Adaptive Graph Neural Network Framework for Real-Time Threat Detection in Critical Infrastructure Networks
Year: 2025
Type: preprint
Abstract: Critical infrastructure networks face increasingly sophisticated cyber threats that traditional detection methods struggle to identify in real-time. This paper presents AGNN-TID (Adaptive Graph Neural Network for Threat Intelligence and Detection), a novel framework that models infrastructure systems as dynamic temporal graphs and employs attention-based graph neural networks to detect anomalous patterns indicative of cyberattacks. Unlike existing approaches that treat network elements independently, AGNN-TID captures spatial relationships between infrastructure components and temporal evolution of attack patterns simultaneously. We introduce a new multi-scale attention mechanism that adapts to infrastructure topology changes and learns hierarchical threat representations. The framework incorporates a novel loss function combining supervised classification with unsupervised anomaly detection, enabling effective learning even with limited labeled attack data. Extensive evaluation on three datasets-NSL-KDD, CICIDS2017, and a newly collected Australian critical infrastructure dataset (AUS-CII-2024)-demonstrates that AGNN-TID achieves 96.8% detection accuracy with2.3% false positive rate, outperforming state-of-the-art methods by 8.4% in F1-score while reducing detection latency to under 180ms. The framework successfully detected zero-day attack patterns in our infrastructure testbed that signature-based systems missed entirely. Mathematical analysis proves the convergence properties of our training algorithm and establishes theoretical bounds on detection performance. Our code and AUS-CII-2024 dataset are publicly available to enable reproducibility and future research.
Author: Kazeem Mohammed
Language: English
Subfield: Computer Networks and Communications
Field: Computer Science
Domain: Physical Sciences
Open Access status: green
OpenAlex ID: W4416347671