Online intrusion detection in computer networks using edge-aware attentive graph neural network

Abstract

Graph Neural Network (GNN)-based intrusion detection systems (IDS) have emerged as powerful tools for modeling the structural patterns of network traffic. However, most existing methods rely on large, temporally aggregated graphs and random train-test splits, which risk information leakage from future traffic and overstate real-world performance. In practice, IDSs must operate continuously on partial, time-limited data. Bridging this methodological gap is essential for translating GNN-IDS research into deployable, real-time defense systems. This study presents an intrusion detection framework based on a GNN that represents packet-flow data as communication graphs constructed over temporally segmented time windows. The method performs periodic classifications to detect deviations from normal operation and raise early alerts on emerging attacks. Using a time-window-driven graph construction method, it effectively models the temporal evolution of communication patterns while maintaining low detection latency. For graph representation learning, an EdgeGAT-based architecture exploits both structural and edge-level features, achieving up to a 9.7% F1-score improvement over the E-GraphSAGE baseline across diverse datasets. An attention-based explainability mechanism further generates compact explanatory subgraphs that highlight the most relevant communication flows, supporting operators in understanding and mitigating attacks. The results demonstrate that the proposed approach effectively balances accuracy, responsiveness, and interpretability, offering a practical foundation for online, explainable intrusion detection in operational environments.