A Hub-Centric Graph Neural Network for Scalable Intrusion Detection
Year: 2025
Type: article
Abstract: : Intrusion detection is a critical component of modern cybersecurity, particularly as network traffic continues to increase in scale and complexity. Traditional machine learning methods have achieved promising results but often fail to capture the relational dependencies among network entities. Graph Neural Networks (GNNs) offer an effective framework for learning from graph-structured data, enabling the modeling of such relationships. However, applying GNNs directly to large-scale intrusion datasets poses scalability challenges due to the vast number of nodes and potential interconnections. In this study, we propose a hub-centric graph construction approach where Internet Protocol (IP) addresses act as hub nodes, and all traffic records associated with the same IP are connected to the hub. This strategy reduces graph density and enhances scalability without significant loss of structural information. The proposed GNN model, implemented using a four-layer SAGEConv architecture, achieved an accuracy of 80% on the UNSW-NB15 dataset [1]. Although traditional models such as Random Forest reached a higher accuracy of 96%, the GNN demonstrated stronger relational learning and better generalization to complex, non-linear, and previously unseen attack patterns. Keywords: Graph Neural Network, Intrusion Detection, Cybersecurity, UNSW-NB15, Hub Node
Author: Raghul Azhagaiah
Language: English
Subfield: Computer Networks and Communications
Field: Computer Science
Domain: Physical Sciences
Open Access status: green
OpenAlex ID: W7088617470
FWCI:
Cites:
Cited by:
Related to: