The Method of Malicious Traffic Detection for Internet of Things Based on Lightweight Graph Neural Networks

Abstract

: With the sustained expansion of complex Internet of Things (IoT) ecosystems, malicious traffic detection has become critical for maintaining both cyber security and operational continuity. Modern IoT deployments contain heterogeneous devices, ubiquitous sensing layers, edge services, and autonomous assets, so abnormal communication may affect not only data confidentiality but also physical operations. To address the limitations of independent flow-level detection and heavy graph propagation, this paper proposes a Lightweight Graph-Attentive Network for Traffic Detection (LGNT). LGNT constructs a directed traffic-interaction graph from NetFlow records, where communication entities are represented as nodes and traffic sessions are represented as edges. Communication-strength-based auxiliary node supervision provides an activity-aware structural signal, while a compact backbone combining topology adaptive graph convolution (TAGConv) and graph attention v2 convolution (GATv2Conv) captures local topological dependencies and key communication relations. A structure-significance pruning strategy is further introduced to reduce the message-passing edge set and graph computation overhead. Experiments on NetFlow BoT-IoT (NF-BoT-IoT) and NetFlow ToN-IoT (NF-ToN-IoT) show that LGNT obtains effective results in both binary and multi-class detection tasks. Specifically, it achieves 94.28% accuracy, 97.36% area under the curve (AUC), and 86.88% F1 on NF-BoT-IoT, and 99.93% accuracy, 99.95% AUC, and 69.05% weighted F1 on NF-ToN-IoT. The per-class analysis further shows that long-tailed minority categories remain challenging in fine-grained NF-ToN-IoT recognition. Overall, LGNT improves the balance between traffic-interaction modeling, detection performance, and deployment efficiency while keeping the parameter scale at 0.236 million.