GraphIDS: Graph-Based Intrusion Detection

• GraphIDS is a graph-based network intrusion detection system that models network flows as edges, learning normal communication patterns via self-supervised masked autoencoding.
• It unifies inductive edge-centric Graph Neural Networks with Transformer-based reconstruction to yield anomaly scores from deviations in local topological contexts.
• Benchmark evaluations report exceptional PR-AUC and Macro-F1 scores, highlighting the efficacy of integrating local topology with global co-occurrence modeling.

GraphIDS denotes a class of graph-based network intrusion detection systems that model network traffic as a graph $G=(V,E)$, with hosts as vertices and communication flows as directed edges within a chosen time frame, and apply graph neural architectures to learn normal traffic patterns and flag deviations as suspicious (Wang et al., 26 Mar 2025). In a more specific usage, GraphIDS is the name of a self-supervised intrusion detection model that learns local graph representations of normal communication patterns through a masked autoencoder: an inductive graph neural network embeds each flow with its local topological context, a Transformer-based encoder-decoder reconstructs these embeddings without positional information, and flows with unusually high reconstruction errors are flagged as potential intrusions (Guerra et al., 20 Sep 2025).

1. Conceptual scope and graph formulation

Within the network-security literature, a GraphIDS models network traffic as a graph $G=(V,E)$ in which $V$ is the set of hosts and $E\subseteq V\times V$ is the set of directed communication-flows in a chosen time frame, often called a snapshot (Wang et al., 26 Mar 2025). The broader taxonomy distinguishes static from dynamic graphs, streaming from batch processing, and supervised from unsupervised settings. Static systems build one graph over a long interval, whereas dynamic systems split traffic into a sequence of snapshots $\{G_t\}$ and learn temporal evolution; streaming systems score edges incrementally, while non-streaming systems process entire snapshots at once. Most GraphIDS are unsupervised or anomaly-based and learn only from benign traffic (Wang et al., 26 Mar 2025).

The specific GraphIDS model instantiates this general formulation at the flow level. Its input is a directed graph $G=(V,E)$ where $V$ are IP hosts and each directed edge $e=(u\to v)$ is a flow with a feature vector $x_e\in\mathbb{R}^F$, such as packet count, byte count, and protocol (Guerra et al., 20 Sep 2025). Rather than treating graph representation learning and anomaly detection as separate stages, the model unifies them end-to-end: the learned embeddings are optimized directly for masked reconstruction of benign communication patterns, and reconstruction error becomes the anomaly score (Guerra et al., 20 Sep 2025). This design situates GraphIDS within unsupervised GraphIDS while making the representation itself downstream-task-aligned.

2. Local topological representation learning

GraphIDS begins with an inductive Edge-GNN, described as E-GraphSAGE, whose goal is to embed each flow $e$ into $G=(V,E)$0 by aggregating its 1-hop local topological context (Guerra et al., 20 Sep 2025). For a flow $G=(V,E)$1, the neighborhood $G=(V,E)$2 is the set of other flows that share an endpoint. Training samples up to a specified fanout of neighbors per batch, and with one GNN layer the model computes

$G=(V,E)$3

followed by

$G=(V,E)$4

where $G=(V,E)$5 denotes concatenation and $G=(V,E)$6 is ReLU (Guerra et al., 20 Sep 2025). A multi-layer extension is defined analogously through message passing.

The architectural emphasis on edge-centric message passing places GraphIDS in direct continuity with earlier graph-based NIDS work. In E-GraphSAGE for IoT, network flows are represented as graph edges between flow endpoints, edge features encode flow statistics, node features are initialized to constant vectors, and the model produces edge embeddings for downstream classification (Lo et al., 2021). GraphIDS preserves the edge-as-flow abstraction but shifts the objective from supervised classification to self-supervised reconstruction of benign local representations (Guerra et al., 20 Sep 2025). This suggests a transition from explicitly labeled attack-family prediction toward anomaly scoring based on deviations from learned normal communication structure.

Inductivity is a central property of this stage. Because training uses neighborhood sampling and mini-batches of edges, new flows can be embedded at inference without retraining (Guerra et al., 20 Sep 2025). That feature is operationally relevant in environments where the host set and communication graph are not fixed.

3. Masked autoencoding and global co-occurrence modeling

The local flow embeddings are passed to a masked autoencoder. Given a batch of $G=(V,E)$7 flow embeddings $G=(V,E)$8, each $G=(V,E)$9, GraphIDS linearly projects them to

$V$0

with $V$1, randomly masks a fraction $V$2 of the projected positions, and trains the model to reconstruct the original local embeddings $V$3 (Guerra et al., 20 Sep 2025). The self-supervised loss is the mean squared reconstruction error

$V$4

The encoder is a stack of $V$5 identical Transformer layers with multi-head self-attention, feed-forward sublayers, residual connections, and layer normalization (Guerra et al., 20 Sep 2025). Queries, keys, and values are all drawn from the projected embeddings, but a binary mask $V$6 prevents masked positions from attending to each other: $V$7 The decoder uses the same number of layers; each layer performs self-attention over the full projected input and cross-attention over the encoder outputs, after which an output projection maps decoder outputs back to $V$8 (Guerra et al., 20 Sep 2025).

A distinctive design choice is the absence of positional encodings. Because flows within a batch are unordered, no positional encoding is used; self-attention learns global co-occurrence patterns purely from content (Guerra et al., 20 Sep 2025). The model therefore operates on batches of flow embeddings as sets rather than sequences. A plausible implication is that the Transformer component is intended less as a temporal model than as a content-based co-occurrence model over local topological signatures.

4. End-to-end optimization and anomaly scoring

GraphIDS is trained jointly end-to-end on benign NetFlow traffic (Guerra et al., 20 Sep 2025). In each training epoch, a GNN batch of edges is sampled, 1-hop neighbors are drawn for each edge, local embeddings $V$9 are computed, and those embeddings are partitioned into windows of a fixed size before masked reconstruction is performed by the Transformer encoder-decoder. Back-propagation proceeds through the output projection, Transformer, input projection, and E-GraphSAGE, so the reconstruction objective shapes both the local graph encoder and the global co-occurrence model (Guerra et al., 20 Sep 2025).

Optimization uses AdamW with separate weight-decay for the GNN and the autoencoder, characterized respectively as heavy regularization and moderate regularization, and early stopping is performed on validation PR-AUC (Guerra et al., 20 Sep 2025). This is not merely an implementation detail. The paper’s conceptual claim is that unifying representation learning and anomaly detection yields task-aligned embeddings: by back-propagating the reconstruction loss through the GNN, edge embeddings are optimized specifically to expose deviations from normal patterns, rather than requiring a separate anomaly detector on a frozen representation (Guerra et al., 20 Sep 2025).

At inference time, GraphIDS fixes the trained E-GraphSAGE, forms windows of embeddings, runs the Transformer encoder-decoder with no masking, and computes for each flow the anomaly score

$E\subseteq V\times V$0

A flow is flagged as anomalous if $E\subseteq V\times V$1 exceeds a threshold $E\subseteq V\times V$2 chosen to maximize macro-F1 on a small labeled validation set, which is used only for threshold tuning (Guerra et al., 20 Sep 2025). A common misconception would be to equate the model with a fully label-free deployment pipeline; the training objective is benign-only and self-supervised, but threshold selection still uses a small labeled validation set.

5. Benchmarks, hyperparameters, and empirical behavior

The reported evaluation uses four NetFlow benchmarks: NF-UNSW-NB15-v2 with $E\subseteq V\times V$3 M flows, $E\subseteq V\times V$4 hosts, and $E\subseteq V\times V$5 anomalies; NF-UNSW-NB15-v3 with $E\subseteq V\times V$6 M flows, $E\subseteq V\times V$7 hosts, and $E\subseteq V\times V$8 anomalies; NF-CSE-CIC-IDS2018-v2 with $E\subseteq V\times V$9 M flows, $\{G_t\}$0 K hosts, and $\{G_t\}$1 anomalies; and NF-CSE-CIC-IDS2018-v3 with $\{G_t\}$2 M flows, $\{G_t\}$3 K hosts, and $\{G_t\}$4 anomalies (Guerra et al., 20 Sep 2025). For the v3 datasets, the example hyperparameters are an E-GraphSAGE embedding dimension $\{G_t\}$5 on UNSW and $\{G_t\}$6 on CSE, 1-hop neighborhoods with fanout $\{G_t\}$7, mean aggregation, dropout $\{G_t\}$8 on UNSW and $\{G_t\}$9 on CSE, Transformer depth $G=(V,E)$0, model dimension $G=(V,E)$1 on UNSW and $G=(V,E)$2 on CSE, window size $G=(V,E)$3, mask ratio $G=(V,E)$4, and learning rate approximately $G=(V,E)$5 (Guerra et al., 20 Sep 2025).

On NF-UNSW-NB15-v3, GraphIDS reports PR-AUC $G=(V,E)$6 $G=(V,E)$7 and Macro-F1 $G=(V,E)$8 $G=(V,E)$9; on NF-CSE-CIC-IDS2018-v3, it reports PR-AUC $V$0 $V$1 and Macro-F1 $V$2 $V$3 (Guerra et al., 20 Sep 2025). The model is described as outperforming the best prior baselines, including Anomal-E, SAFE, and classical outlier detectors, by $V$4–$V$5 percentage points on PR-AUC and Macro-F1 (Guerra et al., 20 Sep 2025). The abstract summarizes the upper end of the benchmark performance as up to $V$6 PR-AUC and $V$7 macro F1-score (Guerra et al., 20 Sep 2025).

The ablation study clarifies which components dominate performance. Without the GNN, a Transformer masked autoencoder operating on raw features exhibits a large drop on large networks, with PR-AUC $V$8 versus $V$9, indicating that topological context is crucial at scale (Guerra et al., 20 Sep 2025). Without self-attention, a simple autoencoder remains strong but less stable, confirming that global co-occurrence helps. A mask ratio of $e=(u\to v)$0 is optimal; larger ratios lead to training instability. One-hop neighborhoods suffice, while adding hops yields little gain but much higher compute and noise. Positional encodings, whether sinusoidal or learnable, have negligible effect, and including raw timestamps degrades performance, so they are discarded (Guerra et al., 20 Sep 2025). These findings collectively indicate that GraphIDS relies more on local graph structure and content-based co-occurrence than on deeper neighborhood expansion or explicit positional structure.

6. Position within graph-based intrusion detection research

GraphIDS belongs to a broader research trajectory in which graph structure is used to expose communication patterns not visible to per-flow tabular classifiers. Earlier work includes LGTBIDS, a layer-wise graph theory-based intrusion detection system for Beyond 5G that models the wireless cell as a directed graph, partitions it into layers, screens candidate vulnerable nodes by minimum capacity, and detects attacked nodes using secrecy rate and energy-efficiency thresholds (Shafi et al., 2022). In the reported MATLAB microcell simulations, LGTBIDS achieved a Detection Rate of $e=(u\to v)$1, False Alarm Rate of $e=(u\to v)$2, Overall Accuracy of $e=(u\to v)$3, and Avg. Computational Time of $e=(u\to v)$4 s (Shafi et al., 2022). E-GraphSAGE then established a practical GNN-based NIDS for IoT by representing flows as edges, aggregating edge features, and performing edge classification; it reported binary F1-scores of $e=(u\to v)$5 on BoT-IoT, $e=(u\to v)$6 on NF-BoT-IoT, $e=(u\to v)$7 on a $e=(u\to v)$8 ToN-IoT sample, and $e=(u\to v)$9 on NF-ToN-IoT (Lo et al., 2021). GraphIDS extends this lineage by combining inductive edge-level graph embedding with masked reconstruction and anomaly scoring rather than direct supervised prediction (Guerra et al., 20 Sep 2025).

At the same time, the broader GraphIDS literature faces unresolved issues of reproducibility, parameter sensitivity, scalability, and robustness (Wang et al., 26 Mar 2025). A systematic evaluation of state-of-the-art graph network intrusion detection systems found that snapshot window $x_e\in\mathbb{R}^F$0 is by far the most critical parameter; in ARGUS and EULER, larger windows cause under-aggregation and can drop average precision by up to $x_e\in\mathbb{R}^F$1 points, while VGRNN peaks at an intermediate window and then degrades (Wang et al., 26 Mar 2025). On a newly collected large-scale enterprise dataset, all evaluated models maintained high TPR $x_e\in\mathbb{R}^F$2 but exhibited FPR in the range $x_e\in\mathbb{R}^F$3–$x_e\in\mathbb{R}^F$4; for the “Sandworm” test, ARGUS had TPR $x_e\in\mathbb{R}^F$5 and FPR $x_e\in\mathbb{R}^F$6, corresponding to $x_e\in\mathbb{R}^F$7 million false positives versus approximately $x_e\in\mathbb{R}^F$8 true positives (Wang et al., 26 Mar 2025). White-box evasion is also substantial in several systems: on LANL, adding only $x_e\in\mathbb{R}^F$9 adversarial edges yielded more than $e$0 attack-edge evasion for VGRNN, EULER, and ARGUS, and $e$1 gave full evasion (Wang et al., 26 Mar 2025).

These observations matter for interpreting GraphIDS. The strong results of the self-supervised model are reported on large NetFlow benchmarks and are accompanied by ablations that isolate the contributions of topology and self-attention (Guerra et al., 20 Sep 2025). However, the survey literature indicates that GraphIDS performance can depend sharply on graph construction choices, thresholding procedures, and evaluation settings, especially under realistic false-positive and adversarial regimes (Wang et al., 26 Mar 2025). This suggests that GraphIDS is best understood not as a settled endpoint, but as a specific end-to-end formulation within an active research area whose core problems include scalable inductive inference, threshold calibration, and robustness under graph perturbation.