{"id":"https://openalex.org/W4376480418","doi":"https://doi.org/10.1109/access.2023.3275789","title":"Graph Neural Networks for Intrusion Detection: A Survey","display_name":"Graph Neural Networks for Intrusion Detection: A Survey","publication_year":2023,"publication_date":"2023-01-01","ids":{"openalex":"https://openalex.org/W4376480418","doi":"https://doi.org/10.1109/access.2023.3275789"},"language":"en","primary_location":{"id":"doi:10.1109/access.2023.3275789","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2023.3275789","pdf_url":"https://ieeexplore.ieee.org/ielx7/6287639/10005208/10123384.pdf","source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://ieeexplore.ieee.org/ielx7/6287639/10005208/10123384.pdf","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5033147328","display_name":"Tristan Bilot","orcid":null},"institutions":[],"countries":[],"is_corresponding":true,"raw_author_name":"Tristan Bilot","raw_affiliation_strings":["Iriguard, Puteaux, France","LISITE Laboratory, ISEP, Issy-les-Moulineaux, France"],"raw_orcid":"https://orcid.org/0000-0003-4153-735X","affiliations":[{"raw_affiliation_string":"Iriguard, Puteaux, France","institution_ids":[]},{"raw_affiliation_string":"LISITE Laboratory, ISEP, Issy-les-Moulineaux, France","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5041418831","display_name":"Nour El Madhoun","orcid":"https://orcid.org/0000-0001-7742-7748"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Nour El Madhoun","raw_affiliation_strings":["LISITE Laboratory, ISEP, Issy-les-Moulineaux, France"],"raw_orcid":"https://orcid.org/0000-0001-7742-7748","affiliations":[{"raw_affiliation_string":"LISITE Laboratory, ISEP, Issy-les-Moulineaux, France","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5043476031","display_name":"Khaldoun Al Agha","orcid":"https://orcid.org/0000-0002-6595-5866"},"institutions":[{"id":"https://openalex.org/I1294671590","display_name":"Centre National de la Recherche Scientifique","ror":"https://ror.org/02feahw73","country_code":"FR","type":"government","lineage":["https://openalex.org/I1294671590"]}],"countries":["FR"],"is_corresponding":false,"raw_author_name":"Khaldoun Al Agha","raw_affiliation_strings":["Laboratoire Interdisciplinaire des Sciences du Numérique, CNRS, Université Paris-Saclay, Gif-sur-Yvette, France"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Laboratoire Interdisciplinaire des Sciences du Numérique, CNRS, Université Paris-Saclay, Gif-sur-Yvette, France","institution_ids":["https://openalex.org/I1294671590"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5018045275","display_name":"Anis Zouaoui","orcid":"https://orcid.org/0009-0001-0273-4601"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Anis Zouaoui","raw_affiliation_strings":["Iriguard, Puteaux, France"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Iriguard, Puteaux, France","institution_ids":[]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":4,"corresponding_author_ids":["https://openalex.org/A5033147328"],"corresponding_institution_ids":[],"apc_list":{"value":1850,"currency":"USD","value_usd":1850},"apc_paid":{"value":1850,"currency":"USD","value_usd":1850},"fwci":32.6661,"has_fulltext":true,"cited_by_count":171,"citation_normalized_percentile":{"value":0.99908239,"is_in_top_1_percent":true,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":98,"max":100},"biblio":{"volume":"11","issue":null,"first_page":"49114","last_page":"49139"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9997000098228455,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9997000098228455,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.9947999715805054,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.9927999973297119,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8357195854187012},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.5461065769195557},{"id":"https://openalex.org/keywords/machine-learning","display_name":"Machine learning","score":0.5132932066917419},{"id":"https://openalex.org/keywords/robustness","display_name":"Robustness (evolution)","score":0.49926328659057617},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.49422815442085266},{"id":"https://openalex.org/keywords/graph","display_name":"Graph","score":0.46864694356918335},{"id":"https://openalex.org/keywords/deep-learning","display_name":"Deep learning","score":0.46396055817604065},{"id":"https://openalex.org/keywords/feature-learning","display_name":"Feature learning","score":0.421817421913147},{"id":"https://openalex.org/keywords/data-science","display_name":"Data science","score":0.33634448051452637},{"id":"https://openalex.org/keywords/theoretical-computer-science","display_name":"Theoretical computer science","score":0.33272889256477356},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.32589924335479736}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8357195854187012},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.5461065769195557},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.5132932066917419},{"id":"https://openalex.org/C63479239","wikidata":"https://www.wikidata.org/wiki/Q7353546","display_name":"Robustness (evolution)","level":3,"score":0.49926328659057617},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.49422815442085266},{"id":"https://openalex.org/C132525143","wikidata":"https://www.wikidata.org/wiki/Q141488","display_name":"Graph","level":2,"score":0.46864694356918335},{"id":"https://openalex.org/C108583219","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep learning","level":2,"score":0.46396055817604065},{"id":"https://openalex.org/C59404180","wikidata":"https://www.wikidata.org/wiki/Q17013334","display_name":"Feature learning","level":2,"score":0.421817421913147},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.33634448051452637},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.33272889256477356},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.32589924335479736},{"id":"https://openalex.org/C104317684","wikidata":"https://www.wikidata.org/wiki/Q7187","display_name":"Gene","level":2,"score":0.0},{"id":"https://openalex.org/C185592680","wikidata":"https://www.wikidata.org/wiki/Q2329","display_name":"Chemistry","level":0,"score":0.0},{"id":"https://openalex.org/C55493867","wikidata":"https://www.wikidata.org/wiki/Q7094","display_name":"Biochemistry","level":1,"score":0.0}],"mesh":[],"locations_count":3,"locations":[{"id":"doi:10.1109/access.2023.3275789","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2023.3275789","pdf_url":"https://ieeexplore.ieee.org/ielx7/6287639/10005208/10123384.pdf","source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},{"id":"pmh:oai:HAL:hal-04099607v1","is_oa":false,"landing_page_url":"https://hal.science/hal-04099607","pdf_url":null,"source":{"id":"https://openalex.org/S4306402512","display_name":"HAL (Le Centre pour la Communication Scientifique Directe)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I1294671590","host_organization_name":"Centre National de la Recherche Scientifique","host_organization_lineage":["https://openalex.org/I1294671590"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"IEEE Access, 2023, pp.1-1. ⟨10.1109/ACCESS.2023.3275789⟩","raw_type":"Journal articles"},{"id":"pmh:oai:doaj.org/article:4d5d8f3cde9643acbce631f5edbe8ab5","is_oa":true,"landing_page_url":"https://doaj.org/article/4d5d8f3cde9643acbce631f5edbe8ab5","pdf_url":null,"source":{"id":"https://openalex.org/S4306401280","display_name":"DOAJ (DOAJ: Directory of Open Access Journals)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"IEEE Access, Vol 11, Pp 49114-49139 (2023)","raw_type":"article"}],"best_oa_location":{"id":"doi:10.1109/access.2023.3275789","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2023.3275789","pdf_url":"https://ieeexplore.ieee.org/ielx7/6287639/10005208/10123384.pdf","source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/16","score":0.5600000023841858,"display_name":"Peace, Justice and strong institutions"}],"awards":[],"funders":[],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4376480418.pdf","grobid_xml":"https://content.openalex.org/works/W4376480418.grobid-xml"},"referenced_works_count":174,"referenced_works":["https://openalex.org/W192671640","https://openalex.org/W1501856433","https://openalex.org/W1513231349","https://openalex.org/W1538131130","https://openalex.org/W1614298861","https://openalex.org/W1924770834","https://openalex.org/W1991210879","https://openalex.org/W2009232481","https://openalex.org/W2021963610","https://openalex.org/W2026258420","https://openalex.org/W2031163547","https://openalex.org/W2064675550","https://openalex.org/W2077488147","https://openalex.org/W2093882311","https://openalex.org/W2097101695","https://openalex.org/W2116341502","https://openalex.org/W2127426251","https://openalex.org/W2133564696","https://openalex.org/W2136922672","https://openalex.org/W2154851992","https://openalex.org/W2167240430","https://openalex.org/W2170646878","https://openalex.org/W2242161203","https://openalex.org/W2284900416","https://openalex.org/W2294333398","https://openalex.org/W2296509296","https://openalex.org/W2407590826","https://openalex.org/W2476891002","https://openalex.org/W2579372251","https://openalex.org/W2604314403","https://openalex.org/W2604763608","https://openalex.org/W2606780347","https://openalex.org/W2743104969","https://openalex.org/W2765424254","https://openalex.org/W2767094836","https://openalex.org/W2789828921","https://openalex.org/W2800695847","https://openalex.org/W2803697594","https://openalex.org/W2805516822","https://openalex.org/W2807786182","https://openalex.org/W2843523788","https://openalex.org/W2887955655","https://openalex.org/W2906943923","https://openalex.org/W2911286998","https://openalex.org/W2914999862","https://openalex.org/W2951659295","https://openalex.org/W2952915411","https://openalex.org/W2962711740","https://openalex.org/W2962756421","https://openalex.org/W2962963847","https://openalex.org/W2963312446","https://openalex.org/W2963748489","https://openalex.org/W2964015378","https://openalex.org/W2964321699","https://openalex.org/W2969696968","https://openalex.org/W2972317931","https://openalex.org/W2980576170","https://openalex.org/W2986944522","https://openalex.org/W2990045899","https://openalex.org/W2990908872","https://openalex.org/W2991408690","https://openalex.org/W2996806689","https://openalex.org/W2997574889","https://openalex.org/W2998038410","https://openalex.org/W3005127313","https://openalex.org/W3006711782","https://openalex.org/W3011482926","https://openalex.org/W3033091443","https://openalex.org/W3036484052","https://openalex.org/W3081450661","https://openalex.org/W3082712634","https://openalex.org/W3092184926","https://openalex.org/W3092382617","https://openalex.org/W3102359135","https://openalex.org/W3103557498","https://openalex.org/W3103720336","https://openalex.org/W3104097132","https://openalex.org/W3106006733","https://openalex.org/W3106355239","https://openalex.org/W3115798218","https://openalex.org/W3122137342","https://openalex.org/W3123893801","https://openalex.org/W3126165507","https://openalex.org/W3130138053","https://openalex.org/W3136205675","https://openalex.org/W3158906645","https://openalex.org/W3161769470","https://openalex.org/W3162956350","https://openalex.org/W3168146198","https://openalex.org/W3171592446","https://openalex.org/W3176065393","https://openalex.org/W3191490876","https://openalex.org/W3198565628","https://openalex.org/W3198703695","https://openalex.org/W3200780444","https://openalex.org/W3206617323","https://openalex.org/W3208773001","https://openalex.org/W3211430557","https://openalex.org/W3211805421","https://openalex.org/W3212868562","https://openalex.org/W3216081894","https://openalex.org/W3216267479","https://openalex.org/W3217748719","https://openalex.org/W4200107777","https://openalex.org/W4200304719","https://openalex.org/W4205275566","https://openalex.org/W4205577106","https://openalex.org/W4210803071","https://openalex.org/W4226236538","https://openalex.org/W4281385944","https://openalex.org/W4281617842","https://openalex.org/W4282963615","https://openalex.org/W4285157251","https://openalex.org/W4285596339","https://openalex.org/W4286225095","https://openalex.org/W4286858940","https://openalex.org/W4287390814","https://openalex.org/W4293651439","https://openalex.org/W4294170691","https://openalex.org/W4294558607","https://openalex.org/W4296899769","https://openalex.org/W4297733535","https://openalex.org/W4304820095","https://openalex.org/W4306317402","https://openalex.org/W4307042912","https://openalex.org/W4311703141","https://openalex.org/W4312676126","https://openalex.org/W4312948208","https://openalex.org/W4313889327","https://openalex.org/W4320024068","https://openalex.org/W4324029729","https://openalex.org/W4360851419","https://openalex.org/W6607795947","https://openalex.org/W6630632610","https://openalex.org/W6632100814","https://openalex.org/W6636510571","https://openalex.org/W6640212811","https://openalex.org/W6678846912","https://openalex.org/W6679434410","https://openalex.org/W6681096077","https://openalex.org/W6682691769","https://openalex.org/W6690230747","https://openalex.org/W6699364125","https://openalex.org/W6713930180","https://openalex.org/W6720006811","https://openalex.org/W6726873649","https://openalex.org/W6729508183","https://openalex.org/W6732461846","https://openalex.org/W6736057607","https://openalex.org/W6736685754","https://openalex.org/W6738964360","https://openalex.org/W6744557953","https://openalex.org/W6751494907","https://openalex.org/W6751796012","https://openalex.org/W6753331806","https://openalex.org/W6754722652","https://openalex.org/W6754929296","https://openalex.org/W6755573351","https://openalex.org/W6767288045","https://openalex.org/W6774909299","https://openalex.org/W6781460436","https://openalex.org/W6782319988","https://openalex.org/W6784004519","https://openalex.org/W6784322088","https://openalex.org/W6785773631","https://openalex.org/W6789146462","https://openalex.org/W6797080381","https://openalex.org/W6803412108","https://openalex.org/W6804451428","https://openalex.org/W6805614776","https://openalex.org/W6811522208","https://openalex.org/W6839877188","https://openalex.org/W6888517835","https://openalex.org/W6905010448"],"related_works":["https://openalex.org/W4380075502","https://openalex.org/W4223943233","https://openalex.org/W4312200629","https://openalex.org/W4360585206","https://openalex.org/W4364306694","https://openalex.org/W4380086463","https://openalex.org/W4225161397","https://openalex.org/W3014300295","https://openalex.org/W3164822677","https://openalex.org/W2795261237"],"abstract_inverted_index":{"Cyberattacks":[0],"represent":[1],"an":[2],"ever-growing":[3],"threat":[4],"that":[5,87,187,206],"has":[6],"become":[7,100],"a":[8,78,85],"real":[9],"priority":[10],"for":[11,43,71,90,117],"most":[12],"organizations.":[13],"Attackers":[14],"use":[15],"sophisticated":[16],"attack":[17],"scenarios":[18],"to":[19,25,47,50,61,92,146,161,172],"deceive":[20],"defense":[21],"systems":[22],"in":[23,102,144,211],"order":[24],"access":[26],"private":[27],"data":[28,59,185],"or":[29,126],"cause":[30],"harm.":[31],"Machine":[32],"Learning":[33,37],"(ML)":[34],"and":[35,81,129,166,178,191,242,248],"Deep":[36],"(DL)":[38],"have":[39,99,114],"demonstrate":[40],"impressive":[41],"results":[42],"detecting":[44],"cyberattacks":[45],"due":[46],"their":[48],"ability":[49],"learn":[51,216],"generalizable":[52],"patterns":[53,141],"from":[54,106,132],"flat":[55,58],"data.":[56,112],"However,":[57],"fail":[60],"capture":[62],"the":[63,107,139,155,162,183,195,200,228,240],"structural":[64,140],"behavior":[65],"of":[66,84,142,157,164,230,244],"attacks,":[67,143],"which":[68],"is":[69,88],"essential":[70],"effective":[72,217],"detection.":[73],"Contrarily,":[74],"graph":[75,158,184],"structures":[76,134,186],"provide":[77],"more":[79],"robust":[80],"abstract":[82],"view":[83],"system":[86],"difficult":[89],"attackers":[91],"evade.":[93],"Recently,":[94],"Graph":[95],"Neural":[96],"Networks":[97],"(GNNs)":[98],"successful":[101],"learning":[103,130,160],"useful":[104],"representations":[105,131,218],"semantic":[108],"provided":[109],"by":[110],"graph-structured":[111],"Intrusions":[113],"been":[115],"detected":[116],"years":[118],"using":[119],"graphs":[120,125],"such":[121],"as":[122],"network":[123,177],"flow":[124],"provenance":[127],"graphs,":[128],"these":[133,231],"can":[135,188,215],"help":[136],"models":[137],"understand":[138],"addition":[145],"traditional":[147],"features.":[148],"In":[149],"this":[150],"survey,":[151],"we":[152,181,192,238],"focus":[153],"on":[154,234],"applications":[156],"representation":[159],"detection":[163,247],"network-based":[165],"host-based":[167],"intrusions,":[168],"with":[169,199],"special":[170],"attention":[171],"GNN":[173],"methods.":[174],"For":[175],"both":[176],"host":[179],"levels,":[180],"present":[182],"be":[189],"leveraged":[190],"comprehensively":[193],"review":[194],"state-of-the-art":[196],"papers":[197],"along":[198],"used":[201],"datasets.":[202],"Our":[203],"analysis":[204],"reveals":[205],"GNNs":[207],"are":[208],"particularly":[209],"efficient":[210],"cybersecurity,":[212],"since":[213],"they":[214],"without":[219],"requiring":[220],"any":[221],"external":[222],"domain":[223],"knowledge.":[224],"We":[225],"also":[226],"evaluate":[227],"robustness":[229],"techniques":[232],"based":[233],"adversarial":[235],"attacks.":[236],"Finally,":[237],"discuss":[239],"strengths":[241],"weaknesses":[243],"GNN-based":[245],"intrusion":[246],"identify":[249],"future":[250],"research":[251],"directions.":[252]},"counts_by_year":[{"year":2026,"cited_by_count":41},{"year":2025,"cited_by_count":85},{"year":2024,"cited_by_count":40},{"year":2023,"cited_by_count":5}],"updated_date":"2026-06-02T09:04:35.204637","created_date":"2025-10-10T00:00:00"}