jiang, X. Wang, and Y . Yao, “Towards network anomaly detection using graph embedding,” inProc. 20th Int. Conf. Comput. Sci., 2020, pp. 156–169

    2020

  38. [38]

    E- GraphSAGE: A graph neural network based intrusion detection system for IoT,

    W. W. Lo, S. Layeghy, M. Sarhan, M. Gallagher, and M. Portmann, “E- GraphSAGE: A graph neural network based intrusion detection system for IoT,” inProc. NOMS IEEE/IFIP Netw. Oper. Manage. Symp., 2022, pp. 1–9

    2022

  39. [39]

    Graph attention networks,

    P. Veli ˇckovi´c, G. Cucurull, A. Casanova, A. Romero, P. Li `o, and Y . Bengio, “Graph attention networks,” inProc. 6th Int. Conf. Learn. Representations, 2018, pp. 1–12

    2018

  40. [40]

    Anomal-E: A self- supervised network intrusion detection system based on graph neural networks,

    E. Caville, W. W. Lo, S. Layeghy, and M. Portmann, “Anomal-E: A self- supervised network intrusion detection system based on graph neural networks,”Knowl.-Based Syst., vol. 258, p. 110030, 2022

    2022

  41. [41]

    Deep graph infomax,

    P. Veli ˇckovi´c, W. Fedus, W. L. Hamilton, P. Li `o, Y . Bengio, and R. D. Hjelm, “Deep graph infomax,” inProc. Int. Conf. Learn. Representa- tions, 2019, pp. 1–17

    2019

  42. [42]

    Hadga: Hierarchical attention-based dynamic gnn algorithm for iot botnet detection,

    N. Sun, L. Chen, and G. Han, “Hadga: Hierarchical attention-based dynamic gnn algorithm for iot botnet detection,”IEEE Internet of Things Journal, vol. 12, no. 16, pp. 33 520–33 532, 2025

    2025

  43. [43]

    TS-IDS: Traffic-aware self-supervised learning for IoT network intrusion detection,

    H. Nguyen and R. Kashef, “TS-IDS: Traffic-aware self-supervised learning for IoT network intrusion detection,”Knowl.-Based Syst., vol. 279, p. 110966, 2023

    2023

  44. [44]

    Applying self- supervised learning to network intrusion detection for network flows with graph neural network,

    R. Xu, G. Wu, W. Wang, X. Gao, A. He, and Z. Zhang, “Applying self- supervised learning to network intrusion detection for network flows with graph neural network,”Comput. Netw., vol. 248, p. 110495, 2024

    2024

  45. [45]

    Inductive representation learning on large graphs,

    W. Hamilton, Z. Ying, and J. Leskovec, “Inductive representation learning on large graphs,” inProc. 31st Int. Conf. Neural Inf. Process. Syst., 2017, p. 1024–1034

    2017

  46. [46]

    Large selective kernel network for remote sensing object detection,

    Y . Li, Q. Hou, Z. Zheng, M.-M. Cheng, J. Yang, and X. Li, “Large selective kernel network for remote sensing object detection,” inProc. IEEE/CVF Int. Conf. Comput. Vis., 2023, pp. 16 794–16 805

    2023

  47. [47]

    Channel prior convolutional attention for medical image segmentation,

    H. Huang, Z. Chen, Y . Zou, M. Lu, C. Chen, Y . Song, H. Zhang, and F. Yan, “Channel prior convolutional attention for medical image segmentation,”Comput. Biol. Med., vol. 178, p. 108784, 2024

    2024

  48. [48]

    NF-NIDS: Normalizing flows for network intrusion detection systems,

    M. J. Idrissi, H. Alami, A. Bouayad, and I. Berrada, “NF-NIDS: Normalizing flows for network intrusion detection systems,” inProc. 2023 10th Int. Conf. Wirel. Netw. Mob. Commun., 2023, pp. 1–7

    2023

  49. [49]

    Netflow datasets for machine learning-based network intrusion detection sys- tems,

    M. Sarhan, S. Layeghy, N. Moustafa, and M. Portmann, “Netflow datasets for machine learning-based network intrusion detection sys- tems,” inProc. 10th EAI Int. Conf. Big Data Technol. Appl. (BDTA) and 13th EAI Int. Conf. Wirel. Internet, 2021, pp. 117–135

    2021

  50. [50]

    Towards a standard feature set for network intrusion detection system datasets,

    M. Sarhan, S. Layeghy, and M. Portmann, “Towards a standard feature set for network intrusion detection system datasets,”Mob. Netw. Appl., vol. 27, pp. 357–370, 2022

    2022

  51. [51]

    Scene: Reasoning about traffic scenes using heterogeneous graph neural networks,

    T. Monninger, J. Schmidt, J. Rupprecht, D. Raba, J. Jordan, D. Frank, S. Staab, and K. Dietmayer, “Scene: Reasoning about traffic scenes using heterogeneous graph neural networks,”IEEE Robot. Autom. Lett., vol. 8, no. 3, pp. 1531–1538, 2023. Long Zhaois currently pursuing the master’s de- gree in Artificial Intelligence and Automation at the School of Ele...

    2023