Inductive Graph Neural Network with Causal Sampling for IoT Network Intrusion Detection System

The widespread use of Internet of Things (IoT) devices causes many vulnerabilities. Today's network intrusion detection techniques require a data-driven approach to deal with many variations of new attacks daily. The machine learning method performs well in anomaly-based intrusion detection systems on network traffic. Recently, traditional machine learning processes network flow data without considering the network topology. Graph-based learning is capable of processing the topology of the data. An inductive Graph Neural Network is used to process large graphs. However, sampling is very challenging in aggregating relevant information from the neighborhood, which causes frequent noise. We propose the application of causal sampling to the Inductive Graph Neural Network model, E-GraphSAGE, to obtain relevant neighboring edges according to the causal weights. Our method was evaluated on publicly available datasets ToN-IoT with improved performance over random sampling, both with and without perturbation.