A survey on graph neural networks for intrusion detection systems: Methods, trends and challenges

Intrusion detection systems (IDS) play a crucial role in maintaining network security. With the increasing sophistication of cyber attack methods, traditional detection approaches are encountering more challenges. In recent years, graph neural networks (GNNs) have garnered significant attention in the field of intrusion detection due to their unique ability to capture the relationships within the graph structure of data communications. In this review, we propose a novel taxonomy that categorizes advanced research into three distinct areas: tasks related to graph construction, network design, and GNN models deployment. We detail a generalized design process for GNN-based intrusion detection models, discussing the challenges encountered at each stage. Building upon these discussions, we conduct a systematic survey of existing works. Ultimately, we delve into a thorough exploration of the future research directions and the pending issues in this domain. By adopting a problem-oriented taxonomy and conducting a targeted survey, this review aims to provide scholars with a clear, systematic framework for deepening their understanding and further exploration of the field.