Robust Intrusion Detection with GCN-AE: A One-Class GNN Approach

Abstract

Designing Intrusion Detection Systems (IDS) that are robust against both known and emerging threats remains a critical challenge in cybersecurity. Traditional graph-based IDS approaches often rely on supervised learning, which requires large labeled datasets and struggles against evasion tactics that deviate from known attack patterns. To overcome these limitations, recent research has explored unsupervised, self-supervised, and semi-supervised learning methods that focus on modeling normal behavior to detect anomalies. Autoencoders have proven effective in learning compact and informative representations. Building on this, we propose GCN-AE, a novel one-class Graph Neural Network (GNN) model that integrates Graph Convolutional Network (GCN) layers within an Autoencoder framework. The model incorporates a specialized message-passing mechanism designed to capture normative network traffic behavior, enabling it to detect deviations without prior knowledge of attack signatures. We evaluate GCN-AE on the NF-UQ-NIDS-v1 dataset under a binary classification setting. Experimental results show that the proposed model outperforms existing approaches and exhibits strong robustness against zero-day, adversarial, and camouflage attacks. These results highlight the promise of combining GCNs with Autoencoders to enhance the adaptability and resilience of network-based IDS, providing a more effective solution for detecting both known and unknown threats in real network environments.