{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,5]],"date-time":"2026-06-05T14:47:13Z","timestamp":1780670833150,"version":"3.54.1"},"reference-count":36,"publisher":"MDPI AG","issue":"7","license":[{"start":{"date-parts":[[2025,6,24]],"date-time":"2025-06-24T00:00:00Z","timestamp":1750723200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"Presidential Foundation of CAEP","award":["YZJJZQ2023026"],"award-info":[{"award-number":["YZJJZQ2023026"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Symmetry"],"abstract":"<jats:p>Deep learning greatly improves the detection efficiency of abnormal traffic through autonomous learning and effective extraction of data feature information. Among them, Graph Neural Networks (GNN) effectively fit the data features of abnormal traffic by aggregating the features and structural information of network nodes. However, the performance of GNN in the field of industrial Internet of Things (IIoT) is still insufficient. Since the asymmetry of GNN traffic data is greater than that of the traditional Internet, it is necessary to propose a detection method with high detection rate. At present, many algorithms overly emphasize the optimization of graph neural network models, while ignoring the heterogeneity of resources caused by the diversity of devices in IIoT networks, and the different traffic characteristics caused by multi type protocols. Therefore, universal GNN may not be fully applicable. Therefore, a novel intrusion detection framework incorporating graph neural networks is developed for Industrial Internet of Things systems. Design mini-batch sampling to support data parallelism and accelerate the training process in response to the distributed characteristics of the IIoT. Due to the strong real-time characteristics of the industrial IIoT, data packets in concentrated time periods contain a large number of feature attributes, and the high redundancy of features due to the correlation between features. This paper establishes a model temporal correlation and designs a new model. The performance of the proposed GIDS model is evaluated on several benchmark datasets such as BoT-IoT, ACI-IoT-2023 and OPCUA. The results marked that the method performs well on both binary classification task and multiclass classification task. The accuracy on binary classification task is 93.63%, 97.34% and 100% with F1 values of 94.34%, 97.68% and 100.00% respectively. The accuracy on multiclass classification task is 92.34%, 93.68% and 99.99% with F1 values of 94.55%, 94.12% and 99.99% respectively. Through experimental measurements, the model effectively utilizes the natural distribution characteristics of network traffic in both temporal and spatial dimensions, achieving better detection results.<\/jats:p>","DOI":"10.3390\/sym17070997","type":"journal-article","created":{"date-parts":[[2025,6,24]],"date-time":"2025-06-24T12:05:40Z","timestamp":1750766740000},"page":"997","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":17,"title":["Industrial Internet of Things Intrusion Detection System Based on Graph Neural Network"],"prefix":"10.3390","volume":"17","author":[{"given":"Siqi","family":"Yang","sequence":"first","affiliation":[{"name":"Institute of Computer Application, China Academy of Engineering Physics, Mianyang 621900, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Wenqiang","family":"Pan","sequence":"additional","affiliation":[{"name":"Institute of Computer Application, China Academy of Engineering Physics, Mianyang 621900, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Min","family":"Li","sequence":"additional","affiliation":[{"name":"Zhongguancun Laboratory, Beijing 100094, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Mingyong","family":"Yin","sequence":"additional","affiliation":[{"name":"Institute of Computer Application, China Academy of Engineering Physics, Mianyang 621900, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Hao","family":"Ren","sequence":"additional","affiliation":[{"name":"Institute of Computer Application, China Academy of Engineering Physics, Mianyang 621900, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yue","family":"Chang","sequence":"additional","affiliation":[{"name":"Institute of Computer Application, China Academy of Engineering Physics, Mianyang 621900, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yidou","family":"Liu","sequence":"additional","affiliation":[{"name":"Institute of Computer Application, China Academy of Engineering Physics, Mianyang 621900, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Senyao","family":"Zhang","sequence":"additional","affiliation":[{"name":"School of Artificial Intelligence, China University of Mining and Technology-Beijing, Beijing 100083, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Fang","family":"Lou","sequence":"additional","affiliation":[{"name":"Institute of Computer Application, China Academy of Engineering Physics, Mianyang 621900, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2025,6,24]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"283","DOI":"10.1016\/j.comnet.2018.11.025","article-title":"Current research on Internet of Things (IoT) security: A survey","volume":"148","author":"Hassan","year":"2019","journal-title":"Comput. Netw."},{"key":"ref_2","doi-asserted-by":"crossref","first-page":"616","DOI":"10.1109\/COMST.2019.2953364","article-title":"Security of the Internet of Things: Vulnerabilities, attacks, and countermeasures","volume":"22","author":"Butun","year":"2019","journal-title":"IEEE Commun. Surv. Tutor."},{"key":"ref_3","doi-asserted-by":"crossref","first-page":"219709","DOI":"10.1109\/ACCESS.2020.3037359","article-title":"A survey of security challenges, attacks taxonomy and advanced countermeasures in the internet of things","volume":"8","author":"Khanam","year":"2020","journal-title":"IEEE Access"},{"key":"ref_4","unstructured":"Antonakakis, M., April, T., Bailey, M., Bernhard, M., Bursztein, E., Cochran, J., Durumeric, Z., Halderman, J.A., Invernizzi, L., and Kallitsis, M. (2017, January 16\u201318). Understanding the mirai botnet. Proceedings of the 26th USENIX Security Symposium (USENIX Security 17), Vancouver, BC, Canada."},{"key":"ref_5","doi-asserted-by":"crossref","unstructured":"Yang, S., Pan, W., Zheng, W., Yin, M., Lou, F., Hu, T., and Xie, J. (2023, January 10\u201313). CLAST: Efficient Certificateless Sequential Aggregate Signature Scheme for Industrial Internet of Things Environments. Proceedings of the 2023 IEEE 11th International Conference on Information, Communication and Networks (ICICN), Xi\u2019an, China.","DOI":"10.1109\/ICICN59530.2023.10393378"},{"key":"ref_6","doi-asserted-by":"crossref","unstructured":"Hu, T., Yang, S., Wang, Y., Li, G., Wang, Y., Wang, G., and Yin, M. (2023). N-Accesses: A Blockchain-Based Access Control Framework for Secure IoT Data Management. Sensors, 23.","DOI":"10.3390\/s23208535"},{"key":"ref_7","doi-asserted-by":"crossref","first-page":"100441","DOI":"10.1016\/j.iot.2021.100441","article-title":"OPIIoT: Design and implementation of an open communication protocol platform for industrial internet of things","volume":"16","author":"Hsiao","year":"2021","journal-title":"Internet Things"},{"key":"ref_8","doi-asserted-by":"crossref","first-page":"8129","DOI":"10.1109\/TII.2022.3163558","article-title":"Time-varying-aware network traffic prediction via deep learning in IIoT","volume":"18","author":"Wang","year":"2022","journal-title":"IEEE Trans. Ind. Inform."},{"key":"ref_9","doi-asserted-by":"crossref","first-page":"1550147718794615","DOI":"10.1177\/1550147718794615","article-title":"A survey of intrusion detection on industrial control systems","volume":"14","author":"Hu","year":"2018","journal-title":"Int. J. Distrib. Sens. Netw."},{"key":"ref_10","unstructured":"Veli\u010dkovi\u0107, P., Cucurull, G., Casanova, A., Romero, A., Lio, P., and Bengio, Y. (2017). Graph attention networks. arXiv."},{"key":"ref_11","unstructured":"Liao, R., Brockschmidt, M., Tarlow, D., Gaunt, A.L., Urtasun, R., and Zemel, R. (2018). Graph partition neural networks for semi-supervised classification. arXiv."},{"key":"ref_12","unstructured":"Chen, J., Zhu, J., and Song, L. (2017). Stochastic training of graph convolutional networks with variance reduction. arXiv."},{"key":"ref_13","doi-asserted-by":"crossref","first-page":"82721","DOI":"10.1109\/ACCESS.2019.2924045","article-title":"A survey on IoT security: Application areas, security threats, and solution architectures","volume":"7","author":"Hassija","year":"2019","journal-title":"IEEE Access"},{"key":"ref_14","doi-asserted-by":"crossref","first-page":"3211","DOI":"10.1007\/s11831-020-09496-0","article-title":"A review on machine learning and deep learning perspectives of IDS for IoT: Recent updates, security issues, and challenges","volume":"28","author":"Thakkar","year":"2021","journal-title":"Arch. Comput. Methods Eng."},{"key":"ref_15","doi-asserted-by":"crossref","unstructured":"Andrea, I., Chrysostomou, C., and Hadjichristofi, G. (2015, January 6\u20139). Internet of Things: Security vulnerabilities and challenges. Proceedings of the 2015 IEEE Symposium on Computers and Communication (ISCC), Larnaca, Cyprus.","DOI":"10.1109\/ISCC.2015.7405513"},{"key":"ref_16","doi-asserted-by":"crossref","first-page":"63995","DOI":"10.1109\/ACCESS.2021.3075066","article-title":"Machine learning for misuse-based network intrusion detection: Overview, unified evaluation and feature choice comparison framework","volume":"9","author":"Goedeme","year":"2021","journal-title":"IEEE Access"},{"key":"ref_17","doi-asserted-by":"crossref","first-page":"353","DOI":"10.1016\/j.cose.2011.05.008","article-title":"Data preprocessing for anomaly based network intrusion detection: A review","volume":"30","author":"Davis","year":"2011","journal-title":"Comput. Secur."},{"key":"ref_18","doi-asserted-by":"crossref","first-page":"102675","DOI":"10.1016\/j.cose.2022.102675","article-title":"A systematic literature review of methods and datasets for anomaly-based network intrusion detection","volume":"116","author":"Yang","year":"2022","journal-title":"Comput. Secur."},{"key":"ref_19","unstructured":"Anderson, D., Frivold, T., and Valdes, A. (2025, March 30). Next-Generation Intrusion Detection Expert System (NIDES): A Summary. Available online: https:\/\/www.csl.sri.com\/papers\/4sri\/4sri.pdf."},{"key":"ref_20","doi-asserted-by":"crossref","first-page":"1781","DOI":"10.1109\/JSAC.2006.877131","article-title":"Fast and scalable pattern matching for network intrusion detection systems","volume":"24","author":"Dharmapurikar","year":"2006","journal-title":"IEEE J. Sel. Areas Commun."},{"key":"ref_21","doi-asserted-by":"crossref","unstructured":"Nikolopoulos, S.D., and Polenakis, I. (2015, January 25\u201326). A graph-based model for malicious code detection exploiting dependencies of system-call groups. Proceedings of the 16th International Conference on Computer Systems and Technologies, Dublin, Ireland.","DOI":"10.1145\/2812428.2812432"},{"key":"ref_22","doi-asserted-by":"crossref","first-page":"1153","DOI":"10.1109\/COMST.2015.2494502","article-title":"A survey of data mining and machine learning methods for cyber security intrusion detection","volume":"18","author":"Buczak","year":"2015","journal-title":"IEEE Commun. Surv. Tutor."},{"key":"ref_23","doi-asserted-by":"crossref","first-page":"2986","DOI":"10.1109\/TC.2016.2519914","article-title":"Building an intrusion detection system using a filter-based feature selection algorithm","volume":"65","author":"Ambusaidi","year":"2016","journal-title":"IEEE Trans. Comput."},{"key":"ref_24","doi-asserted-by":"crossref","first-page":"3","DOI":"10.1049\/iet-net.2018.5036","article-title":"COLIDE: A collaborative intrusion detection framework for Internet of Things","volume":"8","author":"Arshad","year":"2019","journal-title":"IET Netw."},{"key":"ref_25","doi-asserted-by":"crossref","first-page":"49114","DOI":"10.1109\/ACCESS.2023.3275789","article-title":"Graph neural networks for intrusion detection: A survey","volume":"11","author":"Bilot","year":"2023","journal-title":"IEEE Access"},{"key":"ref_26","doi-asserted-by":"crossref","unstructured":"Li, Y., Huang, X., Li, J., Du, M., and Zou, N. (2019, January 3\u20137). Specae: Spectral autoencoder for anomaly detection in attributed networks. Proceedings of the 28th ACM international Conference on Information and Knowledge Management, Beijing, China.","DOI":"10.1145\/3357384.3358074"},{"key":"ref_27","doi-asserted-by":"crossref","first-page":"103821","DOI":"10.1016\/j.cose.2024.103821","article-title":"A Survey on Graph Neural Networks for Intrusion Detection Systems: Methods, Trends and Challenges","volume":"141","author":"Zhong","year":"2024","journal-title":"Comput. Secur."},{"key":"ref_28","unstructured":"Hamilton, W., Ying, Z., and Leskovec, J. (2017). Inductive representation learning on large graphs. arXiv."},{"key":"ref_29","doi-asserted-by":"crossref","unstructured":"Zheng, L., Li, Z., Li, J., Li, Z., and Gao, J. (2019, January 10\u201316). AddGraph: Anomaly Detection in Dynamic Graph Using Attention-based Temporal GCN. Proceedings of the IJCAI, Macao, China.","DOI":"10.24963\/ijcai.2019\/614"},{"key":"ref_30","unstructured":"Chang, L., and Branco, P. (2021). Graph-based solutions with residuals for intrusion detection: The modified e-graphsage and e-resgat algorithms. arXiv."},{"key":"ref_31","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/3565973","article-title":"Graph neural networks in IoT: A survey","volume":"19","author":"Dong","year":"2023","journal-title":"ACM Trans. Sens. Netw."},{"key":"ref_32","doi-asserted-by":"crossref","first-page":"779","DOI":"10.1016\/j.future.2019.05.041","article-title":"Towards the development of realistic botnet dataset in the internet of things for network forensic analytics: Bot-iot dataset","volume":"100","author":"Koroniotis","year":"2019","journal-title":"Future Gener. Comput. Syst."},{"key":"ref_33","unstructured":"Bastian, N., Bierbrauer, D., McKenzie, M., and Nack, E. (2023). ACI IoT Network Traffic Dataset 2023. IEEE Dataport."},{"key":"ref_34","unstructured":"(2020, May 01). The OPC UA Dataset Description. Website. Available online: https:\/\/ieee-dataport.org\/open-access\/m2m-using-opc-ua."},{"key":"ref_35","doi-asserted-by":"crossref","unstructured":"Yang, L., Shami, A., Stevens, G., and De Rusett, S. (2022, January 4\u20138). LCCDE: A decision-based ensemble framework for intrusion detection in the Internet of Vehicles. Proceedings of the GLOBECOM 2022-2022 IEEE Global Communications Conference, Rio de Janeiro, Brazil.","DOI":"10.1109\/GLOBECOM48099.2022.10001280"},{"key":"ref_36","doi-asserted-by":"crossref","first-page":"110030","DOI":"10.1016\/j.knosys.2022.110030","article-title":"Anomal-E: A self-supervised network intrusion detection system based on graph neural networks","volume":"258","author":"Caville","year":"2022","journal-title":"Knowl.-Based Syst."}],"container-title":["Symmetry"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/2073-8994\/17\/7\/997\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,9]],"date-time":"2025-10-09T17:57:59Z","timestamp":1760032679000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/2073-8994\/17\/7\/997"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,6,24]]},"references-count":36,"journal-issue":{"issue":"7","published-online":{"date-parts":[[2025,7]]}},"alternative-id":["sym17070997"],"URL":"https:\/\/doi.org\/10.3390\/sym17070997","relation":{},"ISSN":["2073-8994"],"issn-type":[{"value":"2073-8994","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,6,24]]}}}