Network Traffic Modeling for Anomaly Detection Using GraphSAGE A Graph Neural Network and Feature Analysis Framework

Abstract

This study aims to present an intelligent framework based on the Graph Sample and Aggregation (GraphSAGE) model for analyzing network traffic and accurately and efficiently detecting anomalous activities. The framework incorporates advanced steps for data preprocessing, selecting the most important features, value normalization, and handling class imbalance using the Synthetic Minority Over-sampling Technique (SMOTE), thereby enhancing the quality of input data for the model.

The UNSW-NB15 dataset was used to train and evaluate the proposed model. The results demonstrated high performance, with a classification accuracy of 89.08% and an Area Under the Curve - Receiver Operating Characteristic (AUC-ROC) value of 96%, indicating the model's effectiveness in distinguishing between normal activities and cyberattacks. Additionally, the confusion matrix along with precision and recall metrics showed a balanced performance across both classes.

These results reflect the promising potential of Graph Neural Network (GNN) models in developing intelligent intrusion detection systems within cybersecurity environments.