GRAPH NEURAL NETWORK-BASED INTRUSION DETECTION FOR IOT: PERFORMANCE AND COMPARATIVE ANALYSIS

The rapid proliferation of Internet-of-Things (IoT) devices has created new security challenges, as many smart sensors and gadgets lack robust defenses. Traditional intrusion detection systems (IDS) and conventional ML models do not fully exploit the rich network structure of IoT traffic. In this study, we propose a graph-based IDS that models network flows as nodes in a graph and applies Graph Neural Networks (GNN) to detect anomalies. We form graphs from flow data in the NSL-KDD and BoT-IoT datasets, connecting nodes based on feature similarity. We evaluate three GNN architectures—Graph Convolutional Network (GCN), GraphSAGE, and Graph Attention Network (GAT)—and compare them against a CNN-based IDS and classical ML classifiers (Random Forest, SVM). All models are trained using Google Colab’s TPU with stratified 5-fold cross-validation. Performance is measured by accuracy, F1-score, ROC-AUC, and inference latency on an embedded IoT device (NVIDIA Jetson Nano). Our results show that the GAT-based IDS achieves the best detection performance, with ≈98.3% accuracy and F1≈0.974 on NSL-KDD (about 7% higher than the CNN-IDS baseline). The GNN models also maintain reasonable inference times (~3.1 ms per instance on Jetson Nano). We discuss these findings in the context of recent GNN-based IDS research and highlight how exploiting graph structure improves IoT security.