{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,9]],"date-time":"2026-04-09T05:20:07Z","timestamp":1775712007894,"version":"3.50.1"},"reference-count":124,"publisher":"MDPI AG","issue":"11","license":[{"start":{"date-parts":[[2025,10,24]],"date-time":"2025-10-24T00:00:00Z","timestamp":1761264000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["BDCC"],"abstract":"<jats:p>Network traffic analysis is crucial for understanding network behavior and identifying underlying applications, protocols, and service groups. The increasing complexity of network environments, driven by the evolution of the Internet, poses significant challenges to traditional analytical approaches. Graph Neural Networks (GNNs) have recently garnered considerable attention in network traffic analysis due to their ability to model complex relationships within network flows and between communicating entities. This scoping review systematically surveys major academic databases, employing predefined eligibility criteria to identify and synthesize key research in the field, following the Preferred Reporting Items for Systematic reviews and Meta-Analyses extension for Scoping Reviews (PRISMA-ScR) methodology. We present a comprehensive overview of a generalized architecture for GNN-based traffic analysis and categorize recent methods into three primary types: node prediction, edge prediction, and graph prediction. We discuss challenges in network traffic analysis, summarize solutions from various methods, and provide practical recommendations for model selection. This review also compiles publicly available datasets and open-source code, serving as valuable resources for further research. Finally, we outline future research directions to advance this field. This work offers an updated understanding of GNN applications in network traffic analysis and provides practical guidance for researchers and practitioners.<\/jats:p>","DOI":"10.3390\/bdcc9110270","type":"journal-article","created":{"date-parts":[[2025,10,27]],"date-time":"2025-10-27T07:31:58Z","timestamp":1761550318000},"page":"270","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":4,"title":["Network Traffic Analysis Based on Graph Neural Networks: A Scoping Review"],"prefix":"10.3390","volume":"9","author":[{"ORCID":"https:\/\/orcid.org\/0009-0001-4124-8454","authenticated-orcid":false,"given":"Ruonan","family":"Wang","sequence":"first","affiliation":[{"name":"Institute of Systems Engineering, Academy of Military Sciences, People\u2019s Liberation Army, Beijing 100101, China"}]},{"given":"Jinjing","family":"Zhao","sequence":"additional","affiliation":[{"name":"Institute of Systems Engineering, Academy of Military Sciences, People\u2019s Liberation Army, Beijing 100101, China"}]},{"given":"Hongzheng","family":"Zhang","sequence":"additional","affiliation":[{"name":"Institute of Systems Engineering, Academy of Military Sciences, People\u2019s Liberation Army, Beijing 100101, China"}]},{"given":"Liqiang","family":"He","sequence":"additional","affiliation":[{"name":"Institute of Systems Engineering, Academy of Military Sciences, People\u2019s Liberation Army, Beijing 100101, China"}]},{"given":"Hu","family":"Li","sequence":"additional","affiliation":[{"name":"Institute of Systems Engineering, Academy of Military Sciences, People\u2019s Liberation Army, Beijing 100101, China"}]},{"given":"Minhuan","family":"Huang","sequence":"additional","affiliation":[{"name":"Institute of Systems Engineering, Academy of Military Sciences, People\u2019s Liberation Army, Beijing 100101, China"}]}],"member":"1968","published-online":{"date-parts":[[2025,10,24]]},"reference":[{"key":"ref_1","unstructured":"International Telecommunication Union (2025, June 27). Facts and Figures 2024. Available online: https:\/\/www.itu.int\/itu-d\/reports\/statistics\/facts-figures-2024\/index\/."},{"key":"ref_2","doi-asserted-by":"crossref","first-page":"39","DOI":"10.1007\/978-3-642-04968-2_4","article-title":"A Labeled Data Set for Flow-Based Intrusion Detection","volume":"Volume 5843","author":"Nunzi","year":"2009","journal-title":"IP Operations and Management"},{"key":"ref_3","doi-asserted-by":"crossref","unstructured":"Fogla, P., and Lee, W. (November, January 30). Evading Network Anomaly Detection Systems: Formal Reasoning and Practical Techniques. Proceedings of the 13th ACM Conference on Computer and Communications Security (CCS 2006), Alexandria, VA, USA.","DOI":"10.1145\/1180405.1180414"},{"key":"ref_4","doi-asserted-by":"crossref","first-page":"1135","DOI":"10.1109\/SURV.2013.100613.00161","article-title":"A Survey of Payload-Based Traffic Classification Approaches","volume":"16","author":"Finsterbusch","year":"2014","journal-title":"IEEE Commun. Surv. Tutor."},{"key":"ref_5","doi-asserted-by":"crossref","first-page":"686","DOI":"10.1109\/COMST.2018.2847722","article-title":"A Detailed Investigation and Analysis of Using Machine Learning Techniques for Intrusion Detection","volume":"21","author":"Mishra","year":"2019","journal-title":"IEEE Commun. Surv. Tutor."},{"key":"ref_6","doi-asserted-by":"crossref","first-page":"102526","DOI":"10.1016\/j.jnca.2019.102526","article-title":"The Rise of Machine Learning for Detection and Classification of Malware: Research Developments, Trends and Challenges","volume":"153","author":"Gibert","year":"2020","journal-title":"J. Netw. Comput. Appl."},{"key":"ref_7","doi-asserted-by":"crossref","unstructured":"Wang, Q., Xie, M., Wu, Z., and Dong, Y. (2023, January 15\u201317). Network Intrusion Detection and Dynamic Defense Method Based on Unsupervised Machine Learning. Proceedings of the 2023 International Conference on Computer Simulation and Modeling, Information Security (CSMIS), Buenos Aires, Argentina.","DOI":"10.1109\/CSMIS60634.2023.00019"},{"key":"ref_8","doi-asserted-by":"crossref","unstructured":"Ren, Y. (2022, January 7\u20139). Analysis of Network Intrusion Detection Based on Machine Learning. Proceedings of the 2022 4th International Conference on Artificial Intelligence and Advanced Manufacturing (AIAM), Hamburg, Germany.","DOI":"10.1109\/AIAM57466.2022.00142"},{"key":"ref_9","doi-asserted-by":"crossref","first-page":"377","DOI":"10.1109\/JAS.2021.1004261","article-title":"Deep Learning Based Attack Detection for Cyber-Physical System Cybersecurity: A Survey","volume":"9","author":"Zhang","year":"2022","journal-title":"IEEE\/CAA J. Autom. Sin."},{"key":"ref_10","doi-asserted-by":"crossref","first-page":"158261","DOI":"10.1109\/ACCESS.2021.3128181","article-title":"A Network Traffic Classification Method Based on Graph Convolution and LSTM","volume":"9","author":"Pan","year":"2021","journal-title":"IEEE Access"},{"key":"ref_11","doi-asserted-by":"crossref","first-page":"240","DOI":"10.12720\/jcm.8.4.240-248","article-title":"Traffic Classification: Issues and Challenges","volume":"8","author":"Xue","year":"2013","journal-title":"J. Commun."},{"key":"ref_12","doi-asserted-by":"crossref","first-page":"1999","DOI":"10.1007\/s00500-019-04030-2","article-title":"Deep Packet: A Novel Approach for Encrypted Traffic Classification Using Deep Learning","volume":"24","author":"Lotfollahi","year":"2020","journal-title":"Soft Comput."},{"key":"ref_13","first-page":"100441","article-title":"Graph-powered Learning Methods in the Internet of Things: A Survey","volume":"11","author":"Li","year":"2023","journal-title":"Mach. Learn. Appl."},{"key":"ref_14","doi-asserted-by":"crossref","first-page":"128949","DOI":"10.1016\/j.neucom.2024.128949","article-title":"Graph-based Context Learning Network for Infrared Small Target Detection","volume":"616","author":"Shen","year":"2025","journal-title":"Neurocomputing"},{"key":"ref_15","unstructured":"Subedi, R., Wei, L., Gao, W., Chakraborty, S., and Liu, Y. (2024, January 10\u201316). Empowering Active Learning for 3D Molecular Graphs with Geometric Graph Isomorphism. Proceedings of the 38th Conference on Neural Information Processing Systems (NeurIPS), Vancouver, BC, Canada. Available online: https:\/\/dl.acm.org\/doi\/10.5555\/3737916.3739679."},{"key":"ref_16","doi-asserted-by":"crossref","first-page":"100544","DOI":"10.1016\/j.cosrev.2023.100544","article-title":"A Survey: When Moving Target Defense Meets Game Theory","volume":"48","author":"Tan","year":"2023","journal-title":"Comput. Sci. Rev."},{"key":"ref_17","doi-asserted-by":"crossref","first-page":"8353","DOI":"10.1109\/TIFS.2024.3451189","article-title":"A Deep Reinforcement Learning-based Deception Asset Selection Algorithm in Differential Games","volume":"19","author":"He","year":"2024","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"ref_18","doi-asserted-by":"crossref","unstructured":"Goli, Y.D., and Ambika, R. (2018, January 21\u201322). Network Traffic Classification Techniques\u2014A Review. Proceedings of the 2018 International Conference on Computational Techniques, Electronics and Mechanical Systems (CTEMS), Theni, India.","DOI":"10.1109\/CTEMS.2018.8769309"},{"key":"ref_19","doi-asserted-by":"crossref","unstructured":"Bhatla, N., and Malik, M. (2023). Network Traffic Classification Techniques: A Review. Computational Intelligence for Engineering and Management Applications, Springer. Lecture Notes in Electrical Engineering, 1045.","DOI":"10.1007\/978-981-19-8493-8_29"},{"key":"ref_20","doi-asserted-by":"crossref","first-page":"676","DOI":"10.1016\/j.dcan.2022.09.009","article-title":"Network Traffic Classification: Techniques, Datasets, and Challenges","volume":"10","author":"Azab","year":"2022","journal-title":"Digit. Commun. Netw."},{"key":"ref_21","doi-asserted-by":"crossref","first-page":"413","DOI":"10.1134\/S0361768822070052","article-title":"A Survey of Network Traffic Classification Methods Using Machine Learning","volume":"48","author":"Getman","year":"2022","journal-title":"Program. Comput. Softw."},{"key":"ref_22","first-page":"123:1","article-title":"A Survey on Encrypted Network Traffic Analysis Applications, Techniques, and Countermeasures","volume":"54","author":"Papadogiannaki","year":"2021","journal-title":"ACM Comput. Surv."},{"key":"ref_23","doi-asserted-by":"crossref","first-page":"791","DOI":"10.1109\/COMST.2022.3208196","article-title":"Machine Learning-Powered Encrypted Network Traffic Analysis: A Comprehensive Survey","volume":"25","author":"Meng","year":"2023","journal-title":"IEEE Commun. Surv. Tutor."},{"key":"ref_24","doi-asserted-by":"crossref","first-page":"49114","DOI":"10.1109\/ACCESS.2023.3275789","article-title":"Graph Neural Networks for Intrusion Detection: A Survey","volume":"11","author":"Bilot","year":"2023","journal-title":"IEEE Access"},{"key":"ref_25","doi-asserted-by":"crossref","first-page":"103821","DOI":"10.1016\/j.cose.2024.103821","article-title":"A Survey on Graph Neural Networks for Intrusion Detection Systems: Methods, Trends and Challenges","volume":"141","author":"Zhong","year":"2024","journal-title":"Comput. Secur."},{"key":"ref_26","doi-asserted-by":"crossref","first-page":"47","DOI":"10.1145\/3565973","article-title":"Graph Neural Networks in IoT: A Survey","volume":"19","author":"Dong","year":"2023","journal-title":"ACM Trans. Sens. Netw."},{"key":"ref_27","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1109\/TKDE.2023.3282898","article-title":"A Survey of Graph-based Deep Learning for Anomaly Detection in Distributed Systems","volume":"36","author":"Purkayastha","year":"2024","journal-title":"IEEE Trans. Knowl. Data Eng."},{"key":"ref_28","doi-asserted-by":"crossref","first-page":"47","DOI":"10.1145\/3610228","article-title":"Graph Mining for Cybersecurity: A Survey","volume":"18","author":"Yan","year":"2024","journal-title":"ACM Trans. Knowl. Discov. Data"},{"key":"ref_29","doi-asserted-by":"crossref","first-page":"278","DOI":"10.1145\/3664649","article-title":"A Survey on Malware Detection with Graph Representation Learning","volume":"56","author":"Bilot","year":"2024","journal-title":"ACM Comput. Surv."},{"key":"ref_30","doi-asserted-by":"crossref","first-page":"6659022","DOI":"10.1155\/2021\/6659022","article-title":"Deep-Feature-Based Autoencoder Network for Few-Shot Malicious Traffic Detection","volume":"2021","author":"He","year":"2021","journal-title":"Secur. Commun. Netw."},{"key":"ref_31","doi-asserted-by":"crossref","first-page":"3540","DOI":"10.1109\/TIFS.2020.2991876","article-title":"A Method of Few-Shot Network Intrusion Detection Based on Meta-Learning Framework","volume":"15","author":"Xu","year":"2020","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"ref_32","doi-asserted-by":"crossref","first-page":"109723","DOI":"10.1016\/j.comnet.2023.109723","article-title":"M3F: A Novel Multi-Session and Multi-Protocol Based Malware Traffic Fingerprinting","volume":"227","author":"Liu","year":"2023","journal-title":"Comput. Netw."},{"key":"ref_33","doi-asserted-by":"crossref","first-page":"2460","DOI":"10.1109\/TNSM.2024.3350080","article-title":"MetaRockETC: Adaptive Encrypted Traffic Classification in Complex Network Environments via Time Series Analysis and Meta-Learning","volume":"21","author":"Zhao","year":"2024","journal-title":"IEEE Trans. Netw. Serv. Manag."},{"key":"ref_34","doi-asserted-by":"crossref","first-page":"719","DOI":"10.1016\/j.ins.2023.02.031","article-title":"An Adversarial Domain Adaptation Approach Combining Dual Domain Pairing Strategy for IoT Intrusion Detection under Few-Shot Samples","volume":"629","author":"Ma","year":"2023","journal-title":"Inf. Sci."},{"key":"ref_35","doi-asserted-by":"crossref","unstructured":"Niu, W., Ma, X., Lin, S., Wang, S., Qian, X., Lin, X., Wang, Y., and Ren, B. (2020, January 16\u201320). PatDNN: Achieving Real-Time DNN Execution on Mobile Devices with Pattern-based Weight Pruning. Proceedings of the 25th International Conference on Architectural Support for Programming Languages and Operating Systems (ASPLOS), Lausanne, Switzerland.","DOI":"10.1145\/3373376.3378534"},{"key":"ref_36","doi-asserted-by":"crossref","first-page":"2935","DOI":"10.1109\/JIOT.2023.3294259","article-title":"A Lightweight and Efficient IoT Intrusion Detection Method Based on Feature Grouping","volume":"11","author":"He","year":"2024","journal-title":"IEEE Internet Things J."},{"key":"ref_37","doi-asserted-by":"crossref","first-page":"145","DOI":"10.1145\/3638240","article-title":"A Survey of Recent Advances in Deep Learning Models for Detecting Malware in Desktop and Mobile Platforms","volume":"56","author":"Maniriho","year":"2024","journal-title":"ACM Comput. Surv."},{"key":"ref_38","doi-asserted-by":"crossref","unstructured":"Hamilton, W.L. (2020). The Graph Neural Network Model. Graph Representation Learning, Springer.","DOI":"10.1007\/978-3-031-01588-5"},{"key":"ref_39","unstructured":"Kipf, T.N., and Welling, M. (2017, January 24\u201326). Semi-Supervised Classification with Graph Convolutional Networks. Proceedings of the 5th International Conference on Learning Representations (ICLR), Toulon, France."},{"key":"ref_40","doi-asserted-by":"crossref","unstructured":"Kim, J., Kim, T., Kim, S., Hong, S., and Shin, J. (2019, January 15\u201320). Edge-labeling Graph Neural Network for Few-Shot Learning. Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition (CVPR), Long Beach, CA, USA.","DOI":"10.1109\/CVPR.2019.00010"},{"key":"ref_41","unstructured":"Veli\u010dkovi\u0107, P., Cucurull, G., Casanova, A., Romero, A., Li\u00f2, P., and Bengio, Y. (May, January 30). Graph Attention Networks. Proceedings of the 6th International Conference on Learning Representations (ICLR), Vancouver, BC, Canada."},{"key":"ref_42","unstructured":"Xu, K., Hu, W., Leskovec, J., and Jegelka, S. How Powerful Are Graph Neural Networks? In Proceedings of the 7th International Conference on Learning Representations (ICLR), New Orleans, LA, USA, 6\u20139 May 2019."},{"key":"ref_43","doi-asserted-by":"crossref","unstructured":"Yang, Z., Yang, D., Dyer, C., He, X., Smola, A., and Hovy, E. (2016, January 12\u201317). Hierarchical Attention Networks for Document Classification. Proceedings of the 2016 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (NAACL HLT), San Diego, CA, USA.","DOI":"10.18653\/v1\/N16-1174"},{"key":"ref_44","doi-asserted-by":"crossref","unstructured":"Dvorak, S., Prochazka, P., and Bajer, L. (2022, January 25\u201329). GNN-Based Malicious Network Entities Identification in Large-Scale Network Data. Proceedings of the 2022 IEEE\/IFIP Network Operations and Management Symposium (NOMS), Budapest, Hungary.","DOI":"10.1109\/NOMS54207.2022.9789792"},{"key":"ref_45","doi-asserted-by":"crossref","first-page":"9310","DOI":"10.1109\/JIOT.2021.3130434","article-title":"Hierarchical Adversarial Attacks Against Graph-Neural-Network-Based IoT Network Intrusion Detection System","volume":"9","author":"Zhou","year":"2022","journal-title":"IEEE Internet Things J."},{"key":"ref_46","doi-asserted-by":"crossref","first-page":"110508","DOI":"10.1016\/j.comnet.2024.110508","article-title":"FTG-net-e: A Hierarchical Ensemble Graph Neural Network for DDoS Attack Detection","volume":"245","author":"Bakar","year":"2024","journal-title":"Comput. Netw."},{"key":"ref_47","doi-asserted-by":"crossref","first-page":"103846","DOI":"10.1016\/j.cose.2024.103846","article-title":"GHGDroid: Global Heterogeneous Graph-Based Android Malware Detection","volume":"141","author":"Shen","year":"2024","journal-title":"Comput. Secur."},{"key":"ref_48","unstructured":"Liu, Z., Chen, C., Yang, X., Hu, J., Ding, K., Wang, Y., and Xiong, H. (2020). Heterogeneous Graph Neural Networks for Malicious Account Detection. arXiv."},{"key":"ref_49","doi-asserted-by":"crossref","first-page":"4007","DOI":"10.1109\/TSG.2023.3237011","article-title":"Attack Graph Model for Cyber-Physical Power Systems Using Hybrid Deep Learning","volume":"14","author":"Presekal","year":"2023","journal-title":"IEEE Trans. Smart Grid"},{"key":"ref_50","doi-asserted-by":"crossref","first-page":"9214","DOI":"10.1109\/JIOT.2021.3094295","article-title":"Graph Neural Networks for Anomaly Detection in Industrial Internet of Things","volume":"9","author":"Wu","year":"2022","journal-title":"IEEE Internet Things J."},{"key":"ref_51","doi-asserted-by":"crossref","unstructured":"Li, G., Zhang, F., Pang, J., Zhang, T., Pan, M., Li, X., and Zhang, C. (2022, January 17\u201318). Functional Scenario Classification for Android Applications Using GNNs. Proceedings of the 13th Asia-Pacific Symposium on Internetware (Internetware \u201822), Wuhan, China.","DOI":"10.1145\/3545258.3545270"},{"key":"ref_52","doi-asserted-by":"crossref","first-page":"110278","DOI":"10.1016\/j.comnet.2024.110278","article-title":"Let Gambling Hide Nowhere: Detecting Illegal Mobile Gambling Apps Via Heterogeneous Graph-Based Encrypted Traffic Analysis","volume":"243","author":"Gu","year":"2024","journal-title":"Comput. Netw."},{"key":"ref_53","doi-asserted-by":"crossref","first-page":"380","DOI":"10.1016\/j.ins.2020.03.113","article-title":"Multi-attributed Heterogeneous Graph Convolutional Network for Bot Detection","volume":"537","author":"Zhang","year":"2020","journal-title":"Inf. Sci."},{"key":"ref_54","doi-asserted-by":"crossref","first-page":"3554","DOI":"10.1109\/TIFS.2024.3360867","article-title":"Malicious Internet Entity Detection Using Local Graph Inference","volume":"19","author":"Simon","year":"2024","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"ref_55","doi-asserted-by":"crossref","first-page":"14","DOI":"10.1186\/s40537-017-0074-7","article-title":"Botnet Detection Using Graph-Based Feature Clustering","volume":"4","author":"Chowdhury","year":"2017","journal-title":"J. Big Data"},{"key":"ref_56","doi-asserted-by":"crossref","first-page":"119229","DOI":"10.1016\/j.ins.2023.119229","article-title":"Graph Based Encrypted Malicious Traffic Detection with Hybrid Analysis of Multi-View Features","volume":"644","author":"Yueping","year":"2023","journal-title":"Inf. Sci."},{"key":"ref_57","doi-asserted-by":"crossref","unstructured":"Tao, J., Lin, J., and Zhang, S. (2019, January 4\u20138). MVAN: Multi-View Attention Networks for Real Money Trading Detection in Online Games. Proceedings of the 25th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, Anchorage, AK, USA.","DOI":"10.1145\/3292500.3330687"},{"key":"ref_58","doi-asserted-by":"crossref","first-page":"2894","DOI":"10.1109\/TNSE.2022.3184975","article-title":"Intrusion Detection of Industrial Internet-of-Things Based on Reconstructed Graph Neural Networks","volume":"10","author":"Zhang","year":"2023","journal-title":"IEEE Trans. Netw. Sci. Eng."},{"key":"ref_59","doi-asserted-by":"crossref","first-page":"684","DOI":"10.1109\/TNSM.2022.3213807","article-title":"Flow Topology-Based Graph Convolutional Network for Intrusion Detection in Label-Limited IoT Networks","volume":"20","author":"Deng","year":"2023","journal-title":"IEEE Trans. Netw. Serv. Manag."},{"key":"ref_60","doi-asserted-by":"crossref","unstructured":"Zhang, S., Yin, J., Li, Z., Yang, R., Du, M., and Li, R. (2022, January 4\u20136). Node-Imbalance Learning on Heterogeneous Graph for Pirated Video Website Detection. Proceedings of the 2022 IEEE 25th International Conference on Computer Supported Cooperative Work in Design (CSCWD), Hangzhou, China.","DOI":"10.1109\/CSCWD54268.2022.9776224"},{"key":"ref_61","doi-asserted-by":"crossref","first-page":"2579","DOI":"10.1109\/TNSE.2022.3166655","article-title":"FA-GNN: Filter and Augment Graph Neural Networks for Account Classification in Ethereum","volume":"9","author":"Liu","year":"2022","journal-title":"IEEE Trans. Netw. Sci. Eng."},{"key":"ref_62","doi-asserted-by":"crossref","first-page":"1541","DOI":"10.1109\/TSMC.2023.3329520","article-title":"Who is Who on Ethereum? Account Labeling Using Heterophilic Graph Convolutional Network","volume":"54","author":"Lin","year":"2024","journal-title":"IEEE Trans. Syst. Man Cybern. Syst."},{"key":"ref_63","doi-asserted-by":"crossref","unstructured":"Xie, F., Cao, Z., Xu, Y., Chen, L., and Zheng, Z. (2020, January 18\u201324). Graph Neural Network and Multi-View Learning Based Mobile Application Recommendation in Heterogeneous Graphs. Proceedings of the 2020 IEEE International Conference on Services Computing (SCC), Virtual, Beijing, China.","DOI":"10.1109\/SCC49832.2020.00022"},{"key":"ref_64","doi-asserted-by":"crossref","unstructured":"Dou, Y., Liu, Z., Sun, L., Deng, Y., Peng, H., and Yu, P.S. (2020, January 19\u201323). Enhancing Graph Neural Network-Based Fraud Detectors Against Camouflaged Fraudsters. Proceedings of the 29th ACM International Conference on Information & Knowledge Management (CIKM), Virtual Event, Ireland.","DOI":"10.1145\/3340531.3411903"},{"key":"ref_65","doi-asserted-by":"crossref","first-page":"4703","DOI":"10.1109\/TNNLS.2021.3105617","article-title":"Hawk: Rapid Android Malware Detection Through Heterogeneous Graph Attention Networks","volume":"35","author":"Hei","year":"2024","journal-title":"IEEE Trans. Neural Netw. Learn. Syst."},{"key":"ref_66","doi-asserted-by":"crossref","unstructured":"Li, A., Qin, Z., Liu, R., Yang, Y., and Li, D. (2019, January 3\u20137). Spam Review Detection with Graph Convolutional Networks. Proceedings of the 28th ACM International Conference on Information and Knowledge Management (CIKM), Beijing, China.","DOI":"10.1145\/3357384.3357820"},{"key":"ref_67","doi-asserted-by":"crossref","unstructured":"Zheng, L., Li, Z., Li, J., Li, Z., and Gao, J. (2019, January 10\u201316). AddGraph: Anomaly Detection in Dynamic Graph Using Attention-Based Temporal GCN. Proceedings of the 28th International Joint Conference on Artificial Intelligence (IJCAI), Macao, China.","DOI":"10.24963\/ijcai.2019\/614"},{"key":"ref_68","doi-asserted-by":"crossref","unstructured":"Xu, P., Lu, G., Li, Y., and Xu, C. (2023, January 24\u201326). EE-GCN: A Graph Convolutional Network Based Intrusion Detection Method for IIoT. Proceedings of the 2023 5th International Conference on Natural Language Processing (ICNLP), Guangzhou, China.","DOI":"10.1109\/ICNLP58431.2023.00068"},{"key":"ref_69","doi-asserted-by":"crossref","first-page":"110495","DOI":"10.1016\/j.comnet.2024.110495","article-title":"Applying Self-Supervised Learning to Network Intrusion Detection for Network Flows with Graph Neural Network","volume":"248","author":"Xu","year":"2024","journal-title":"Comput. Netw."},{"key":"ref_70","unstructured":"Fu, C., Li, Q., and Xu, K. (March, January 27). Detecting Unknown Encrypted Malicious Traffic in Real Time via Flow Interaction Graph Analysis. Proceedings of the 30th Network and Distributed System Security Symposium (NDSS), San Diego, CA, USA."},{"key":"ref_71","unstructured":"Baahmed, A.R.E., Andresini, G., Robardet, C., and Appice, A. (2023, January 18\u201322). Using Graph Neural Networks for the Detection and Explanation of Network Intrusions. Proceedings of the European Conference on Machine Learning (ECML 2023), Torino, Italy."},{"key":"ref_72","doi-asserted-by":"crossref","first-page":"4851","DOI":"10.1109\/TIFS.2024.3385321","article-title":"Practical Cyber Attack Detection with Continuous Temporal Graph in Dynamic Network System","volume":"19","author":"Duan","year":"2024","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"ref_73","doi-asserted-by":"crossref","unstructured":"Yang, Z., Pei, W., Chen, M., and Yue, C. (2022, January 23\u201326). WTAGRAPH: Web Tracking and Advertising Detection Using Graph Neural Networks. Proceedings of the 43rd IEEE Symposium on Security and Privacy (SP), San Francisco, CA, USA.","DOI":"10.1109\/SP46214.2022.9833670"},{"key":"ref_74","doi-asserted-by":"crossref","first-page":"110030","DOI":"10.1016\/j.knosys.2022.110030","article-title":"Anomal-E: A Self-Supervised Network Intrusion Detection System Based on Graph Neural Networks","volume":"258","author":"Caville","year":"2022","journal-title":"Knowl.-Based Syst."},{"key":"ref_75","doi-asserted-by":"crossref","first-page":"587","DOI":"10.1016\/j.neucom.2021.03.134","article-title":"A Subgraph-Based Knowledge Reasoning Method for Collective Fraud Detection in E-Commerce","volume":"461","author":"Song","year":"2021","journal-title":"Neurocomputing"},{"key":"ref_76","doi-asserted-by":"crossref","first-page":"110966","DOI":"10.1016\/j.knosys.2023.110966","article-title":"TS-IDS: Traffic-Aware Self-Supervised Learning for IoT Network Intrusion Detection","volume":"279","author":"Nguyen","year":"2023","journal-title":"Knowl.-Based Syst."},{"key":"ref_77","doi-asserted-by":"crossref","first-page":"100818","DOI":"10.1016\/j.iot.2023.100818","article-title":"A New Concatenated Multigraph Neural Network for IoT Intrusion Detection","volume":"22","author":"Altaf","year":"2023","journal-title":"Internet Things"},{"key":"ref_78","doi-asserted-by":"crossref","first-page":"699","DOI":"10.1109\/TIFS.2022.3228493","article-title":"Application of a Dynamic Line Graph Neural Network for Intrusion Detection with Semisupervised Learning","volume":"18","author":"Duan","year":"2023","journal-title":"IEEE Trans. Inform. Forensics Secur."},{"key":"ref_79","doi-asserted-by":"crossref","unstructured":"Gu, Z., Lopez, D.T., Alrahis, L., and Sinanoglu, O. (2024). Always be Pre-Training: Representation Learning for Network Intrusion Detection with GNNs. arXiv.","DOI":"10.1109\/ISQED60706.2024.10528371"},{"key":"ref_80","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1109\/TPAMI.2021.3137605","article-title":"A Comprehensive Survey of Scene Graphs: Generation and Application","volume":"45","author":"Chang","year":"2023","journal-title":"IEEE Trans. Pattern Anal. Mach. Intell."},{"key":"ref_81","first-page":"97","article-title":"Graph Neural Networks in Recommender Systems: A Survey","volume":"55","author":"Wu","year":"2022","journal-title":"ACM Comput. Surv."},{"key":"ref_82","doi-asserted-by":"crossref","first-page":"2367","DOI":"10.1109\/TIFS.2021.3050608","article-title":"Accurate Decentralized Application Identification via Encrypted Traffic Analysis Using Graph Neural Networks","volume":"16","author":"Shen","year":"2021","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"ref_83","doi-asserted-by":"crossref","first-page":"389","DOI":"10.1109\/TMLCN.2023.3323915","article-title":"WFF-EGNN: Encrypted Traffic Classification Based on Weaved Flow Fragment via Ensemble Graph Neural Networks","volume":"1","author":"Chen","year":"2023","journal-title":"IEEE Trans. Mach. Learn. Commun. Netw."},{"key":"ref_84","doi-asserted-by":"crossref","first-page":"17589","DOI":"10.1109\/JIOT.2024.3360039","article-title":"Intrusion Detection for Encrypted Flows Using Single Feature Based on Graph Integration Theory","volume":"11","author":"Han","year":"2024","journal-title":"IEEE Internet Things J."},{"key":"ref_85","doi-asserted-by":"crossref","first-page":"968","DOI":"10.1109\/TCCN.2024.3350531","article-title":"Resource Knowledge-Driven Heterogeneous Graph Learning for Website Fingerprinting","volume":"10","author":"Gao","year":"2024","journal-title":"IEEE Trans. Cogn. Commun. Netw."},{"key":"ref_86","doi-asserted-by":"crossref","unstructured":"Xu, H., Li, S., Cheng, Z., Qin, R., Xie, J., and Sun, P. (2022, January 4\u20138). TrafficGCN: Mobile Application Encrypted Traffic Classification Based on GCN. Proceedings of the 2022 IEEE Global Communications Conference (GLOBECOM), Rio de Janeiro, Brazil.","DOI":"10.1109\/GLOBECOM48099.2022.10000658"},{"key":"ref_87","doi-asserted-by":"crossref","first-page":"110406","DOI":"10.1016\/j.comnet.2024.110406","article-title":"GlareShell: Graph Learning-Based PHP Webshell Detection for Web Server of Industrial Internet","volume":"245","author":"Feng","year":"2024","journal-title":"Comput. Netw."},{"key":"ref_88","doi-asserted-by":"crossref","unstructured":"Kisanga, P., Woungang, I., Traor\u00e9, I., and Carvalho, G.H.S. (2023, January 20\u201323). Network Anomaly Detection Using a Graph Neural Network. Proceedings of the 2023 International Conference on Computing, Networking and Communications (ICNC), Honolulu, HI, USA.","DOI":"10.1109\/ICNC57223.2023.10074111"},{"key":"ref_89","doi-asserted-by":"crossref","unstructured":"Li, H., and Chasaki, D. (2024, January 19\u201322). Heterogeneous GNN with Express Edges for Intrusion Detection in Cyber-Physical Systems. Proceedings of the 2024 International Conference on Computing, Networking and Communications (ICNC), Honolulu, HI, USA.","DOI":"10.1109\/ICNC59896.2024.10556029"},{"key":"ref_90","unstructured":"Cui, T., Gou, G., Xiong, G., Li, Z., Cui, M., and Liu, C. (2021, January 11\u201313). SiamHAN: IPv6 Address Correlation Attacks on TLS Encrypted Traffic via Siamese Heterogeneous Graph Attention Network. Proceedings of the 30th USENIX Security Symposium, Virtual Event."},{"key":"ref_91","doi-asserted-by":"crossref","unstructured":"Zhang, H., Yu, L., Xiao, X., Li, Q., Mercaldo, F., Luo, X., and Liu, Q. (May, January 30). TFE-GNN: A Temporal Fusion Encoder Using Graph Neural Networks for Fine-Grained Encrypted Traffic Classification. Proceedings of the ACM Web Conference 2023 (WWW \u201823), Austin, TX, USA.","DOI":"10.1145\/3543507.3583227"},{"key":"ref_92","doi-asserted-by":"crossref","first-page":"106531","DOI":"10.1016\/j.engappai.2023.106531","article-title":"TCGNN: Packet-Grained Network Traffic Classification via Graph Neural Networks","volume":"123","author":"Hu","year":"2023","journal-title":"Eng. Appl. Artif. Intell."},{"key":"ref_93","doi-asserted-by":"crossref","unstructured":"Okonkwo, Z., Foo, E., Hou, Z., Li, Q., and Jadidi, Z. (2023, January 5\u20137). Encrypted Network Traffic Classification with Higher Order Graph Neural Network. Proceedings of the 28th Australasian Conference on Information Security and Privacy (ACISP 2023), Melbourne, VIC, Australia.","DOI":"10.1007\/978-3-031-35486-1_27"},{"key":"ref_94","doi-asserted-by":"crossref","first-page":"1224","DOI":"10.1109\/TNSM.2022.3227500","article-title":"Flow-Based Encrypted Network Traffic Classification with Graph Neural Networks","volume":"20","author":"Huoh","year":"2023","journal-title":"IEEE Trans. Netw. Serv. Manag."},{"key":"ref_95","doi-asserted-by":"crossref","first-page":"3583","DOI":"10.1109\/TNSM.2024.3383851","article-title":"MTSecurity: Privacy-Preserving Malicious Traffic Classification Using Graph Neural Network and Transformer","volume":"21","author":"Yang","year":"2024","journal-title":"IEEE Trans. Netw. Serv. Manag."},{"key":"ref_96","doi-asserted-by":"crossref","first-page":"2972","DOI":"10.1109\/TNET.2024.3370851","article-title":"Flow Interaction Graph Analysis: Unknown Encrypted Malicious Traffic Detection","volume":"32","author":"Fu","year":"2024","journal-title":"IEEE\/ACM Trans. Netw."},{"key":"ref_97","doi-asserted-by":"crossref","unstructured":"Zhao, R., Deng, X., Wang, Y., Chen, L., Liu, M., Xue, Z., and Wang, Y. (2022, January 10\u201312). Flow Sequence-Based Anonymity Network Traffic Identification with Residual Graph Convolutional Networks. Proceedings of the 2022 IEEE\/ACM 30th International Symposium on Quality of Service (IWQoS 2022), Oslo, Norway.","DOI":"10.1109\/IWQoS54832.2022.9812882"},{"key":"ref_98","doi-asserted-by":"crossref","first-page":"2703","DOI":"10.1109\/TIFS.2022.3191493","article-title":"Wrongdoing Monitor: A Graph-Based Behavioral Anomaly Detection in Cyber Security","volume":"17","author":"Wang","year":"2022","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"ref_99","doi-asserted-by":"crossref","first-page":"1566","DOI":"10.1109\/TIFS.2023.3240291","article-title":"Federated Graph Neural Network for Fast Anomaly Detection in Controller Area Networks","volume":"18","author":"Zhang","year":"2023","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"ref_100","doi-asserted-by":"crossref","first-page":"1258","DOI":"10.1109\/TNSM.2023.3344580","article-title":"DGNN: Accurate Darknet Application Classification Adopting Attention Graph Neural Network","volume":"21","author":"Zhu","year":"2024","journal-title":"IEEE Trans. Netw. Serv. Manag."},{"key":"ref_101","doi-asserted-by":"crossref","unstructured":"Pham, T.-D., Ho, T.-L., Truong-Huu, T., Cao, T.-D., and Truong, H.-L. (2021, January 6\u201310). MAppGraph: Mobile-App Classification on Encrypted Network Traffic Using Deep Graph Convolution Neural Networks. Proceedings of the 37th Annual Computer Security Applications Conference (ACSAC 2021), Virtual Event.","DOI":"10.1145\/3485832.3485925"},{"key":"ref_102","doi-asserted-by":"crossref","first-page":"101792","DOI":"10.1016\/j.cose.2020.101792","article-title":"AMalNet: A Deep Learning Framework Based on Graph Convolutional Networks for Malware Detection","volume":"93","author":"Pei","year":"2020","journal-title":"Comput. Secur."},{"key":"ref_103","first-page":"188","article-title":"Web Page Classification Based on Graph Neural Network","volume":"Volume 279","author":"Barolli","year":"2022","journal-title":"Innovative Mobile and Internet Services in Ubiquitous Computing"},{"key":"ref_104","doi-asserted-by":"crossref","first-page":"4","DOI":"10.1109\/TNNLS.2020.2978386","article-title":"A Comprehensive Survey on Graph Neural Networks","volume":"32","author":"Wu","year":"2021","journal-title":"IEEE Trans. Neural Netw. Learn. Syst."},{"key":"ref_105","doi-asserted-by":"crossref","unstructured":"Fan, W., Ma, Y., Li, Q., He, Y., Zhao, E., Tang, J., and Yin, D. (2019, January 13\u201317). Graph Neural Networks for Social Recommendation. Proceedings of the 2019 World Wide Web Conference (WWW \u201819), San Francisco, CA, USA.","DOI":"10.1145\/3308558.3313488"},{"key":"ref_106","doi-asserted-by":"crossref","first-page":"111423","DOI":"10.1016\/j.asoc.2024.111423","article-title":"Interaction Matters: Encrypted Traffic Classification via Status-Based Interactive Behavior Graph","volume":"155","author":"Li","year":"2024","journal-title":"Appl. Soft Comput."},{"key":"ref_107","doi-asserted-by":"crossref","unstructured":"Busch, J., Kocheturov, A., Tresp, V., and Seidl, T. (2021, January 6\u20137). NF-GNN: Network Flow Graph Neural Networks for Malware Detection and Classification. Proceedings of the 33rd International Conference on Scientific and Statistical Database Management (SSDBM 2021), Tampa, FL, USA.","DOI":"10.1145\/3468791.3468814"},{"key":"ref_108","doi-asserted-by":"crossref","first-page":"110475","DOI":"10.1016\/j.comnet.2024.110475","article-title":"TLS Fingerprint for Encrypted Malicious Traffic Detection with Attributed Graph Kernel","volume":"247","author":"Yu","year":"2024","journal-title":"Comput. Netw."},{"key":"ref_109","doi-asserted-by":"crossref","first-page":"3595304","DOI":"10.1155\/2022\/3595304","article-title":"Interaction Context-Aware Network Behavior Anomaly Detection for Discovering Unknown Attacks","volume":"2022","author":"Qin","year":"2022","journal-title":"Secur. Commun. Netw."},{"key":"ref_110","doi-asserted-by":"crossref","first-page":"103466","DOI":"10.1016\/j.cose.2023.103466","article-title":"TGPrint: Attack Fingerprint Classification on Encrypted Network Traffic Based Graph Convolution Attention Networks","volume":"135","author":"Wang","year":"2023","journal-title":"Comput. Secur."},{"key":"ref_111","doi-asserted-by":"crossref","first-page":"100","DOI":"10.1016\/j.cose.2014.05.011","article-title":"An Empirical Comparison of Botnet Detection Methods","volume":"45","author":"Garcia","year":"2014","journal-title":"Comput. Secur."},{"key":"ref_112","unstructured":"Song, H.M., and Kim, H.K. (2020). CAN Signal Extraction and Translation Dataset, HCRL. Available online: https:\/\/ocslab.hksecurity.net\/Datasets\/can-signal-extraction-and-translation-dataset."},{"key":"ref_113","doi-asserted-by":"crossref","unstructured":"Arp, D., Spreitzenbarth, M., H\u00fcbner, M., Gascon, H., Rieck, K., and Siemens, C.E.R.T. (2014, January 23\u201326). DREBIN: Effective and Explainable Detection of Android Malware in Your Pocket. Proceedings of the Network and Distributed System Security Symposium (NDSS), San Diego, CA, USA.","DOI":"10.14722\/ndss.2014.23247"},{"key":"ref_114","doi-asserted-by":"crossref","unstructured":"Lashkari, A.H., Kadir, A.F.A., Taheri, L., and Ghorbani, A.A. (2018, January 22\u201325). Toward Developing a Systematic Approach to Generate Benchmark Android Malware Datasets and Classification. Proceedings of the 2018 International Carnahan Conference on Security Technology (ICCST), Montreal, QC, Canada.","DOI":"10.1109\/CCST.2018.8585560"},{"key":"ref_115","unstructured":"Praguard (2025, June 27). Public Malware Traffic Dataset. Available online: https:\/\/github.com\/Praguard."},{"key":"ref_116","doi-asserted-by":"crossref","first-page":"28791","DOI":"10.1109\/ACCESS.2019.2902299","article-title":"Fault Diagnosis of Power Transformers With Membership Degree","volume":"7","author":"Li","year":"2019","journal-title":"IEEE Access"},{"key":"ref_117","doi-asserted-by":"crossref","first-page":"165130","DOI":"10.1109\/ACCESS.2020.3022862","article-title":"TON_IoT Telemetry Dataset: A New Generation Dataset of IoT and IIoT for Data-Driven Intrusion Detection Systems","volume":"8","author":"Alsaedi","year":"2020","journal-title":"IEEE Access"},{"key":"ref_118","doi-asserted-by":"crossref","unstructured":"Moustafa, N., and Slay, J. (2015, January 10\u201312). UNSW-NB15: A Comprehensive Data Set for Network Intrusion Detection Systems (UNSW-NB15 Network Data Set). Proceedings of the 2015 Military Communications and Information Systems Conference (MilCIS), Canberra, ACT, Australia.","DOI":"10.1109\/MilCIS.2015.7348942"},{"key":"ref_119","doi-asserted-by":"crossref","first-page":"100359","DOI":"10.1016\/j.bdr.2022.100359","article-title":"Evaluating standard feature sets towards increased generalisability and explainability of MLbased network intrusion detection","volume":"30","author":"Sarhan","year":"2020","journal-title":"Big Data Res."},{"key":"ref_120","unstructured":"Lashkari, A.H., Kaur, G., and Rahali, A. (2020, January 27\u201329). DIDarknet: A Contemporary Approach to Detect and Characterize the Darknet Traffic Using Deep Image Learning. Proceedings of the 10th International Conference on Communication and Network Security (ICCNS), Tokyo, Japan."},{"key":"ref_121","unstructured":"Lashkari, A.H., Draper-Gil, G., Mamun, M.S.I., and Ghorbani, A.A. (2017, January 19\u201321). Characterization of Tor Traffic Using Time Based Features. Proceedings of the 3rd International Conference on Information Systems Security and Privacy (ICISSP), Porto, Portugal."},{"key":"ref_122","unstructured":"Sharafaldin, I., Lashkari, A.H., and Ghorbani, A.A. (2019, January 20\u201324). Toward the Development of a New Intrusion Detection System for the Internet of Things. Proceedings of the 2019 IEEE International Conference on Communications (ICC), Shanghai, China."},{"key":"ref_123","doi-asserted-by":"crossref","unstructured":"Song, J., Takakura, H., Okabe, Y., Eto, M., Inoue, D., and Nakao, K. (2011, January 21). Statistical Analysis of Honeypot Data and Building of Kyoto 2006+ Dataset for NIDS Evaluation. Proceedings of the First Workshop on Building Analysis Datasets and Gathering Experience Returns for Security (BADGERS \u201811), Chicago, IL, USA.","DOI":"10.1145\/1978672.1978676"},{"key":"ref_124","doi-asserted-by":"crossref","unstructured":"Allix, K., Bissyand\u00e9, T.F., Klein, J., and Le Traon, Y. (2016, January 14\u201315). AndroZoo: Collecting Millions of Android Apps for the Research Community. Proceedings of the 13th International Conference on Mining Software Repositories (MSR), Austin, TX, USA.","DOI":"10.1145\/2901739.2903508"}],"container-title":["Big Data and Cognitive Computing"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/2504-2289\/9\/11\/270\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,27]],"date-time":"2025-10-27T08:13:43Z","timestamp":1761552823000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/2504-2289\/9\/11\/270"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,10,24]]},"references-count":124,"journal-issue":{"issue":"11","published-online":{"date-parts":[[2025,11]]}},"alternative-id":["bdcc9110270"],"URL":"https:\/\/doi.org\/10.3390\/bdcc9110270","relation":{},"ISSN":["2504-2289"],"issn-type":[{"value":"2504-2289","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,10,24]]}}}