Graph-based Solutions with Residuals for Intrusion Detection: the
  Modified E-GraphSAGE and E-ResGAT Algorithms
  The high volume of increasingly sophisticated cyber threats is drawing
growing attention to cybersecurity, where many challenges remain unresolved.
Namely, for intrusion detection, new algorithms that are more robust,
effective, and able to use more information are needed. Moreover, the intrusion
detection task faces a serious challenge associated with the extreme class
imbalance between normal and malicious traffics. Recently, graph-neural network
(GNN) achieved state-of-the-art performance to model the network topology in
cybersecurity tasks. However, only a few works exist using GNNs to tackle the
intrusion detection problem. Besides, other promising avenues such as applying
the attention mechanism are still under-explored. This paper presents two novel
graph-based solutions for intrusion detection, the modified E-GraphSAGE, and
E-ResGATalgorithms, which rely on the established GraphSAGE and graph attention
network (GAT), respectively. The key idea is to integrate residual learning
into the GNN leveraging the available graph information. Residual connections
are added as a strategy to deal with the high-class imbalance, aiming at
retaining the original information and improving the minority classes'
performance. An extensive experimental evaluation of four recent intrusion
detection datasets shows the excellent performance of our approaches,
especially when predicting minority classes.
