SketchSAGE: Enabling efficient IoT network intrusion detection based on graph neural networks
TL;DR
SketchSAGE is a novel framework that employs sketch-based feature extraction alongside Graph Neural Networks (GNNs) to efficiently capture multiple critical features from extensive network flows and achieves efficient real-time detection capabilities for IoT network environments.
Abstract
With the rapid expansion of the Internet of Things (IoT) and the corresponding surge in traffic volume, efficient intrusion detection in large-scale traffic environments has become a critical demand. While existing machine learning-based methods show promising performance, they often suffer from inefficient feature extraction in high-speed networks and insufficient contextual awareness to detect sophisticated threats effectively. To address these issues, we introduce SketchSAGE, a novel framework that employs sketch-based feature extraction alongside Graph Neural Networks (GNNs). It adopts the proposed adaptive sketch to efficiently capture multiple critical features from extensive network flows. SketchSAGE leverages these flow-level features to create a dynamic communication graph, which is then processed by an optimized GNN model. By learning edge representations that integrate both flow features and topological context, SketchSAGE achieves efficient real-time detection capabilities for IoT network environments. Evaluations conducted using real-world IoT datasets show that SketchSAGE significantly outperforms state-of-the-art methods, achieving 18% faster training per epoch and 13% lower inference latency while maintaining a high level of detection accuracy.