IoTGUARD: A Graph Learning Based-Approach for Early IoT Attack Traffic Detection

Abstract

Internet of things (IoT) attack traffic detection is essential in guarding IoT security. Mainstream methods, which rely on tabular feature extraction from completed network flows, often suffer from considerable latency, hindering real-time detection. Even those methods that focus on early threat detection are fraught with numerous shortcomings, insufficient accuracy, and difficulties in extracting temporal features from attack flows. Therefore, we propose IoTGUARD, a graph learning-based approach for early IoT attack traffic detection. It leverages only the initial packets of IoT flows for constructing IoT weighted flow graphs to enhance real-time performance. By design a node-edge alternating learning graph neural network, NEL-GNN, IoTGUARD enables comprehensive learning of IoT weighted flow graphs and effectively classify attack flows. Experiments conducted on ToN-IoT dataset demonstrate that IoTGUARD achieves accuracies of 97.30% for various attacks with limited data packets, outperforming other comparable methods.