Mehmet Baris Yaman , Foundational Technology, Turkey

Network intrusion detection in Internet of Things (IoT) environments presents unique challenges due to the scale, heterogeneity and dynamic nature of device interactions. Although graph neural networks (GNNs) have demonstrated promising results by modeling network topology, standard edge-level classification approaches leave substantial room for improvement. This paper introduces three GNN architectures that advance the state-of-the-art through distinct mechanisms: Prototype-GNN, which employs distance-based classification with learnable prototypes to capture diverse attack patterns; ContrastiveGNN, which optimizes embedding geometry through supervised contrastive learning; and GSL-GNN, which learns optimal graph structure adaptively from node features. Evaluated on the TON IoT dataset, our approaches achieve 94.24%, 94.71% and 96.66% accuracy, respectively, representing improvements of +2.37, +2.84, and +4.79 percentage points over the baseline EdgeLevelGCN (91.87%). GSL-GNN achieves near-perfect discrimination with 99.70% ROC-AUC and only 1.5% false positive rate. Our mechanisms generalize beyond network security to any edge classification task on graphs, convolutional neural networks, and knowledge graphs.

Graph Neural Networks, Network Intrusion Detection, IoT, Security, Prototype Learning, Contrastive Learning, Graph Structure Learning, Deep Learning