Graph neural network method boosts detection of rare cyberattacks in imbalanced data

Researchers have introduced a graph-based intrusion detection framework designed to tackle a persistent weakness in security systems for industrial control environments: when attack samples are scarce, conventional models tend to favour the majority class and fail to detect rare attacks.

The method, called Enhanced Graph Neural Networks (EGNN), was described by Xuebei Liu and Wenping Ma in a paper published in Cluster Computing. The work addresses the problem of imbalanced class distributions, in which normal behaviour dominates the data and minority attack classes are underrepresented, causing models to underfit those minority classes.

The central idea of EGNN is to increase the number of samples available for minority classes so the model can better learn their features. Rather than relying solely on the limited labeled attack data, the framework generates pseudo-samples based on a graph structure constructed from the same labeled samples, expanding the effective representation of rare attack types.

To make better use of labeled data, the approach also employs semi-supervised learning to assign pseudo-labels to a large amount of unlabeled data. The quality of these pseudo-labels is controlled through dynamic thresholds, which the authors set differently for different classes.

A key design choice is that lower thresholds are applied to minority classes. This makes it easier for samples belonging to rare attack types to receive pseudo-labels, further expanding their sample size and counteracting the bias toward majority classes that plagues existing methods.

According to the paper, the scheme addresses the high leakage and false alarm rates that arise from the scarcity of attack samples and the predominance of normal behaviours in industrial control system traffic, with the goal of enhancing overall system security.

The authors report extensive multiclass classification experiments on two imbalanced intrusion detection datasets. In these experiments, the framework achieved up to a 19.09% improvement in detection performance, and the results indicated that the approach outperformed state-of-the-art methods with which it was compared.

The work reflects a broader trend in which graph-based intrusion detection techniques have advanced rapidly in recent years and emerged as a crucial means of ensuring the security of industrial control systems. By combining graph-structured sample generation with threshold-controlled semi-supervised labeling, EGNN offers a way to sharpen detection of rare attacks without requiring large volumes of labeled attack data, a resource that is often difficult to obtain in operational security settings.

Subject of Research: A graph neural network framework for intrusion detection under class-imbalanced data distributions.

Article Title: EGNN: A graph-based intrusion detection framework considering class-imbalanced problem

Article References: Liu, X., & Ma, W. (2026). EGNN: A graph-based intrusion detection framework considering class-imbalanced problem. Cluster Computing, 29(15), Article 890. https://doi.org/10.1007/s10586-026-06678-6

Image Credits: AI Generated

DOI: 10.1007/s10586-026-06678-6

Keywords: intrusion detection, graph neural networks, class imbalance, industrial control systems, semi-supervised learning, pseudo-labels, network security, machine learning, anomaly detection, cybersecurity, EGNN, graph-based