DynKDD: Dynamic Graph-Based Network Intrusion Detection Using Graph Neural Networks
Aabid Ahmad Mir, Megat F. Zuhairi, Shahrulniza Musa, Abdallah Namoun · 2025
The inability to capture the temporal dynamics of network interactions limits traditional intrusion detection systems (IDSs) in detecting sophisticated threats that evolve over time. This research introduces DynKDD, a dynamic graph-based version of the NSL-KDD dataset, designed to capture the temporal relationships between network entities and their interactions. The proposed solution leverages Graph Neural Networks (GNNs) to detect network intrusions by analysing both the spatial and temporal evolution of network traffic. The methodology involves transforming the static NSL-KDD dataset into a series of timeordered graph snapshots by assigning synthetic timestamps and constructing dynamic graphs. The snapshots represent the evolution of network interactions, enabling advanced dynamic graph learning models to process and detect intrusions. Five stateof-the-art GNN models, Graph Convolutional Networks (GCN), Graph Attention Networks (GAT), Graph Sample and Aggregation (GraphSAGE), Graph Isomorphism Networks (GIN) and Graph Auto-Encoders (GAE), were trained and tested on the DynKDD dataset, and their performance was evaluated using metrics such as accuracy, precision, recall, and F1-score. Evaluation results demonstrate that GraphSAGE consistently outperforms other models, achieving an accuracy of 95.80% on the DynKDD dataset, a notable improvement over the static NSLKDD dataset. Other models follow a similar trend with a significant improvement on the constructed DynKDD dataset. The results validate the superiority of dynamic graph-based intrusion detection systems in identifying evolving network threats. With its ability to model evolving cyberattacks, DynKDD holds immense potential for real-world applications in protecting critical infrastructure from advanced and persistent threats, offering a transformative approach to network intrusion detection.