{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,11]],"date-time":"2026-04-11T05:55:35Z","timestamp":1775886935491,"version":"3.50.1"},"reference-count":40,"publisher":"Springer Science and Business Media LLC","issue":"1","license":[{"start":{"date-parts":[[2025,4,24]],"date-time":"2025-04-24T00:00:00Z","timestamp":1745452800000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"},{"start":{"date-parts":[[2025,4,24]],"date-time":"2025-04-24T00:00:00Z","timestamp":1745452800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Cybersecurity"],"abstract":"<jats:title>Abstract<\/jats:title>\n          <jats:p>The emergence of Edge Computing has led to an increasingly intricate and widespread issue of network infiltration in Edge Computing devices. Therefore, it is crucial to explore intelligent, automated, and resilient methods for network intrusion detection. Graph neural network-based techniques for network intrusion detection have been proposed by many scholars recently. However, the graph construction methods of these approaches cannot fully adapt to real network intrusion datasets, leading to problems such as overfitting and insufficient graph information mining. Furthermore, the methods employed in the model training phase are relatively limited, failing to consider the characteristic presence of grouping within networks. These shortcomings result in a lack of high accuracy in intrusion detection systems, especially in multi-class classification scenarios. This research suggests a graph neural network technique based on behavior similarity employing a graph attention network (BS-GAT) to handle the aforementioned problem. To address overfitting and inadequate graph information mining, a behavioral similarity-based graph creation method is first presented through an analysis of real datasets. Subsequently, the inclusion of edge behavioral relationship weights into the GAT leverages the relationship between data flow and graph structural information, enhancing the performance of the trained model. In the final stage, experiments were executed using the most recent datasets to assess the effectiveness of the proposed behavior similarity-based graph attention network in network intrusion detection. The findings indicate that the proposed approach is highly effective and significantly outperforms existing solutions. In binary classification, recall, precision, f1-score, and accuracy all exceed 99%. For multi-class performance, the recognition accuracy exceeds 93%, the weighted recall surpasses 91%, and the weighted f1-score exceeds 92%, showing a substantial improvement in multi-class recognition effectiveness.<\/jats:p>","DOI":"10.1186\/s42400-024-00296-8","type":"journal-article","created":{"date-parts":[[2025,4,24]],"date-time":"2025-04-24T02:02:05Z","timestamp":1745460125000},"update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":18,"title":["BS-GAT: a network intrusion detection system based on graph neural network for edge computing"],"prefix":"10.1186","volume":"8","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-3823-6230","authenticated-orcid":false,"given":"Yalu","family":"Wang","sequence":"first","affiliation":[]},{"given":"Zhijie","family":"Han","sequence":"additional","affiliation":[]},{"given":"Ying","family":"Du","sequence":"additional","affiliation":[]},{"given":"Jie","family":"Li","sequence":"additional","affiliation":[]},{"given":"Xin","family":"He","sequence":"additional","affiliation":[]}],"member":"297","published-online":{"date-parts":[[2025,4,24]]},"reference":[{"issue":"3","key":"296_CR1","doi-asserted-by":"publisher","first-page":"530","DOI":"10.3390\/math10030530","volume":"10","author":"I Ahmad","year":"2022","unstructured":"Ahmad I, Ul Haq QE, Imran M et al (2022) An efficient network intrusion detection and classification system. Mathematics 10(3):530. https:\/\/doi.org\/10.3390\/math10030530","journal-title":"Mathematics"},{"issue":"5","key":"296_CR2","doi-asserted-by":"publisher","first-page":"12","DOI":"10.1109\/MCE.2022.3193268","volume":"12","author":"A Aljuhani","year":"2022","unstructured":"Aljuhani A, Kumar P, Kumar R et al (2022) Fog intelligence for secure smart villages: architecture and future challenges. IEEE Consum Electron Mag 12(5):12\u201321. https:\/\/doi.org\/10.1109\/MCE.2022.3193268","journal-title":"IEEE Consum Electron Mag"},{"key":"296_CR3","doi-asserted-by":"publisher","first-page":"100818","DOI":"10.1016\/j.iot.2023.100818","volume":"22","author":"T Altaf","year":"2023","unstructured":"Altaf T, Wang X, Ni W et al (2023) A new concatenated multigraph neural network for iot intrusion detection. Internet of Things 22:100818. https:\/\/doi.org\/10.1016\/j.iot.2023.100818","journal-title":"Internet of Things"},{"key":"296_CR4","doi-asserted-by":"publisher","first-page":"14792","DOI":"10.1007\/s10489-022-04039-5","volume":"53","author":"S Anjhpsp","year":"2023","unstructured":"Anjhpsp S et al (2023) On-device context-aware misuse detection framework for heterogeneous IoT edge. Appl Intell 53:14792\u201314818. https:\/\/doi.org\/10.1007\/s10489-022-04039-5","journal-title":"Appl Intell"},{"issue":"10","key":"296_CR5","doi-asserted-by":"publisher","first-page":"1565","DOI":"10.1093\/comjnl\/bxr035","volume":"54","author":"MH Bhuyan","year":"2011","unstructured":"Bhuyan MH, Bhattacharyya DK, Kalita JK (2011) Surveying port scans and their detection methodologies. Comput J 54(10):1565\u20131581. https:\/\/doi.org\/10.1093\/comjnl\/bxr035","journal-title":"Comput J"},{"key":"296_CR6","doi-asserted-by":"publisher","unstructured":"Chang L and Paula B (2021) Graph-based Solutions with Residuals for Intrusion Detection: the Modified E-GraphSAGE and E-ResGAT Algorithms. arXiv preprint arXiv:2111.13597. https:\/\/doi.org\/10.48550\/arXiv.2111.13597","DOI":"10.48550\/arXiv.2111.13597"},{"key":"296_CR7","doi-asserted-by":"publisher","first-page":"2","DOI":"10.3390\/s21020446","volume":"21","author":"A Churcher","year":"2021","unstructured":"Churcher A, Ullah R, Ahmad J, Rehman S, Masood F, Gogate M, Alqahtani F, Nour B, Buchanan WJ (2021) An experimental analysis of attack classification using machine learning in IoT networks. Sensors 21:2. https:\/\/doi.org\/10.3390\/s21020446","journal-title":"Sensors"},{"issue":"1","key":"296_CR8","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1186\/s42400-021-00103-8","volume":"5","author":"RA Disha","year":"2022","unstructured":"Disha RA, Waheed S (2022) Performance analysis of machine learning models for intrusion detection system using Gini Impurity-based Weighted Random Forest (GIWRF) feature selection technique. Cybersecurity 5(1):1. https:\/\/doi.org\/10.1186\/s42400-021-00103-8","journal-title":"Cybersecurity"},{"key":"296_CR9","doi-asserted-by":"publisher","first-page":"146","DOI":"10.2307\/1924845","volume":"5","author":"R Dorfman","year":"1979","unstructured":"Dorfman R (1979) A formula for the Gini coefficient. Rev Econ Stat 5:146\u2013149. https:\/\/doi.org\/10.2307\/1924845","journal-title":"Rev Econ Stat"},{"key":"296_CR10","doi-asserted-by":"publisher","unstructured":"Ghasempour (2019) Internet of things in smart grid: Architecture, applications, services, key technologies, and challenges. Inventions 4(1): 22. https:\/\/doi.org\/10.3390\/inventions4010022","DOI":"10.3390\/inventions4010022"},{"key":"296_CR11","unstructured":"Hamilton WL, Ying R, Leskovec J (2017) Inductive representation learning on large graphs. In: Proceedings of the 31st international conference on neural information processing systems, ser. NIPS\u201917, Long Beach, California, USA: Curran Associates Inc., pp 1025\u20131035, ISBN: 9781510860964 Available Link: https:\/\/proceedings.neurips.cc\/paper_files\/paper\/2017\/hash\/5dd9db5e033da9c6fb5ba83c7a7ebea9-Abstract.html"},{"key":"296_CR12","doi-asserted-by":"publisher","first-page":"183207","DOI":"10.1109\/ACCESS.2019.2959131","volume":"7","author":"H He","year":"2019","unstructured":"He H, Sun X, He H, Zhao G, He L, Ren J (2019) A novel multimodal-sequential approach based on multiview features for network intrusion detection. IEEE Access 7:183207\u2013183221","journal-title":"IEEE Access"},{"issue":"3","key":"296_CR13","doi-asserted-by":"publisher","first-page":"1727","DOI":"10.1109\/TITS.2020.3025685","volume":"23","author":"R Islam","year":"2020","unstructured":"Islam R, Refat RUD, Yerram SM et al (2020) Graph-based intrusion detection system for controller area networks. IEEE Trans Intell Transp Syst 23(3):1727\u20131736. https:\/\/doi.org\/10.1109\/TITS.2020.3025685","journal-title":"IEEE Trans Intell Transp Syst"},{"key":"296_CR14","doi-asserted-by":"publisher","first-page":"40","DOI":"10.1016\/j.comcom.2021.12.015","volume":"185","author":"W Jiang","year":"2021","unstructured":"Jiang W (2021) Graph-based deep learning for communication networks: a survey. Comput Commun 185:40\u201354. https:\/\/doi.org\/10.1016\/j.comcom.2021.12.015","journal-title":"Comput Commun"},{"key":"296_CR15","doi-asserted-by":"publisher","DOI":"10.1016\/j.eswa.2022.117921","author":"W Jiang","year":"2022","unstructured":"Jiang W, Jiayun L (2022) Graph neural network for traffic forecasting: a survey. Expert Syst Appl. https:\/\/doi.org\/10.1016\/j.eswa.2022.117921","journal-title":"Expert Syst Appl"},{"key":"296_CR16","doi-asserted-by":"publisher","unstructured":"Kambourakis G, Moschos T, Geneiatakis D, Gritzalis S (2007) Detecting dns amplification attacks. In: International workshop on critical information infrastructures security, Springer, pp 185\u2013196. https:\/\/doi.org\/10.1007\/978-3-540-89173-4_16","DOI":"10.1007\/978-3-540-89173-4_16"},{"issue":"8","key":"296_CR17","doi-asserted-by":"publisher","first-page":"13491","DOI":"10.3934\/mbe.2023602","volume":"20","author":"NW Khan","year":"2023","unstructured":"Khan NW, Alshehri MS, Khan MA et al (2023) A hybrid deep learning-based intrusion detection system for IoT networks. Math Biosci Eng 20(8):13491\u201313520","journal-title":"Math Biosci Eng"},{"key":"296_CR18","doi-asserted-by":"publisher","unstructured":"Kipf TN, Welling M (2016) Semi-supervised classification with graph convolutional networks. arXiv preprint arXiv:1609.02907, https:\/\/doi.org\/10.48550\/arXiv.1609.02907","DOI":"10.48550\/arXiv.1609.02907"},{"key":"296_CR19","doi-asserted-by":"publisher","first-page":"779","DOI":"10.1016\/j.future.2019.05.041","volume":"100","author":"N Koroniotis","year":"2019","unstructured":"Koroniotis N, Moustafa N, Sitnikova E, Turnbull B (2019) Towards the development of realistic botnet dataset in the internet of things for network forensic analytics: Bot-iot dataset. Futur Gener Comput Syst 100:779\u2013796. https:\/\/doi.org\/10.1016\/j.future.2019.05.041","journal-title":"Futur Gener Comput Syst"},{"key":"296_CR20","doi-asserted-by":"publisher","first-page":"10","DOI":"10.3390\/electronics9101565","volume":"9","author":"MA Lawal","year":"2020","unstructured":"Lawal MA, Shaikh RA, Hassan SR (2020) An anomaly mitigation framework for IoT using fog computing. Electronics 9:10. https:\/\/doi.org\/10.3390\/electronics9101565","journal-title":"Electronics"},{"issue":"1","key":"296_CR21","doi-asserted-by":"publisher","first-page":"1578314","DOI":"10.1155\/2018\/1578314","volume":"2018","author":"L Li","year":"2018","unstructured":"Li L, Yu Y, Bai S et al (2018) Towards effective network intrusion detection: a hybrid model integrating gini index and GBDT with PSO. J Sens 2018(1):1578314. https:\/\/doi.org\/10.1155\/2018\/1578314","journal-title":"J Sens"},{"key":"296_CR22","doi-asserted-by":"publisher","unstructured":"Lo WW et al. (2022) E-GraphSAGE: a graph neural network based intrusion detection system for IoT. In: NOMS 2022\u20132022 IEEE\/IFIP network operations and management symposium. IEEE. https:\/\/doi.org\/10.1109\/NOMS54207.2022.9789878","DOI":"10.1109\/NOMS54207.2022.9789878"},{"issue":"14","key":"296_CR23","doi-asserted-by":"publisher","first-page":"12521","DOI":"10.1109\/JIOT.2023.3248259","volume":"10","author":"Z Ma","year":"2023","unstructured":"Ma Z, Liu L, Meng W et al (2023) ADCL: toward an adaptive network intrusion detection system using collaborative learning in IoT networks. IEEE Internet Things J 10(14):12521\u201312536. https:\/\/doi.org\/10.1109\/JIOT.2023.3248259","journal-title":"IEEE Internet Things J"},{"issue":"4","key":"296_CR24","doi-asserted-by":"publisher","first-page":"1717","DOI":"10.1109\/TETC.2022.3178283","volume":"10","author":"R Mag\u00e1n-Carri\u00f3n","year":"2022","unstructured":"Mag\u00e1n-Carri\u00f3n R, Urda D, Diaz-Cano I et al (2022) Improving the reliability of network intrusion detection systems through dataset integration. IEEE Trans Emerg Top Comput 10(4):1717\u20131732. https:\/\/doi.org\/10.1109\/TETC.2022.3178283","journal-title":"IEEE Trans Emerg Top Comput"},{"key":"296_CR25","doi-asserted-by":"publisher","DOI":"10.1016\/j.scs.2021.102994","author":"N Moustafa","year":"2021","unstructured":"Moustafa N (2021) A new distributed architecture for evaluating AI-based security systems at the edge: Network TON_IoT datasets. Sustain Cities Soc. https:\/\/doi.org\/10.1016\/j.scs.2021.102994","journal-title":"Sustain Cities Soc"},{"key":"296_CR26","doi-asserted-by":"publisher","DOI":"10.1016\/j.jnca.2023.103637","author":"M Nuaimi","year":"2023","unstructured":"Nuaimi M, Fourati LC, Hamed BB (2023) Intelligent approaches toward intrusion detection systems for Industrial Internet of Things: a systematic comprehensive review. J Netw Comput Appl. https:\/\/doi.org\/10.1016\/j.jnca.2023.103637","journal-title":"J Netw Comput Appl"},{"key":"296_CR27","doi-asserted-by":"publisher","unstructured":"Qingsai X, Jian L, Quiyun W, Zhengwei J, Xuren W, Yepeng Y (2020) Towards network anomaly detection using graph embedding. In: International Conference on Computational Science, pp 156\u2013169. Springer, https:\/\/doi.org\/10.1007\/978-3-030-50423-6_12","DOI":"10.1007\/978-3-030-50423-6_12"},{"issue":"1","key":"296_CR28","doi-asserted-by":"publisher","first-page":"357","DOI":"10.1007\/s11036-021-01843-0","volume":"27","author":"M Sarhan","year":"2022","unstructured":"Sarhan M, Layeghy S, Portmann M (2022) Towards a standard feature set for network intrusion detection system datasets. Mob Netw Appl 27(1):357\u2013370. https:\/\/doi.org\/10.1007\/s11036-021-01843-0","journal-title":"Mob Netw Appl"},{"key":"296_CR29","doi-asserted-by":"publisher","unstructured":"Sarhan M, Layeghy S, Moustafa N, Portmann M (2011) Netflow datasets for machine learning-based network intrusion detection systems. arXiv: 2011. 09144. https:\/\/doi.org\/10.48550\/arXiv.2011.09144","DOI":"10.48550\/arXiv.2011.09144"},{"key":"296_CR30","doi-asserted-by":"publisher","unstructured":"Sarhan M et al. (2020) Netflow datasets for machine learning-based network intrusion detection systems. In: Big data technologies and applications. Springer, Cham, pp 117\u2013135. https:\/\/doi.org\/10.1007\/978-3-030-72802-1_9","DOI":"10.1007\/978-3-030-72802-1_9"},{"key":"296_CR31","doi-asserted-by":"publisher","first-page":"109661","DOI":"10.1016\/j.patcog.2023.109661","volume":"141","author":"L Shuaiyi","year":"2023","unstructured":"Shuaiyi L, Wang K, Zhang L et al (2023) Process-Oriented heterogeneous graph learning in GNN-Based ICS anomalous pattern recognition. Pattern Recogn 141:109661. https:\/\/doi.org\/10.1016\/j.patcog.2023.109661","journal-title":"Pattern Recogn"},{"key":"296_CR32","doi-asserted-by":"crossref","unstructured":"Sun, P, Guo Z, Wang J, Li J, Lan J, Hu Y (2021) Deepweave: accelerating jobcompletion time with deep reinforcement learning-based coflow scheduling. In: Proceedings of the twenty-ninth international conference on international joint conferences on artificial intelligence, pp 3314\u20133320. https:\/\/www.ijcai.org\/proceedings\/2020\/0458.pdf","DOI":"10.24963\/ijcai.2020\/458"},{"key":"296_CR33","doi-asserted-by":"publisher","unstructured":"Veli\u010dkovi\u0107 P et al. (2017) Graph attention networks. arXiv preprint arXiv:1710.10903. https:\/\/doi.org\/10.48550\/arXiv.1710.10903","DOI":"10.48550\/arXiv.1710.10903"},{"issue":"4","key":"296_CR34","doi-asserted-by":"publisher","first-page":"2768","DOI":"10.1109\/COMST.2017.2749442","volume":"19","author":"G Vormayr","year":"2017","unstructured":"Vormayr G, Zseby T, Fabini J (2017) Botnet communication patterns. IEEE Commun Surv Tutor 19(4):2768\u20132796. https:\/\/doi.org\/10.1109\/COMST.2017.2749442","journal-title":"IEEE Commun Surv Tutor"},{"issue":"5","key":"296_CR35","doi-asserted-by":"publisher","first-page":"56","DOI":"10.1145\/3371934.3371955","volume":"49","author":"W Willinger","year":"2019","unstructured":"Willinger W, Taqqu MS, Wilson DV (2019) Lessons from\" on the self-similar nature of ethernet traffic\". ACM SIGCOMM Comput Commun Rev 49(5):56\u201362. https:\/\/doi.org\/10.1145\/3371934.3371955","journal-title":"ACM SIGCOMM Comput Commun Rev"},{"key":"296_CR36","unstructured":"Yu Z (2014) The detection and tracing of DDoS attack based on the analysis of self-similarity behaviors. Central South University, MA thesis"},{"issue":"4","key":"296_CR37","doi-asserted-by":"publisher","first-page":"4750","DOI":"10.1109\/TNSM.2022.3193099","volume":"19","author":"Z Zeng","year":"2022","unstructured":"Zeng Z, Peng W, Zeng D (2022) Improving the stability of intrusion detection with causal deep learning. IEEE Trans Netw Serv Manage 19(4):4750\u20134763. https:\/\/doi.org\/10.1109\/TNSM.2022.3193099","journal-title":"IEEE Trans Netw Serv Manage"},{"key":"296_CR38","doi-asserted-by":"publisher","first-page":"690049","DOI":"10.3389\/fgene.2021.690049","volume":"12","author":"XM Zhang","year":"2021","unstructured":"Zhang XM, Liang L, Liu L et al (2021a) Graph neural networks and their current applications in bioinformatics. Front Genet 12:690049. https:\/\/doi.org\/10.3389\/fgene.2021.690049","journal-title":"Front Genet"},{"issue":"1","key":"296_CR39","first-page":"6610675","volume":"2021","author":"C Zhang","year":"2021","unstructured":"Zhang C, Chen Y, Meng Y et al (2021b) A novel framework design of network intrusion detection based on machine learning techniques. Secur Commun Netw 2021(1):6610675","journal-title":"Secur Commun Netw"},{"issue":"12","key":"296_CR40","doi-asserted-by":"publisher","first-page":"9310","DOI":"10.1109\/JIOT.2021.3130434","volume":"9","author":"X Zhou","year":"2021","unstructured":"Zhou X, Liang W, Li W et al (2021) Hierarchical adversarial attacks against graph-neural-network-based IoT network intrusion detection system. IEEE Internet Things J 9(12):9310\u20139319. https:\/\/doi.org\/10.1109\/JIOT.2021.3130434","journal-title":"IEEE Internet Things J"}],"container-title":["Cybersecurity"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1186\/s42400-024-00296-8.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1186\/s42400-024-00296-8\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1186\/s42400-024-00296-8.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,4,24]],"date-time":"2025-04-24T02:02:15Z","timestamp":1745460135000},"score":1,"resource":{"primary":{"URL":"https:\/\/cybersecurity.springeropen.com\/articles\/10.1186\/s42400-024-00296-8"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,4,24]]},"references-count":40,"journal-issue":{"issue":"1","published-online":{"date-parts":[[2025,12]]}},"alternative-id":["296"],"URL":"https:\/\/doi.org\/10.1186\/s42400-024-00296-8","relation":{},"ISSN":["2523-3246"],"issn-type":[{"value":"2523-3246","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,4,24]]},"assertion":[{"value":"29 May 2024","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"26 September 2024","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"24 April 2025","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Declaration"}},{"value":"The authors declare that they have no competing interests.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Competing interests"}}],"article-number":"27"}}