{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/e-graphsage-a-graph-neural-network-based","title":"E-GraphSAGE: A Graph Neural Network based Intrusion Detection System for IoT","arxiv_id":"2103.16329","date":"2021-03-30","proceeding":null,"authors":["Wai Weng Lo","Siamak Layeghy","Mohanad Sarhan","Marcus Gallagher","Marius Portmann"],"abstract":"This paper presents a new Network Intrusion Detection System (NIDS) based on Graph Neural Networks (GNNs). GNNs are a relatively new sub-field of deep neural networks, which can leverage the inherent structure of graph-based data. Training and evaluation data for NIDSs are typically represented as flow records, which can naturally be represented in a graph format. In this paper, we propose E-GraphSAGE, a GNN approach that allows capturing both the edge features of a graph as well as the topological information for network intrusion detection in IoT networks. To the best of our knowledge, our proposal is the first successful, practical, and extensively evaluated approach of applying GNNs on the problem of network intrusion detection for IoT using flow-based data. Our extensive experimental evaluation on four recent NIDS benchmark datasets shows that our approach outperforms the state-of-the-art in terms of key classification metrics, which demonstrates the potential of GNNs in network intrusion detection, and provides motivation for further research.","url_abs":"https://arxiv.org/abs/2103.16329v8","url_pdf":"https://arxiv.org/pdf/2103.16329v8.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"e-graphsage-a-graph-neural-network-based","repo_url":"https://github.com/waimorris/E-GraphSAGE","is_official":1,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok","spdx":"Apache-2.0"}},{"paper_slug":"e-graphsage-a-graph-neural-network-based","repo_url":"https://github.com/George730/E-ResGAT","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":null},{"paper_slug":"e-graphsage-a-graph-neural-network-based","repo_url":"https://github.com/cheng0719/E-GraphSAGE_NIDS","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok"}}],"tasks":[{"task_slug":"anomaly-detection","task_name":"Anomaly Detection"},{"task_slug":"graph-neural-network","task_name":"Graph Neural Network"},{"task_slug":"graph-representation-learning","task_name":"Graph Representation Learning"},{"task_slug":"intrusion-detection","task_name":"Intrusion Detection"},{"task_slug":"network-intrusion-detection","task_name":"Network Intrusion Detection"},{"task_slug":"representation-learning","task_name":"Representation Learning"}],"methods":[{"method_slug":"graphsage","method_name":"GraphSAGE"}],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2103.16329","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2103.16329"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/George730/E-ResGAT","reach":null},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/waimorris/E-GraphSAGE","reach":{"status":"ok","spdx":"Apache-2.0"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/cheng0719/E-GraphSAGE_NIDS","reach":{"status":"ok"}}],"summary":{"ran_fixture":1},"by_repo_kind":{"listed":{"samples":1,"ran":1,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":1,"samples":[{"code_sha256_prefix":"e9fde43f0c3c7567","entry":"predict_","repo":"George730/E-ResGAT","repo_kind":"listed","path":"fit_model.py","file_url":"https://github.com/George730/E-ResGAT/blob/HEAD/fit_model.py","link_basis":"first_harvest_node","language":"python","status":"ran_fixture","verification_level":1,"contract_check":"RAISES","metamorphic_tier":"deterministic","behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"e9fde43f0c3c7567"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}