SketchSAGE: Enabling efficient IoT network intrusion detection based on graph neural networks

Abstract

With the rapid expansion of the Internet of Things (IoT) and the corresponding surge in traffic volume, efficient intrusion detection in large-scale traffic environments has become a critical demand. While existing machine learning-based methods show promising performance, they often suffer from inefficient feature extraction in high-speed networks and insufficient contextual awareness to detect sophisticated threats effectively. To address these issues, we introduce SketchSAGE, a novel framework that employs sketch-based feature extraction alongside Graph Neural Networks (GNNs). It adopts the proposed adaptive sketch to efficiently capture multiple critical features from extensive network flows. SketchSAGE leverages these flow-level features to create a dynamic communication graph, which is then processed by an optimized GNN model. By learning edge representations that integrate both flow features and topological context, SketchSAGE achieves efficient real-time detection capabilities for IoT network environments. Evaluations conducted using real-world IoT datasets show that SketchSAGE significantly outperforms state-of-the-art methods, achieving 18% faster training per epoch and 13% lower inference latency while maintaining a high level of detection accuracy.