Intrusion Detection of Industrial Internet-of-Things Based on Reconstructed Graph Neural Networks

Industrial Internet-of-Things (IIoT) are highly vulnerable to cyber-attacks due to their open deployment in unattended environments. Intrusion detection is an efficient solution to improve security. However, because the labeled samples are difficult to obtain, and the sample categories are imbalanced in real applications, it is difficult to obtain a reliable model. In this paper, a general framework for intrusion detection is proposed based on graph neural network technologies. In detail, a network embedding feature representation is proposed to deal with the high dimensional, redundant but categories imbalanced and rare labeled data in IIoT. To avoid the influence caused by the inaccurate network structure, a network constructor with refinement regularization is designed to amend it. At last, the network embedding representation weights and network constructor are trained together. The high accuracy and robust properties of the proposed method were verified by conducting intrusion detection tasks based on public datasets. Compared with several state-of-art algorithms, the proposed framework outperforms these methods in many evaluation metrics. In addition, a hard-in-the-loop platform is designed to test the performance in real environments. The results show that the method can not only identify different attacks but also distinguish between cyber-attacks and physical failures.