The increasing deployment of IoT devices has introduced new cybersecurity vulnerabilities, as traditional defense mechanisms often fail to protect resource-constrained and highly heterogeneous environments. Network traffic analysis has emerged as a key strategy for detecting malicious activities; however, the inherent dynamism of IoT communications undermines the effectiveness of traditional security mechanisms. In this paper, we focus on detecting malicious activities in IoT networks by solving a node-classification problem in a graph-based network representation. We evaluate six Graph Neural Network methods, encompassing both static and time-dependent models, using two distinct graph representations of network traffic. Our analysis is conducted across three recent IoT traffic datasets, and considers multiple snapshot durations to understand how temporal granularity affects detection accuracy. Through extensive experiments, we assess the impact of graph structure, snapshot duration, and temporal modeling on detection performance. Results show that GNNs, especially static models, are effective at identifying anomalous nodes even in unseen environments. We find that shorter snapshot durations consistently improve model accuracy by reducing noise in node embeddings, and that simpler traffic representation often match or outperform more complex counterparts, particularly when computational efficiency is a concern. Additionally, further research is needed to draw firm conclusions about dynamic methods. Our findings provide actionable insights for selecting models, representations, and configurations in the design of GNN-based intrusion detection systems for IoT networks.
扫码关注我们
求助内容：
应助结果提醒方式：
京公网安备 11010802042870号