GAT-AID: A Graph Attention-Based Dual-Branch Framework for Scalable Anomaly and Intrusion Detection

Wankhade, Nitin; Khandare, Anand

doi:10.22042/isecure.2026.542048.1244

GAT-AID: A Graph Attention-Based Dual-Branch Framework for Scalable Anomaly and Intrusion Detection

Document Type : Research Article

Authors

Nitin Wankhade

Anand Khandare

Thakur College of Engineering & Technology, Computer Engineering Department, Mumbai, Maharashtra, India

https://doi.org/10.22042/isecure.2026.542048.1244

Abstract

Intrusion Detection Systems (IDS) are vital for defending modern networks against emerging cyber threats, including zero-day attacks. In this article, we introduce GAT-AID (Graph Attention-based Anomaly and Intrusion Detection), an IDS architecture that integrates Graph Attention Networks (GATs), Multi-Layer Perceptron (MLP) classifiers, and Autoencoders. The proposed methodology represents network traffic as a graph, allowing GAT to extract complex node-wise associations across traffic flows. The embeddings generated are further processed through a dual-branch architecture, an MLP-based classifier for identifying known attack types, and an Autoencoder-based anomaly detector for flagging zero-day intrusions. The proposed GAT-AID methodology is evaluated on two widely used benchmark datasets, namely CICIDS2017 and UNSW-NB15. The experiment results demonstrate that it outperforms conventional IDS baselines, including SVM, Random Forest, CNN, and GCN models, achieving higher detection rates, improved robustness against unseen threats, and greater adaptability to evolving network environments. These findings suggest that GAT-AID is an effective and scalable solution for intelligent, real-time intrusion detection.

Keywords

Anomaly Detection

Autoencoder

Graph Neural Networks

Intrusion Detection Systems

Zero-Day Attacks

[1] N. Lin, L. Wu, Y. Liu, L. Xu, Z. Lin, T. Huang, and H. Liu. Dynamic malware detection method based on graph neural networks. In Proceedings of the 8th World Conference on Computer Communication Technology (WCCCT), pages 309– 315, April 2025.

[2] Z. Guo. Big data mining algorithm for malicious behavior feature extraction and application in network security. In Proceedings of the 2nd International Conference on Big Data, Computing Intelligence, and Applications (BDCIA), volume 13550, pages 270–277, March 2025.

[3] Y. Wang, Z. Han, Y. Du, J. Li, and X. He. Bsgat: A network intrusion detection system based on graph neural network for edge computing. Cybersecurity, 8(1):27, 2025.

[4] X. Deng, J. Zhu, X. Pei, L. Zhang, Z. Ling, and K. Xue. Flow topology-based graph convolutional network for intrusion detection in labellimited iot networks. IEEE Transactions on Network and Service Management, 20(1):684–696, March 2023.

[5] P. Veličković, G. Cucurull, A. Casanova, A. Romero, P. Liò, and Y. Bengio. Graph attention networks. In International Conference on Learning Representations (ICLR), Toulon, France, April 2018.

[6] T. Bilot, N. El Madhoun, K. Al Agha, and A. Zouaoui. Graph neural networks for intrusion detection: A survey. IEEE Access, 11:49114– 49139, 2023.

[7] A. Salehi, S. Ahmadi, and M. R. Aref. A semisupervised ids for cyber-physical systems using a deep learning approach. ISeCure, 15(3):43–50, 2023.

[8] H. Shadabfar, M. Dehghan, and B. Sadeghian. Dsrl-apt-2023: A new synthetic dataset for advanced persistent threats. ISeCure, 17(2):107– 116, 2025.

[9] C. Wu, J. Sun, J. Chen, M. Alazab, Y. Liu, and Y. Xiang. Tcg-ids: Robust network intrusion detection via temporal contrastive graph learning. IEEE Transactions on Information Forensics and Security, 20:1475–1486, 2025.

[10] S. B. Park, H. J. Jo, and D. H. Lee. G-idcs: Graph-based intrusion detection and classification system for can protocol. IEEE Access, 11:39213–39227, 2023.

[11] H. Zhang, K. Zeng, and S. Lin. Federated graph neural network for fast anomaly detection in controller area networks. IEEE Transactions on Information Forensics and Security, 18:1566– 1579, 2023.

[12] J. Xiao, H. Chen, and F. Zhong. A novel feature extraction framework using a graph node attention network for in-vehicle network intrusion detection. IEEE Systems Journal, 18(1):150–161, 2024.

[13] M. Wang, N. Yang, and N. Weng. K-getnid: Knowledge-guided graphs for early and transferable network intrusion detection. IEEE Transactions on Information Forensics and Security, 2024. In press.

[14] D. H. Tran and M. Park. Graph embedding for a graph neural network in an intrusion detection system. In Proceedings of the International Conference on Information Networking (ICOIN), pages 395–397, January 2024.

[15] B. J. Saunders, R. E. de Grande, G. H. S. Carvalho, and I. Woungang. Deep graph learning for ddos detection and multi-class classification ids. In IEEE International Conference on Cyber Security and Resilience (CSR), pages 96–100, September 2024.

[16] S. W. Lee, J. Y. Lee, and T. J. Lee. Graph neural networks for network intrusion detection: An ip behavioral analysis perspective. In Silicon Valley Cybersecurity Conference (SVCC), pages 1–4, June 2024.

[17] B. J. Saunders, P. Kisanga, G. H. S. Carvalho, and I. Woungang. A graph convolutional network-based ddos detection model. In IEEE International Systems Conference (SysCon), pages 1–5, April 2024.

[18] S. P. Singh, B. Abhay, A. Kumar, P. Agrawal, D. Singh, and V. Ghosh. An efficient approach using a graphical neural network for a network intrusiondetectionsystem. InInternational Conference on Computing Communication and Networking Technologies (ICCCNT), pages 1–11, June 2024.

[19] M. A. Daoud, S. A. M. Mostefaoui, H. M. Meghazi, O. Labbadi, C. Zenina, and A. Bouguessa. Advanced intrusion detection systems leveraging knowledge graph-based techniques. In International Conference on Systems and Control (ICSC), pages 424–428, November 2024.

[20] N. A. T. Phung, A. Nguyen, and M. T. Nguyen. Network intrusion detection system using a graph attention network and particle swarm optimization. In International Conference on Advanced Technologies for Communications (ATC), pages 378–382, October 2024.

[21] K. Kim, M. Sohn, and J. Kim. Cross-domain explainable recommendation using graph convolutional networks and a topic model. IEEE Access, 13:118310–118323, 2025.

[22] M. U. Rehman, H. Ahmadi, and W. U. Hassan. Flash: A comprehensive approach to intrusion detection via provenance graph representation learning. In IEEE Symposium on Security and Privacy (SP), pages 3552–3570, May 2024.

[23] N. Sharma, M. Swarnkar, and B. Mondal. Webwall: Zero-day attack detection in web traffic using a spatial graph neural network. In IEEE International Conference on Advanced Networks and Telecommunications Systems (ANTS), pages 1–6, December 2024.

[24] A. Alharbi and K. Alsubhi. Botnet detection approach using graph-based machine learning. IEEE Access, 9:99166–99180, 2021.

[25] M. Dehghan and E. Khosravain. Smart grid security: Proactive prediction of advanced persistent threats. Computer and Knowledge Engineering, 8(2):25–40, 2025.