REAL-IoT: Characterizing GNN Intrusion Detection Robustness under Practical Adversarial Attack

Hamed Haddadi; Huichi Zhou; Zhonghao Zhan

REVIEW 4 major objections 5 minor 68 references

REAL-IoT: Characterizing GNN Intrusion Detection Robustness under Practical Adversarial Attack

T0 review · 4 major / 5 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This paper claims that GNN-based network intrusion detection systems are less robust than standard benchmarks suggest, and that REAL-IoT's unified datasets, physical testbed, and LLM-based filtering quantify and partly close the gap.

desk verdict The real story: solid new artifacts, but the headline finding about performance drops is currently unsupported because Anomal-E's clean-set F1 disagrees by 0.8 between two tables. read the letter →

arxiv 2507.10836 v1 pith:RCLY36OS submitted 2025-07-14 cs.CR

Zhonghao Zhan , Huichi Zhou , Hamed Haddadi This is my paper

classification cs.CR

keywords GNN-basedNIDSadversarialrobustnessdistributiondriftIoTsecurityNetFlowstandardizationLLM-basedfilteringintrusiondetectionbenchmarking

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Graph neural networks (GNNs) are increasingly used for network intrusion detection, but their evaluations typically rely on a single dataset and synthetic attacks. This paper argues that such evaluations overstate real-world resilience and introduces REAL-IoT, a framework that standardizes several NetFlow intrusion datasets into one unified benchmark, adds a new dataset collected from a physical IoT testbed under real DoS and scanning attacks, and applies a fixed evaluation protocol covering distribution drift, adversarial attacks, and LLM-based filtering. Across three published GNN models, the paper reports performance drops under the unified and standardized conditions compared with the numbers originally reported by each model. It also shows that LLM-based filtering can partially restore robustness, provided the LLM's precision is high. The central point is that realistic threat modeling and standardized measurement are necessary before GNN-based detectors can be trusted in deployment.

What carries the argument

The load-bearing machinery is the REAL-IoT measurement pipeline: a standardization layer that maps heterogeneous NetFlow datasets to a common feature schema (identifier alignment, protocol mapping, label unification, and Z-score scaling computed only on training data), adaptive stratified sampling that preserves rare attack classes, and a uniform IP-centric graph construction in which each flow becomes a directed edge whose features are the standardized flow attributes. This pipeline makes cross-dataset and cross-model comparisons possible. The second component is the evaluation engine's four-step protocol covering baseline performance, distribution drift, synthetic attacks, and LLM mitigation. The third component is the LLM-based node analyzer, which assigns a confidence score to each node's anomaly status so that flagged nodes and their incident edges can be pruned before the GNN sees the graph.

What would settle it

Re-run each of the three GNN models on the same standardized and unified datasets while reproducing each model's original feature preprocessing and graph construction; if the original reported scores reappear, the drop is an artifact of the re-standardization rather than a property of the models.

Watch

Extended reading notes

Core claim

On REAL-IoT's standardized datasets, Anomal-E's F1 falls to 0.641 on NF-BoT-IoT v2 versus 0.924 reported on its original evaluation, E-GraphSAGE drops to 0.640 accuracy on NF-CSE-CIC-IDS2018 v2 and 0.675 on the unified dataset, and CAGN-GAT Fusion falls to an F1 of 0.182 on standardized NF-UNSW-NB15 v2. Under synthetic attacks, white-box PGD degrades all three models substantially, node injection causes consistent scaled degradation, and edge removal leaves performance nearly unchanged. On the new testbed dataset of 4,161 NetFlow records with labeled DoS and port-scan attacks, E-GraphSAGE and CAGN-GAT Fusion retain high recall with moderate F1 loss, which the paper interprets as realistic drift. The paper also finds that some LLMs, used to flag suspicious nodes and prune them from the graph, improve downstream GNN F1, while others with high recall but low precision hurt it.

Load-bearing premise

The headline performance drops assume that the scores a model's original paper reported on its own preprocessing and data split are directly comparable to scores this paper obtains under REAL-IoT's different standardization, graph construction, and train/test split.

Editorial extensions

If this is right

Single-dataset evaluations overestimate generalization, because models that look strong on one benchmark can lose large accuracy or F1 on standardized or unified data.
White-box attacks such as PGD remain the most damaging in these measurements, while structural black-box attacks like edge removal are largely ineffective up to 30% deletion.
Node injection is a realistic and consistently degrading attack vector in IoT-style graphs, so defenses should target it.
LLM-based flow filtering can improve downstream GNN robustness, but only if the LLM's precision is adequate; high-recall and low-precision filtering degrades the detector.
Reproducible physical testbeds with ground-truth labels can complement large public datasets and reveal moderate, manageable drift rather than catastrophic failure.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

A reader should not assume the reported drops are purely model weakness: they are measured after changing preprocessing, graph construction, and data splits, so part of the gap could be an artifact of re-standardization rather than an intrinsic property of the GNNs.
The paper's framing suggests a combined evaluation design in which attacks that resemble natural drift are tested together with drift itself, since the two may compound in deployment.
The LLM mitigation results are early and cost-limited; a natural next test is to run the same filtering on larger graphs and on the other two GNNs to see whether the F1 gains persist.
A concrete extension is to train the models on REAL-IoT's unified dataset and test on the physical testbed dataset to measure how well unified training transfers to truly unseen real-world attacks.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

The headline finding is not yet supportable. Table 3 gives Anomal-E an F1 of 0.977 on the unified dataset; Table 4's clean row gives the same model an F1 of 0.17 on what is described as the same dataset. Accuracy differs too (0.945 vs 0.81). Those numbers cannot both be true under the stated stratified 70/30 split, and the text never addresses it. Since the abstract's performance-drop claim is built on these tables, that is a load-bearing problem, not a cosmetic one.

The paper does have real value. The unified-dataset standardization pipeline is a careful extension of Sarhan et al. and directly addresses a known measurement gap. The physical testbed is small (4161 flows) but documented end-to-end, including attack parameters and labeling rules, and the authors explicitly state where their feature mapping falls short (Anomal-E on testbed). The LLM mitigation study is small but honestly scoped, with API costs, prompt dependence, and variance across models acknowledged in the text. These are credible, useful artifacts for the GNN-NIDS benchmarking community.

The soft spots beyond the contradiction are the ones you'd expect. The drift evaluation in Step 2 describes train/test separation by dataset source, but Section 4.4.2 says random stratified 70/30 splits for individual and unified datasets. If the actual drift results use a random split, then what is called drift is really just model performance on a merged dataset. The Table 3 comparison also adopts numbers from the original model papers and treats them as comparable to results obtained under a different feature schema, graph construction, and split; the 'performance drop' could be a re-standardization artifact. The adaptive sampling multipliers are hand-picked, which is fine as a design choice, but the numbers should be reported as such.

Who this is for: researchers building reproducible NIDS benchmarks will get real value from the pipeline, testbed documentation, and the honest limitation sections. The robustness conclusions should not be cited until the tables are reconciled and the drift split is redone.

Recommendation: send it to peer review. The artifacts and framework deserve referee time, but the authors need to fix the Anomal-E inconsistency, run a true source-based drift split, and re-evaluate against baselines trained under the identical pipeline.

Referee Report

4 major / 5 minor

Summary. The paper proposes REAL-IoT, a framework for robustness evaluation of GNN-based network intrusion detection systems (NIDS) in IoT environments. The framework standardizes canonical NetFlow datasets into a unified benchmark, introduces a physical IoT testbed dataset with real attack traffic, evaluates three GNN models (E-GraphSAGE, Anomal-E, CAGN-GAT Fusion) under distribution drift and synthetic adversarial attacks, and explores LLM-based filtering as a mitigation. The central claim is that REAL-IoT reveals performance drops in GNN models compared to standard benchmarks, quantifying susceptibility to drift and realistic attacks, and that LLM filtering can partially restore robustness.

Significance. If the measurements were reliable, the paper would address a real and timely measurement gap: GNN-NIDS evaluations rarely combine distribution drift, realistic attacks, and standardized cross-dataset comparison. The physical testbed, the reproducible artifact promise, and the candid enumeration of limitations are strengths. However, the current manuscript contains internal contradictions in the headline numbers and omits the key drift experiment, so the quantitative conclusions cannot yet be accepted. The framework idea is valuable, but the evidence supporting the central claim needs substantial repair.

major comments (4)

[Table 3 vs Table 4] The clean-set results for Anomal-E on the unified dataset are internally inconsistent. Table 3 reports Accuracy 0.945 and weighted F1 0.977 for the Unified Dataset, while the Clean row of Table 4 reports Accuracy 0.81, Recall 0.10, and F1 0.17 for the same model trained on the unified dataset per Section 4.4.1 Step 3. Accuracy is not affected by metric weighting, so both rows cannot describe the same model and test protocol. The Table 3 footnote states that the best-performing algorithm (HBOS) and parameters were used, but Table 4 does not state which algorithm or parameters were used. If different settings are silently used, the adversarial degradation numbers in Tables 4-6 cannot be attributed to a single measurable system, and the central performance-drop claim is unsupported. Please reconcile the numbers or clearly specify the protocol for each table.
[Section 4.4.1 Step 2 and Table 3] The distribution-drift evaluation described in Step 2, which trains on source-defined subsets and tests on distinct subsets, is never reported as such. The only unified-dataset results appear in Table 3 and, per Section 4.4.2, come from a stratified 70/30 random split rather than a source-based split. Without a source-based split, the paper's claim that REAL-IoT quantifies susceptibility to distribution drift is not supported by the presented experiments. Please either report the source-based drift results or revise the claim to match the actual protocol.
[Table 3 caption and Section 4.2.4] Values marked with * are taken from the original model papers and directly compared with results obtained under REAL-IoT's standardized pipeline. However, the standardization changes the feature schema, graph construction, feature scaling, and data split relative to the original papers. For example, E-GraphSAGE's original NF-BoT-IoT result (Accuracy 0.936) is compared with a result on standardized NF-BoT-IoT v2 (Accuracy 0.983), and CAGN-GAT's original UNSW-NB15 result (F1 0.918) is compared with a standardized NF-UNSW-NB15 v2 result (F1 0.182). These differences could reflect the re-standardization itself rather than model robustness. The paper should either re-run the original configurations or explicitly bound the effect of the pipeline change on the reported drops.
[Tables 7-8 and Section 4.4.5] The LLM mitigation metrics are internally inconsistent. In Table 7, DeepSeek R1 is reported with LLM Recall 0.960 but only 1 Correctly Flagged node out of 20 injected nodes, which would correspond to recall 0.05 if recall is correctly flagged divided by total injected. The Baseline for CAGN-GAT in Tables 7-8 (F1 0.720 and 0.821) also differs from the Clean F1 of 0.83 in Table 6, without an explanation of which subgraph or split is used. Because the LLM mitigation claim rests on these comparisons, the protocol and metric definitions need to be stated precisely and the numbers must be reconciled.

minor comments (5)

[Figure 2] The figure contains a typo in the prompt text: 'te x tual' should be 'textual'.
[Table 1] In the CAGN-GAT Fusion row, 'UNSW-NW15' should be 'UNSW-NB15'.
[Section 4.2.2] Equation (1) is difficult to reproduce because the values of p_rare, p_uncommon, M_rare, M_uncommon, and M_common are not specified; please provide the concrete values used in the experiments.
[Section 4.4.3] Edge removal and node injection are described as 'black-box' attacks, but the DeepRobust implementations used here are not inherently black-box; the threat model for each attack should be clarified.
[Section 5.4] The explanation for omitting Anomal-E from the testbed evaluation is clear, but it leaves the testbed comparison inconsistent across the three models; a brief sentence on how this affects the generality of the testbed conclusions would help.

Circularity Check

0 steps flagged · score 2.0 of 10

No circular derivation found: REAL-IoT is an empirical measurement framework, not a fit-derived prediction; the main integrity concern is an internal Table 3/Table 4 contradiction (validity, not circularity).

full rationale

The paper's central claim is that evaluating GNN NIDS models under REAL-IoT's standardized unified dataset and testbed reveals performance drops relative to original benchmark reports. This is a measurement claim, not a derivation. The adaptive stratified sampling rates in Section 4.2.2 are an explicit heuristic design choice ('The multipliers are chosen heuristically based on observed class distributions'), not a fitted parameter later renamed as a prediction. Table 3's starred values are imported from the original model papers and compared externally; that comparison may be non-commensurable but is not circular by construction. Adversarial attack results in Tables 4-6 are independent evaluations on trained models, and the LLM mitigation results in Tables 7-8 are measured by downstream GNN performance after pruning, not derived from the LLM's own outputs. Same-group citations exist ([24], [60], [61]) but are not load-bearing: the LLM experiments are executed in this paper rather than imported from [60]. The most serious issue found is an internal measurement contradiction: Table 3 reports Anomal-E on the unified dataset with Accuracy 0.945 and F1 0.977, while Table 4's Clean row (trained on the unified dataset per Section 4.4.1 Step 3, 70/30 protocol per Section 4.4.2) reports Accuracy 0.81 and F1 0.17; the Table 3 footnote selects the best-performing Anomal-E algorithm (HBOS), while Table 4 does not state its algorithm, so the two tables may not measure the same system, undermining the central performance-drop and attack-degradation claims. This is an internal-consistency/validity problem, not a reduction of a prediction to its inputs, so it does not count as circularity under the stated criteria.

Assumptions & free parameters 2 free parameters · 4 assumptions · 0 invented entities

The framework introduces no new physical or mathematical entities. Its main dependencies are the choice of sampling hyperparameters and the assumption that a random split of merged data represents drift.

free parameters (2)

Adaptive stratified sampling hyperparameters = r_base=0.05, N_min=1000; M_rare, M_uncommon, M_common, r_high not specified ('chosen heuristically')
Section 4.2.2: These control the class balance of the unified dataset. The central finding that models drop in performance on the unified dataset could change if the sampling balance changes.
PGD perturbation budget epsilon = per-model values: 0.01-0.2 (Anomal-E), 0.3-0.7 (EGraphSage), 0.1-0.7 (CAGN-GAT)
Section 4.4.1 Step 3: The conclusion that white-box attacks degrade models depends on the chosen budgets. No rationale is given for why these specific budgets are 'practical'.

assumptions (4)

domain assumption IP-as-node, flow-as-edge graph construction is a valid and fair representation for comparing GNN NIDS models.
Section 4.2.4: All models are forced into this common graph representation, but some models were designed around different graph constructions; differences could be due to the graph, not the model.
domain assumption A random 70/30 split of the merged unified dataset exposes distribution drift.
Section 4.4.2: The paper calls this 'Distribution Drift Evaluation' but a random split samples from the same distribution; it does not simulate temporal or spatial drift.
domain assumption LLM API outputs are a stable, queryable expert signal.
Section 4.4.4 and 4.4.6: The mitigation results depend on API behavior, which the paper itself notes varies over time.
ad hoc to paper The simple hping3/nmap attacks in the testbed are representative of realistic adversarial traffic for GNN NIDS.
Section 5.6 acknowledges the attacks are a small subset of the threat landscape.

how reviews work

0 comments

Cite this review

Pith. "Pith review of REAL-IoT: Characterizing GNN Intrusion Detection Robustness under Practical Adversarial Attack." pith.science (2026). https://pith.science/paper/RCLY36OS

@misc{pith2026250710836,
  author       = {Pith},
  title        = {Pith review of: REAL-IoT: Characterizing GNN Intrusion Detection Robustness under Practical Adversarial Attack},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/RCLY36OS}},
  note         = {Machine review of arXiv:2507.10836}
}

read the original abstract

Graph Neural Network (GNN)-based network intrusion detection systems (NIDS) are often evaluated on single datasets, limiting their ability to generalize under distribution drift. Furthermore, their adversarial robustness is typically assessed using synthetic perturbations that lack realism. This measurement gap leads to an overestimation of GNN-based NIDS resilience. To address the limitations, we propose \textbf{REAL-IoT}, a comprehensive framework for robustness evaluation of GNN-based NIDS in IoT environments. Our framework presents a methodology that creates a unified dataset from canonical datasets to assess generalization under drift. In addition, it features a novel intrusion dataset collected from a physical IoT testbed, which captures network traffic and attack scenarios under real-world settings. Furthermore, using REAL-IoT, we explore the usage of Large Language Models (LLMs) to analyze network data and mitigate the impact of adversarial examples by filtering suspicious flows. Our evaluations using REAL-IoT reveal performance drops in GNN models compared to results from standard benchmarks, quantifying their susceptibility to drift and realistic attacks. We also demonstrate the potential of LLM-based filtering to enhance robustness. These findings emphasize the necessity of realistic threat modeling and rigorous measurement practices for developing resilient IoT intrusion detection systems.

Figures

Figures reproduced from arXiv: 2507.10836 by the authors.

**Figure 2.** The LLM Mitigation pipeline design node injection attacks show a more consistent and intuitively scaled degradation across models. This predictable impact suggests that node injection represents a more realistic attack vector for future real-world experimental validation and defensive strategy development. 4.4.4 LLM-Enhanced GNN Robustness. To assess the novel application of Large Language Models (LLMs) in enhanci… view at source ↗

**Figure 3.** Node-Red flow of Echo Dot Traffic pertinent and intuitive attack vector in a real-world context. Therefore, DoS attacks are featured in this experiment design. The primary objectives of building this testbed dataset are: (1) To design a small-scale yet representative physical testbed emulating an IoT network, including simulated IoT devices and a dedicated attack platform. (2) To execute a series of carefully orche… view at source ↗

Figures from the paper (2 more)

**Figure 4.** Figure 4: High level lab setup diagram to send a high volume of TCP SYN packets to the SSH port. Based on preliminary tests, the source ports for these attack packets were observed to start from a base port of 60002 and increment with successive packets or differing spoofed sour…

**Figure 5.** Figure 5: Physical Testbed setup A ETHICS This work does not raise any ethical concerns. All experiments were conducted using simulated network traffic generated within a controlled testbed environment. The network was fully isolated and operated in a private local setting, with…

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

68 extracted references · 60 canonical work pages

[1]

Amazon Web Services. 2025. AWS IoT Greengrass. https://docs.aws. amazon.com/greengrass/. Accessed: 2025-05-15

work page 2025
[2]

Giuseppina Andresini, Feargus Pendlebury, Fabio Pierazzi, Corrado Loglisci, Annalisa Appice, and Lorenzo Cavallaro. 2021. Insomnia: Towards concept-drift robustness in network intrusion detection. In Proceedings of the 14th ACM workshop on artificial intelligence and security. 111–122

work page 2021
[3]

Anthropic. 2024. Claude 3.5 Haiku. https://www.anthropic.com/claude/ haiku. Accessed: 2025-05-15

work page 2024
[4]

Anthropic. 2025. Claude 3.7 Sonnet. https://www.anthropic.com/ claude/sonnet. Accessed: 2025-05-15

work page 2025
[5]

Tristan Bilot, Nour El Madhoun, Khaldoun Al Agha, and Anis Zouaoui

work page
[6]

Mateusz Buda, Atsuto Maki, and Maciej A Mazurowski. 2018. A systematic study of the class imbalance problem in convolutional neural networks. Neural networks 106 (2018), 249–259

work page 2018
[7]

Canadian Institute for Cybersecurity. 2018. CICIDS2018 Dataset. https://www.unb.ca/cic/datasets/ids-2018.html. Accessed: 2025-05-14

work page 2018
[8]

Evan Caville, Wai Weng Lo, Siamak Layeghy, and Marius Portmann

work page

Show all 68 references

[9]

Liyan Chang and Paula Branco. 2021. Graph-based solutions with residuals for intrusion detection: The modified e-graphsage and e-resgat algorithms. arXiv preprint arXiv:2111.13597 (2021)

2021 arXiv
[10]

Dylan Chou and Meng Jiang. 2021. A survey on data-driven network intrusion detection. ACM Computing Surveys (CSUR) 54, 9 (2021), 1–36

2021
[11]

DeepSeek-AI, Daya Guo, Dejian Yang, Haowei Zhang, Junxiao Song, Ruoyu Zhang, Runxin Xu, Qihao Zhu, Shirong Ma, Peiyi Wang, Xiao Bi, Xiaokang Zhang, Xingkai Yu, Yu Wu, Z. F. Wu, Zhibin Gou, Zhi- hong Shao, Zhuoshu Li, Ziyi Gao, Aixin Liu, Bing Xue, Bingxuan Wang, Bochao Wu, Bei...

2025 arXiv
[12]

Xiaoheng Deng, Jincai Zhu, Xinjun Pei, Lan Zhang, Zhen Ling, and Kaiping Xue. 2022. Flow topology-based graph convolutional network for intrusion detection in label-limited IoT networks. IEEE Transac- tions on Network and Service Management 20, 1 (2022), 684–696

2022
[13]

Luca Deri. 2003. nProbe: an Open Source NetFlow Probe for Gigabit Networks. In Proceedings of the TERENA Networking Conference . Zagreb, Croatia. https://cuc.carnet.hr/2003/program/papers/p8b2.pdf

2003
[14]

Wenbo Ding, Hongxin Hu, and Long Cheng. 2021. Iotsafe: Enforcing safety and security policy withreal iot physical interaction discovery. In Network and Distributed System Security Symposium

2021
[15]

Elias Dritsas and Maria Trigka. 2025. A Survey on Cybersecurity in IoT. Future Internet 17, 1 (2025)

2025
[16]

Sabrine Ennaji, Fabio De Gaspari, Dorjan Hitaj, Alicia Kbidi, and Luigi V Mancini. 2024. Adversarial Challenges in Network Intrusion Detection Systems: Research Insights and Future Prospects. arXiv preprint arXiv:2409.18736 (2024)

2024 arXiv
[17]

Yasir Ali Farrukh, Syed Wali, Irfan Khan, and Nathaniel D Bastian
[18]

Wei Guo, Han Qiu, Zimian Liu, Junhu Zhu, and Qingxian Wang. 2022. GLD-Net: Deep Learning to Detect DDoS Attack via Topological and Traffic Feature Fusion. Computational Intelligence and Neuroscience 2022, 1 (2022), 4611331

2022
[19]

Vikas Hassija, Vinay Chamola, Vikas Saxena, Divyansh Jain, Pranav Goyal, and Biplab Sikdar. 2019. A survey on IoT security: application areas, security threats, and solution architectures.IEEe Access 7 (2019), 82721–82743

2019
[20]

Jake Hesford, Daniel Cheng, Alan Wan, Larry Huynh, Seungho Kim, Hyoungshick Kim, and Jin B Hong. 2024. Expectations Versus Reality: Evaluating Intrusion Detection Systems in Practice. arXiv preprint arXiv:2403.17458 (2024)

2024 arXiv
[21]

Rick Hofstede, Pavel ˇCeleda, Brian Trammell, Idilio Drago, Ramin Sadre, Anna Sperotto, and Aiko Pras. 2014. Flow monitoring explained: From packet capture to data analysis with netflow and ipfix. IEEE Communications Surveys & Tutorials 16, 4 (2014), 2037–2064

2014
[22]

Md Abrar Jahin, Shahriar Soudeep, MF Mridha, Raihan Kabir, Md Rashedul Islam, and Yutaka Watanobe. 2025. CAGN-GAT Fusion: A Hybrid Contrastive Attentive Graph Neural Network for Network Intrusion Detection. arXiv preprint arXiv:2503.00961 (2025)

2025 arXiv
[23]

P Rajesh Kanna and P Santhi. 2021. Unified deep learning approach for efficient intrusion detection system using integrated spatial–temporal features. Knowledge-Based Systems 226 (2021), 107132

2021
[24]

Roman Kolcun, Diana Andreea Popescu, Vadim Safronov, Poonam Ya- dav, Anna Maria Mandalari, Yiming Xie, Richard Mortier, and Hamed Haddadi. 2020. The case for retraining of ml models for iot device identification at the edge. arXiv preprint arXiv:2011.08605 (2020)

2020 arXiv
[25]

Nickolaos Koroniotis, Nour Moustafa, Elena Sitnikova, and Benjamin Turnbull. 2019. Towards the development of realistic botnet dataset in the internet of things for network forensic analytics: Bot-iot dataset. Future Generation Computer Systems 100 (2019), 779–796

2019
[26]

Corentin Larroche. 2025. Designing a reliable lateral movement detec- tor using a graph foundation model. arXiv preprint arXiv:2504.13527 (2025)

2025 arXiv
[27]

Arash Habibi Lashkari. 2018. CICFlowMeter: Network Traffic Bi-flow Generator and Analyzer. https://github.com/ahlashkari/CICFlowMeter. Accessed: 2025-05-15. 14 REAL-IoT: Characterizing GNN Intrusion Detection Robustness under Practical Adversarial Attack

2018
[28]

Yann LeCun, Yoshua Bengio, and Geoffrey Hinton. 2015. Deep learn- ing. nature 521, 7553 (2015), 436–444

2015
[29]

Yaxin Li, Wei Jin, Han Xu, and Jiliang Tang. 2020. Deeprobust: A pytorch library for adversarial attacks and defenses. arXiv preprint arXiv:2005.06149 (2020)

2020 arXiv
[30]

Wai Weng Lo, Siamak Layeghy, Mohanad Sarhan, Marcus Gallagher, and Marius Portmann. 2022. E-graphsage: A graph neural net- work based intrusion detection system for iot. In NOMS 2022-2022 IEEE/IFIP Network Operations and Management Symposium. IEEE, 1–9

2022
[31]

Gordon Fyodor Lyon. 2024. Nmap: Network Mapper. https://nmap.org. Version 7.95, released on April 23, 2024. Accessed: 2025-05-15

2024
[32]

Jiaqi Ma, Shuangrui Ding, and Qiaozhu Mei. 2020. Towards more practical adversarial attacks on graph neural networks. Advances in neural information processing systems 33 (2020), 4756–4766

2020
[33]

Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. 2017. Towards deep learning models resis- tant to adversarial attacks. arXiv preprint arXiv:1706.06083 (2017)

2017 arXiv
[34]

Meta AI. 2025. LLaMA 4 Maverick 17B-128E Instruct. https: //huggingface.co/meta-llama/Llama-4-Maverick-17B-128E-Instruct. Accessed: 2025-05-15

2025
[35]

Nour Moustafa. 2019. New generations of internet of things datasets for cybersecurity applications based machine learning: TON_IoT datasets. In Proceedings of the eResearch Australasia Conference, Brisbane, Australia. 21–25

2019
[36]

Nour Moustafa and Jill Slay. 2015. UNSW-NB15: a comprehensive data set for network intrusion detection systems (UNSW-NB15 network data set). In 2015 military communications and information systems conference (MilCIS). IEEE, 1–6

2015
[37]

Muhammad Bisri Musthafa, Samsul Huda, Yuta Kodera, Md Arshad Ali, Shunsuke Araki, Jedidah Mwaura, and Yasuyuki Nogami. 2024. Optimizing IoT intrusion detection using balanced class distribution, feature selection, and ensemble machine learning techniques. Sensors 24, 13 (2024), 4293

2024
[38]

Node-RED Community Contributors. 2025. Node-RED Flow: de9ad7f94c78343416ccb1ec0d4a5b2b. https://flows.nodered.org/flow/ de9ad7f94c78343416ccb1ec0d4a5b2b. Accessed: 2025-05-14

2025
[39]

ntop. 2025. ndpi_protocol_ids.h: Mapping Table for Protocol Iden- tifiers in nDPI. https://github.com/ntop/nDPI/blob/dev/src/include/ ndpi_protocol_ids.h Retrieved from nDPI repository, commit f6b1e8a, accessed May 14, 2025

2025
[40]

Offensive Security. 2024. Kali Linux 2024.4: Advanced Penetration Testing Distribution. https://www.kali.org/releases/kali-2024-4/. Re- leased on December 16, 2024. Accessed: 2025-05-15

2024
[41]

OpenAI. 2024. GPT-4o. https://openai.com/index/hello-gpt-4o/. Ac- cessed: 2025-05-15

2024
[42]

OpenJS Foundation and Node-RED Contributors. 2025. Node-RED: Low-code programming for event-driven applications. https://nodered. org. Version 4.0.9, released on February 14, 2025. Accessed: 2025-05- 15

2025
[43]

Pavlos Papadopoulos, Oliver Thornewill von Essen, Nikolaos Pitropakis, Christos Chrysoulas, Alexios Mylonas, and William J Buchanan. 2021. Launching adversarial attacks against network intru- sion detection systems for iot. Journal of Cybersecurity and Privacy 1, 2 (2021), 252–273

2021
[44]

Raspberry Pi Foundation. 2022. Raspberry Pi OS (64-bit). https: //www.raspberrypi.com/software/operating-systems/. Official 64-bit release. Accessed: 2025-05-15

2022
[45]

Salvatore Sanfilippo. 2021. hping3: TCP/IP Packet Assembler and Analyzer. http://www.hping.org/. Version 3.0.0, released on December 30, 2021. Accessed: 2025-05-15

2021
[46]

Mohanad Sarhan, Siamak Layeghy, and Marius Portmann. 2022. To- wards a standard feature set for network intrusion detection system datasets. Mobile networks and applications (2022), 1–14

2022
[47]

Iman Sharafaldin, Amirhossein Gharib, Arash Habibi Lashkari, Ali A Ghorbani, et al. 2018. Towards a reliable intrusion detection benchmark dataset. Software Networking 2018, 1 (2018), 177–200

2018
[48]

Iman Sharafaldin, Arash Habibi Lashkari, Ali A Ghorbani, et al. 2018. Toward generating a new intrusion detection dataset and intrusion traffic characterization. ICISSp 1, 2018 (2018), 108–116

2018
[49]

Salvatore Stolfo, Wei Fan, Wenke Lee, Andreas Prodromidis, and Philip Chan. 1999. KDD Cup 1999 Data. UCI Machine Learning Repository. DOI: https://doi.org/10.24432/C51C7N

1999 doi
[50]

Zhenlu Sun, André MH Teixeira, and Salman Toor. 2024. GNN-IDS: Graph Neural Network based Intrusion Detection System. In Proceed- ings of the 19th International Conference on Availability, Reliability and Security. 1–12

2024
[51]

Mahbod Tavallaee, Ebrahim Bagheri, Wei Lu, and Ali A Ghorbani
[52]

Dinh-Hau Tran and Minho Park. 2024. FN-GNN: A novel graph embedding approach for enhancing graph neural networks in network intrusion detection systems. Applied Sciences 14, 16 (2024), 6932

2024
[53]

Louis Van Langendonck, Ismael Castell-Uroz, and Pere Barlet-Ros
[54]

Apostol Vassilev, Alina Oprea, Alie Fordyce, and Hyrum Andersen
[55]

Andrea Venturi, Daniele Pellegrini, Mauro Andreolini, Luca Ferretti, Mirco Marchetti, Michele Colajanni, et al. 2023. Practical Evaluation of Graph Neural Networks in Network Intrusion Detection. In CEUR Workshop Proceedings, V ol. 3488. CEUR-WS

2023
[56]

Chenglong Wang, Pujia Zheng, Jiaping Gui, Cunqing Hua, and Wa- jih Ul Hassan. 2025. Are We There Yet? Unraveling the State-of- the-Art Graph Network Intrusion Detection Systems. arXiv preprint arXiv:2503.20281 (2025)

2025 arXiv
[57]

Wireshark Foundation. 2025. Wireshark: The World’s Most Popular Network Protocol Analyzer. https://www.wireshark.org. Version 4.4.6, released on April 16, 2025. Accessed: 2025-05-15

2025
[58]

Lingfei Wu, Peng Cui, Jian Pei, Liang Zhao, and Xiaojie Guo. 2022. Graph neural networks: foundation, frontiers and applications. In Pro- ceedings of the 28th ACM SIGKDD conference on knowledge discovery and data mining. 4840–4841

2022
[59]

Jie Ying, Tiantian Zhu, Aohan Zheng, Tieming Chen, Mingqi Lv, and Yan Chen. 2024. METANOIA: A Lifelong Intrusion Detection and Investigation System for Mitigating Concept Drift. arXiv preprint arXiv:2501.00438 (2024)

2024
[60]

Adversarial machine learning: A taxonomy and terminology of attacks and mitigations. (2024)

2024
[61]

Huichi Zhou, Kin-Hei Lee, Zhonghao Zhan, Yue Chen, Zhenhao Li, Zhaoyang Wang, Hamed Haddadi, and Emine Yilmaz. 2025. Trustrag: Enhancing robustness and trustworthiness in rag. arXiv preprint arXiv:2501.00879 (2025)

2025 arXiv
[62]

Incoming bytes

Jie Zhou, Ganqu Cui, Shengding Hu, Zhengyan Zhang, Cheng Yang, Zhiyuan Liu, Lifeng Wang, Changcheng Li, and Maosong Sun. 2020. Graph neural networks: A review of methods and applications. AI open 1 (2020), 57–81. 15 Figure 5: Physical Testbed setup A ETHICS This work does not ...

2020
[66]

Zhongjian Zhang, Xiao Wang, Huichi Zhou, Yue Yu, Mengmei Zhang, Cheng Yang, and Chuan Shi. 2024. Can Large Language Models Improve the Adversarial Robustness of Graph Neural Networks? arXiv preprint arXiv:2408.08685 (2024)

2024 arXiv
[2009]

In 2009 IEEE symposium on computational intelligence for security and defense applications

A detailed analysis of the KDD CUP 99 data set. In 2009 IEEE symposium on computational intelligence for security and defense applications. Ieee, 1–6

2009
[2022]

Knowledge-based systems 258 (2022), 110030

Anomal-E: A self-supervised network intrusion detection system based on graph neural networks. Knowledge-based systems 258 (2022), 110030

2022
[2023]

IEEE Access 11 (2023), 49114–49139

Graph neural networks for intrusion detection: A survey. IEEE Access 11 (2023), 49114–49139

2023
[2024]

arXiv preprint arXiv:2406.13365 (2024)

PPT-GNN: A Practical Pre-Trained Spatio-Temporal Graph Neu- ral Network for Network Security. arXiv preprint arXiv:2406.13365 (2024)

2024 arXiv
[2025]

Expert Systems with Applications (2025), 128089

Xg-nid: Dual-modality network intrusion detection using a heterogeneous graph neural network and large language model. Expert Systems with Applications (2025), 128089

2025

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.

[1] [1]

Amazon Web Services. 2025. AWS IoT Greengrass. https://docs.aws. amazon.com/greengrass/. Accessed: 2025-05-15

work page 2025

[2] [2]

Giuseppina Andresini, Feargus Pendlebury, Fabio Pierazzi, Corrado Loglisci, Annalisa Appice, and Lorenzo Cavallaro. 2021. Insomnia: Towards concept-drift robustness in network intrusion detection. In Proceedings of the 14th ACM workshop on artificial intelligence and security. 111–122

work page 2021

[3] [3]

Anthropic. 2024. Claude 3.5 Haiku. https://www.anthropic.com/claude/ haiku. Accessed: 2025-05-15

work page 2024

[4] [4]

Anthropic. 2025. Claude 3.7 Sonnet. https://www.anthropic.com/ claude/sonnet. Accessed: 2025-05-15

work page 2025

[5] [5]

Tristan Bilot, Nour El Madhoun, Khaldoun Al Agha, and Anis Zouaoui

work page

[6] [6]

Mateusz Buda, Atsuto Maki, and Maciej A Mazurowski. 2018. A systematic study of the class imbalance problem in convolutional neural networks. Neural networks 106 (2018), 249–259

work page 2018

[7] [7]

Canadian Institute for Cybersecurity. 2018. CICIDS2018 Dataset. https://www.unb.ca/cic/datasets/ids-2018.html. Accessed: 2025-05-14

work page 2018

[8] [8]

Evan Caville, Wai Weng Lo, Siamak Layeghy, and Marius Portmann

work page