Explainable Graph Neural Networks for Network Intrusion Detection Systems

open_access
Open Access
Author:
Wilson, Cayden
Area of Honors:
Data Sciences
Degree:
Bachelor of Science
Document Type:
Thesis
Thesis Supervisors:
Suhang Wang, Thesis Supervisor
John Yen, Thesis Honors Advisor
Keywords:
Machine Learning
Graph Neural Network
Cybersecurity
Networking
Data Science
Abstract:
The arrival of the Internet of Things has drastically increased the scale and complexity of our networks. Traditional network intrusion detection systems (NIDS) can detect malicious traffic patterns and statistical anomalies, but there is limited capability in detecting novel attack patterns. Machine learning architectures prove to be useful for NIDS, and graph neural network (GNN) models are an appealing choice for ML-based network intrusion detection systems. These architectures use a message passing mechanism to extract relational information about the flow of network data between devices. While highly accurate in binary detection scenarios, many ML-based algorithms may fail to detect attack types accurately in multiclass classification scenarios. Understanding the outputs of NIDS models is crucial, and GNN explainer methodologies can reveal which subgraphs and features were most influential in GNN model outputs. A GNN model is implemented and evaluated with a graph explainer methodology to examine the output’s relevance to a particular class of cyber-attack. This process can help system administrators to build confidence in AI-driven network monitoring tools while also allowing for understanding where the model deviates from our expectations.