%Version 3.1 December 2024
% See section 11 of the User Manual for version history
%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%                                                                 %%
%% Please do not use \input{...} to include other tex files.       %%
%% Submit your LaTeX manuscript as one .tex document.              %%
%%                                                                 %%
%% All additional figures and files should be attached             %%
%% separately and not embedded in the \TeX\ document itself.       %%
%%                                                                 %%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%%\documentclass[referee,sn-basic]{sn-jnl}% referee option is meant for double line spacing

%%=======================================================%%
%% to print line numbers in the margin use lineno option %%
%%=======================================================%%

%%\documentclass[lineno,pdflatex,sn-basic]{sn-jnl}% Basic Springer Nature Reference Style/Chemistry Reference Style

%%=========================================================================================%%
%% the documentclass is set to pdflatex as default. You can delete it if not appropriate.  %%
%%=========================================================================================%%

%%\documentclass[sn-basic]{sn-jnl}% Basic Springer Nature Reference Style/Chemistry Reference Style

%%Note: the following reference styles support Namedate and Numbered referencing. By default the style follows the most common style. To switch between the options you can add or remove Numbered in the optional parenthesis. 
%%The option is available for: sn-basic.bst, sn-chicago.bst%  
 
%%\documentclass[pdflatex,sn-nature]{sn-jnl}% Style for submissions to Nature Portfolio journals
%%\documentclass[pdflatex,sn-basic]{sn-jnl}% Basic Springer Nature Reference Style/Chemistry Reference Style
\documentclass[pdflatex,sn-mathphys-num]{sn-jnl}% Math and Physical Sciences Numbered Reference Style
%%\documentclass[pdflatex,sn-mathphys-ay]{sn-jnl}% Math and Physical Sciences Author Year Reference Style
%%\documentclass[pdflatex,sn-aps]{sn-jnl}% American Physical Society (APS) Reference Style
%%\documentclass[pdflatex,sn-vancouver-num]{sn-jnl}% Vancouver Numbered Reference Style
%%\documentclass[pdflatex,sn-vancouver-ay]{sn-jnl}% Vancouver Author Year Reference Style
%%\documentclass[pdflatex,sn-apa]{sn-jnl}% APA Reference Style
%%\documentclass[pdflatex,sn-chicago]{sn-jnl}% Chicago-based Humanities Reference Style

%%%% Standard Packages
%%<additional latex packages if required can be included here>

\usepackage{graphicx}%
\usepackage{multirow}%
\usepackage{amsmath,amssymb,amsfonts}%
\usepackage{amsthm}
\usepackage{mathrsfs}%
\usepackage[title]{appendix}%
\usepackage{xcolor}%
\usepackage{textcomp}%
\usepackage{manyfoot}%
\usepackage{booktabs}%
\usepackage{algorithm}%
\usepackage{algorithmicx}%
\usepackage{algpseudocode}%
\usepackage{listings}%
\usepackage{tikz}
\usepackage{pgfplots}
\pgfplotsset{compat=1.18}

%%%%

%%%%%=============================================================================%%%%
%%%%  Remarks: This template is provided to aid authors with the preparation
%%%%  of original research articles intended for submission to journals published 
%%%%  by Springer Nature. The guidance has been prepared in partnership with 
%%%%  production teams to conform to Springer Nature technical requirements. 
%%%%  Editorial and presentation requirements differ among journal portfolios and 
%%%%  research disciplines. You may find sections in this template are irrelevant 
%%%%  to your work and are empowered to omit any such section if allowed by the 
%%%%  journal you intend to submit to. The submission guidelines and policies 
%%%%  of the journal take precedence. A detailed User Manual is available in the 
%%%%  template package for technical guidance.
%%%%%=============================================================================%%%%

%% as per the requirement new theorem styles can be included as shown below
\theoremstyle{thmstyleone}%
\newtheorem{theorem}{Theorem}%  meant for continuous numbers
%%\newtheorem{theorem}{Theorem}[section]% meant for sectionwise numbers
%% optional argument [theorem] produces theorem numbering sequence instead of independent numbers for Proposition
\newtheorem{proposition}[theorem]{Proposition}% 
%%\newtheorem{proposition}{Proposition}% to get separate numbers for theorem and proposition etc.

\theoremstyle{thmstyletwo}%
\newtheorem{example}{Example}%
\newtheorem{remark}{Remark}%

\theoremstyle{thmstylethree}%
\newtheorem{definition}{Definition}%

\raggedbottom
%%\unnumbered% uncomment this for unnumbered level heads

\begin{document}

\title[Article Title]{Deep Learning for IoT Security: Leveraging GNNs and Attention Networks}

%%=============================================================%%
%% GivenName	-> \fnm{Joergen W.}
%% Particle	-> \spfx{van der} -> surname prefix
%% FamilyName	-> \sur{Ploeg}
%% Suffix	-> \sfx{IV}
%% \author*[1,2]{\fnm{Joergen W.} \spfx{van der} \sur{Ploeg} 
%%  \sfx{IV}}\email{iauthor@gmail.com}
%%=============================================================%%

\author*[1,2]{\fnm{Khalid} \sur{El Azhar}}\email{khalid.elazhar@usmba.ac.ma}
\author[3,4]{\fnm{Ghizlane} \sur{Hnini}}\email{ghizlane.hnini@uit.ac.ma}
\author[1,2]{\fnm{Khalid} \sur{El Fazazi}}\email{khalid.elfazazy@usmba.ac.ma}
\author[1,2]{\fnm{Mohamed Adnane} \sur{Mahraz}}\email{mohamed.mahraz@usmba.ac.ma}
\author[1,2]{\fnm{Hamid} \sur{Tairi}}\email{hamid.tairi@usmba.ac.ma}
\author[1,2]{\fnm{Jamal} \sur{Riffi}}\email{jamal.riffi@usmba.ac.ma}
\equalcont{These authors contributed equally to this work.}
\affil[1]{
  \orgdiv{Faculté des Sciences Dhar El Mahraz, Département d’Informatique}, 
  \orgname{Université Sidi Mohamed Ben Abdellah}, 
  \orgaddress{
    \street{Avenue Ibn Battouta, B.P. 1796 Atlas}, 
    \city{Fès}, 
    \postcode{30000}, 
    \state{Fès-Meknès}, 
    \country{Maroc}
  }
}
\affil[3]{
  \orgdiv{Département d’Informatique}, 
  \orgname{Université Ibn Tofaïl}, 
  \orgaddress{
    \street{Campus Universitaire, B.P. 133}, 
    \city{Kénitra}, 
    \postcode{14000}, 
    \state{Région Rabat-Salé-Kénitra}, 
    \country{Maroc}
  }
}

%%==================================%%
%% Sample for unstructured abstract %%
%%==================================%%

\abstract{This study introduces an innovative methodology that combine between two powerful architectures, a graph base on attention network (GAT) with another graph based on àdeep learning algorithm called E-Graphsage, the vector result was given to a model based on a multilayer perceptron (MLP) to enhance the interpretation process. Graph Fusion is a smart implementation for a unique neural network technology for network intrusion detection systems (NIDS). Deep learning has many diversified and complex subfields; in fact, the graph neural networks (GNNs) stand out as one of the latest advancements in DL. graph-based data have proven a good potential to be particularly effective in leveraging the inherent structure difference. Within the scope of network intrusion detection systems (NIDS), flow records represent the information collected from networks that can be conveniently transformed into a graph format for training and evaluation purposes. Furthermore, the main idea of this study is to work with two fields of graphs that combines the GATSAGE and EGraphsage techniques and a multilayer perceptron (MLP) at the last to combine and classify Graphs. We leveraged graph neural networks to address the issue of intrusion detection in IoT networks, grounded on four distinctive datasets—two as Bot and two from Ton. This enabled us to inspect both edge-level interactions in the graph and the sophisticated topological structures characteristic of the network. We see that this approach is a notable enhancement in IoT network security through the use of flow-based data as an intrinsic aspect of analysis. By combining graph analysis and machine learning with an MLP architecture, we achieved superior performance on principal classification tests. Our method was extensively tested on four new NIDS datasets, affirming its effectiveness. We hope our results will encourage further work in this emerging area.}

%%================================%%
%% Sample for structured abstract %%
%%================================%%

% \abstract{\textbf{Purpose:} The abstract serves both as a general introduction to the topic and as a brief, non-technical summary of the main results and their implications. The abstract must not include subheadings (unless expressly permitted in the journal's Instructions to Authors), equations or citations. As a guide the abstract should not exceed 200 words. Most journals do not set a hard limit however authors are advised to check the author instructions for the journal they are submitting to.
% 
% \textbf{Methods:} The abstract serves both as a general introduction to the topic and as a brief, non-technical summary of the main results and their implications. The abstract must not include subheadings (unless expressly permitted in the journal's Instructions to Authors), equations or citations. As a guide the abstract should not exceed 200 words. Most journals do not set a hard limit however authors are advised to check the author instructions for the journal they are submitting to.
% 
% \textbf{Results:} The abstract serves both as a general introduction to the topic and as a brief, non-technical summary of the main results and their implications. The abstract must not include subheadings (unless expressly permitted in the journal's Instructions to Authors), equations or citations. As a guide the abstract should not exceed 200 words. Most journals do not set a hard limit however authors are advised to check the author instructions for the journal they are submitting to.
% 
% \textbf{Conclusion:} The abstract serves both as a general introduction to the topic and as a brief, non-technical summary of the main results and their implications. The abstract must not include subheadings (unless expressly permitted in the journal's Instructions to Authors), equations or citations. As a guide the abstract should not exceed 200 words. Most journals do not set a hard limit however authors are advised to check the author instructions for the journal they are submitting to.}

\keywords{GAT, GraphSage, DNN, IoT Intrusion Detection}

%%\pacs[JEL Classification]{D8, H51}

%%\pacs[MSC Classification]{35A01, 65L10, 65L12, 65L20, 65L70}

\maketitle

\section{Introduction}\label{sec1}
The rise of Networked devices in the Internet of Things has brought with it a growing number attacks in network security. Therefore, it is essential that methods such as intrusion detection system which are reliable and effective be developed to cope with this situation. This work presents a new approach referred too as "graph combination technology. " It can improve the efficacy of cyber attack detection in IoT networks compared with conventional approaches. The results have important implications for advancing cybersecurity practices, both for industry practitioners learning technology solutions and public policy makers who are involved in securing vulnerable networks such as IoT ones.
The suggested approach utilizes the last field in deep learning, graph learning mechanisms, thus can get a high performance of threat detection in any datasets for IoT such as Bot-IoT and Ton-IoT. This approach can assist organizations in strengthening their cybersecurity mechanisms, reducing false positives, and enhancing their capacity for real-time anomaly detection.
Security companies and network operators can integrate the Graph Fusion technique into their security systems to effectively detect and thwart cyberattacks. Moreover, the method's adaptability to fit a large variety of datasets indicates that it may find applicability in numerous IoT settings, from residential smart systems to industrial networks.
Cumulatively, this study contributes towards building more efficient and reliable security measures for IoT networks, which ultimately protect critical infrastructures against novel and emerging cyber threats.
There has been considerable attention in recent academic literature to graph convolutional neural networks (GCNs), owing to the great success these models achieve on most complicated data mining tasks of network analysis. However,In the context of information networks, graphs are particularly useful for modeling and analyzing the interactions between different network elements.
The rapid expansion of the Internet of Things (IoT) has dramatically increased the frequency and complexity of network attacks, posing significant security challenges across its layered architecture. Due to their limited computing power, storage capacity, and network bandwidth, IoT devices are highly vulnerable to various security threats,
IoT network models in the form of graphs allow for visualisation of communications between devices, tracking the flow of data and detecting anomalies that may indicate malicious activity.
The extensive incorporation of the Internet of Things (IoT) in various sectors has resulted in the emergence of the "Internet of Vulnerability" (IoV), a phenomenon where security and privacy issues are frequently ignored in the rush to create and implement IoT devices\cite{Obaidat2020}. The IoT environment is confronted with numerous security risks, encompassing physical and network assaults, breaches in cryptographic mechanisms, vulnerabilities in software, complications related to licensing, surveillance concerns, instances of identity theft, and difficulties associated with ensuring secure communication\cite{Mandapuram2017}.
IoT networks are increasingly targeted by a range of cyber threats, including sophisticated attacks such as ransomware and distributed denial of service (DDoS) incidents. Notably, IoT-based botnets have emerged as a primary source of DDoS attacks, posing a serious and escalating challenge to network security. The rapid proliferation of such botnets represents a critical threat that demands urgent attention. To address this growing risk, it is essential to strengthen IoT security through the deployment of timely and effective mitigation strategies. Accordingly, numerous studies have been conducted to develop advanced detection techniques aimed at reducing the impact of IoT-related cyber threats.
Security Information and Event Management (SIEM) systems have emerged as particularly effective within this landscape. These systems are designed to monitor network activity in real time, allowing them to detect patterns in various types of traffic — such as TCP SYN, ICMP, and DNS packets. Their strength lies in the ability to correlate diverse data sources, which enhances the early identification of anomalies and potential threats.
Through this monitoring process, SIEM systems have the ability to accurately identify and block any malicious traffic within a network. As a result, integrating SIEM systems into existing security infrastructure is crucial in strengthening defences against the growing threat posed by IoT botnets \cite{Obaidat2020}.
\begin{figure}
    \centering
    \includegraphics[width=1\linewidth]{Design sans titre (1).jpg}
    \caption{global architecture of the deployment}
    \label{fig:architecture}
\end{figure}
Network Intrusion Detection Systems (NIDS) are essential for securing Internet of Things (IoT) environments, as they monitor network traffic and help detect malicious activities that may indicate an ongoing or potential attack capable of compromising system integrity. Generally, NIDS can be classified into two main types: anomaly-based systems, which establish a model of normal network behavior and flag deviations as possible threats; and signature-based systems, which detect attacks based on known patterns or signatures. \cite{Erlacher2018}.
However, Network Intrusion Detection Systems (NIDS) are inherently passive and face limitations in high-speed network environments. Factors such as packet overload, computationally expensive signature matching, and high false alarm rates can significantly reduce their operational efficiency. \cite{Meng2014}.
Monitoring of network traffic data can be done in packet-based or flow-based mode. Packet-based data offers more fine-grained details on per-packet basis, e.g., their payload, whereas flow-based data is higher level and usually consists of metadata about network connections. This makes a difference in the planning and creation of NIDS for IoT settings \cite{Ring2019}.

The following discourse explores the new developments in the field of machine learning, more precisely deep learning, that have taken the Network Intrusion Detection Systems (NIDS) to a whole new level. The following study explores the utilization of Graphical Neural Networks (GNNs), a novel family of deep learning models designed for data represented in graphical format. Graphs can be used to denote complexities, with non-linear nodes possessing varying degrees of connectivity. Such irregularities present computational complexities, especially in operations such as convolutions, which are comparatively simpler in the image domain but more complicated in the graph case. To address this issue, Graph Neural Networks (GNNs) leverage relational inductive biases in their deep learning architectures so that there is effective learning, inference, and generalization from complex graph data structures. For humans, for instance, GNNs can utilize the concept of message propagation to encode interactions and interdependencies among nodes, leading to more precise models for applications such as traffic forecasting and anomaly detection \cite{Wu2021}.

In modern environments, network threat detection systems are becoming more reliant on flow-based analysis methods, especially with the use of NetFlow data, to identify malicious activity in network traffic. This approach involves ordering network flows by connection endpoints like IP address, Layer 4 port numbers, and protocol, with significant advantages over earlier packet-level observation methods. This enhancement in efficiency of processing using flow analysis has reinforced intrusion detection as well as IoT security capabilities.

In effect, the significance of employing GRAPHs in IoT cybersecurity is critical as they facilitate the identification and blocking of cyberattacks through the provision of a comprehensive model that represents network relationships and interactions. Integration of GNN nodes and GAT features in this scenario can provide new perspectives aimed at improving IoT security \cite{Mandapuram2017,Obaidat2020}. The rest of the paper is structured as follows: the literature available in this field will be discussed in the next section, followed by a detailed explanation of the materials and methods used by current researchers. The suggested methodology will be discussed in the fourth section, while the fifth section will report the results of the experiments and the methodology evaluation. The sixth section will incorporate discussion of proposed methodology and results, whereas the seventh and final section will provide an overview of the general conclusions.
\section{RELATED WORK}
IoT botnets have emerged in recent years as a significant threat to the Internet ecosystem. Malware families such as Mirai and Bashlite have been at the forefront of carrying out massive DDoS attacks, as noted in previous studies \cite{Ceron2019}\cite{Kambourakis2017}. Current research has been directed primarily towards analyzing and classifying these IoT groups of malware with a view to enhancing the effectiveness of detection and prevention strategies. Research has demonstrate that most IoT malware families lack advanced obfuscation methods, making them vulnerable to classification and tracking using methods such as binary code similarity and string-based analysis \cite{Cozzi2020}\cite{Torabi2021}. Following these observations, researchers have started investigating the application of machine learning and deep learning methods in the detection of IoT malware. We note that an effective lightweight convolutional neural network was put into practice, making use of greyscale images created from binary files to achieve remarkable 94.0\% accuracy in identifying benign software vs. DDoS-based malware \cite{Su2018}. In their landmark paper, Lo et al. (2021)  \cite{Lo2021} proposed E-GraphSAGE, a state-of-the-art graph neural network specially crafted for intrusion detection systems (IDS) applications in IoT network scenarios.
Graph neural networks are essential for accurately capturing the complex structural relationships between devices within a network, enabling the development of more powerful and precise detection models. Specifically, the application of E-GraphSAGE significantly enhances the identification of abnormal behaviors and potential security vulnerabilities, thereby strengthening the overall security framework of IoT systems. To validate the effectiveness and scalability of their approach, the authors conducted an extensive series of experiments using real-world data.\cite{Lo2021}. 

Sarhan et al. (2021) employed a standardized feature set in datasets for network intrusion detection. Consistency and standardization directly impact the comparability and reproducibility of IDS research. The proposed feature set aims to cover a wide range of attack scenarios and typical traffic patterns, providing a solid foundation for future IDS studies. \cite{Sarhan2021}.

In contemporary network threat detection mechanisms, there is a growing reliance on flow-based analysis, particularly using NetFlow data, to identify malicious activities within network traffic. This approach involves categorizing network flows based on connection endpoints such as IP addresses, Layer 4 ports, and protocols. This method offers significant advantages over traditional packet-level inspection techniques and has proven to enhance intrusion detection capabilities, thereby strengthening IoT security defences.

Recently, Ring et al. (2019) conducted a comprehensive analysis of network-based intrusion detection datasets, thoroughly evaluating various datasets, identifying their strengths and weaknesses, and providing valuable insights into their relevance and utility to advance IDS research. The authors stressed the critical importance of using high-quality realistic datasets for training and testing IDS models effectively, while also proposing strategies for future improvements and refinements \cite{Ring2019}.
The Bot-IoT dataset is a carefully constructed real-world network traffic dataset centered on botnet activity, with its primary objective being forensic analysis in IoT networks, this work was realized by Koroniotis et al. (2019). The process used to develop the Bot-IoT dataset is thoroughly documented, employing several advanced simulation techniques to replicate a wide range of IoT characteristics and botnet attacks. This dataset serves as a valuable resource for researchers focused on detecting and analyzing IoT-related intrusions \cite{Koroniotis2019}.
Atuhurra et al. (2024), in their noteworthy work, highlight a major limitation of the Bot-IoT dataset—its highly imbalanced class distribution. To address this issue, the authors proposed several solutions, including data augmentation and cost-sensitive learning techniques, to enhance the performance and robustness of IDS models trained on this dataset \cite{Atuhurra2024}. Similarly, Altaf et al. (2023) introduced a novel concatenated multigraph neural network for IoT intrusion detection, demonstrating a significant improvement in the overall security of IoT systems. In another study \cite{Altaf2023}, Malik et al. (2022) presented a deep belief network-based IDS tailored for IoT traffic, showcasing its ability to detect and mitigate various types of attacks. Additionally, Dahou et al. (2022) proposed an IDS leveraging deep learning in combination with a modified reptilian search algorithm.\cite{ Malik2022, Dahou2022}.
In conclusion, several studies have addressed the challenge of unbalanced datasets and proposed effective solutions to overcome this limitation. The work of Atuhurra et al. (2024) stands out for its objectivity, while various IDS architectures have also been explored, such as the one proposed by Sarhan et al. (2021) \cite{Atuhurra2024, Sarhan2021}.
Lo et al. (2021) integrated graph-based approaches to develop more powerful IDS models. Graphs offer a unique advantage in IoT cybersecurity by enabling detailed analysis of the relationships and interactions within a network, which is central to detecting and preventing cyberattacks. The integration of Graph Neural Network (GNN) nodes and Graph Attention Network (GAT) features plays a key role in securing IoT devices and protecting critical infrastructure from emerging threats\cite{Lo2021}.
The study also highlights both the limitations and opportunities for further research in this area, providing a thorough description of the methods, hardware, and tools used to ensure reproducibility and to support future investigations. The aim of this work is to provide detailed insights into the research process and to promote transparency, ultimately advancing knowledge in the field of IoT security.

\section{Materials and methods}
\subsection{Graph Neural Networks (GNN)}
Graph Neural Networks (GNNs) have become increasingly popular models for processing graph-structured data. A graph is made of a set of nodes (i.e., the active nodes) and the messages passing among them, which represent the relational structure and the semantic information associated with the elements. Many existing works have shown that GNNs outperform conventional baselines in many deep learning applications because of the message-passing mechanisms, which capture the complex dependencies in graphs. Over time, new advancements in GNN architectures,  have resulted in excellent performance in a variety of applications. Graph networks are also successful in simulating physical systems, learning molecular fingerprints, predicting protein-protein interactions, and classifying diseases.
In addition, they are fundamental in the context of reasoning over graphs constructed from unstructured data sources like text and images. Their generality enables their use in various domains such as social networks, natural sciences, and knowledge graph modeling. Since GNNs are proficient at extracting useful information from intricate structures of graphs, they have been proved to be highly effective for tasks that entail relational reasoning and representation learning \cite{Zhou2018}. Literature highlights the state-of-the-art performance of Graph Neural Networks (GNNs) in a wide range of applications, from but not limited to computer vision, natural language processing, to fields such as biology and chemistry \cite{Pradhyumna2021, Vatter2024}. However, deploying GNNs poses unique structural and implementation issues. For example, modern runtimes, i.e., machine learning accelerators, do not have the framework to fully support GNNs because of their extremely irregular data access patterns \cite{Auten2020}.
To deal with complexities emerged owing to disparate needs of deep neural networks (DNNs) and graph-based computations, new architectures such as ReGraphX have been introduced \cite{Arka2021}. Specially, heterogeneous ReRAM crossbar arrays are utilized in such architectures to meet the diversified needs of such complicated systems.
Furthermore, the inductive model introduced by GraphSAGE in Hamilton's 2017 paper introduces a novel approach to generating node embeddings in big graphs. Unlike traditional approaches that rely on having all nodes available at training time, GraphSAGE can efficiently compute embeddings for previously unseen nodes \cite{Hamilton2017}. The key innovation is the technique for learning a function to produce embeddings by sampling and aggregation of features from the local neighborhood of a node. This novel technique allows the algorithm to extend its applicability to unseen nodes and graphs, a capability lacking in other algorithms that generate separate embeddings for each node, thereby restricting their applicability in dynamic or evolving graph settings.
GraphSAGE's ability to utilize node feature information, such as text attributes, alongside graph structure, makes it particularly effective for tasks like node classification in evolving information graphs. Its superior performance on in benchmarks that involve citation networks, Reddit post data, and protein-protein interaction datasets underscores its strength in producing informative embeddings by incorporating both structural and attribute information, in line with the broader trend in graph representation learning exemplified by works like HetGNN \cite{Zhang2019}.
\subsection{Graph Attention Networks (GATs)}
No one can deny the strength of Graph Neural Networks (GNNs); however, their capabilities are significantly enhanced with the integration of Graph Attention Networks (GATs). GATs bring increased effectiveness in learning meaningful representations from graph-structured data through the use of a self-attention mechanism. This approach enables the model to learn attention weights for each edge in the spatial domain, allowing it to prioritize the most relevant neighboring nodes during the information aggregation process.\cite{Chang2021}. This unique approach has resulted in superior performance on various tasks compared to other GNN models \cite{He2023}.
In conclusion, general analytics tools have demonstrated their efficacy in diverse applications, including node classification, link prediction, and graph classification \cite{Chang2021, Huang2019, Gao2021}. These tools have been successfully deployed in a variety of fields such as social networks, biological networks, and autonomous driving \cite{Peng2022}. However, ongoing research is focused on optimizing and extending GAT architectures to overcome their limitations and enhance their performance across different data types and graph-related tasks.
\begin{equation}
h_i^{(l+1)} = \sigma \left( \sum_{j \in \mathcal{N}_i} \alpha_{ij}^{(l)} W^{(l)} h_j^{(l)} \right)
\label{eq:gat}
\end{equation}
\section*{Graph Attention Network (GAT) Algorithm}

\begin{algorithm}
\caption{Graph Attention Network (GAT)}
\begin{algorithmic}[1]
\Require Graph $G = (V, E)$, Node Features $H \in \mathbb{R}^{|V| \times d}$, 
Number of Attention Heads $H$, Weight Matrices $W^{(l)}$, Attention Parameters $a$, 
Activation Function $\sigma$, Dropout Rate $p$
\Ensure Updated Node Embeddings $H'$

\For{each layer $l = 1$ to $L$}
    \For{each node $v \in V$}
        \State Apply linear transformation:
        \[
        h_v' \gets W^{(l)} h_v
        \]
    \EndFor

    \For{each edge $(u, v) \in E$}
        \State Compute attention scores:
        \[
        e_{uv} \gets a^T \text{concat}(h_u', h_v')
        \]
    \EndFor

    \For{each node $v \in V$}
        \State Normalize attention scores:
        \[
        \alpha_{uv} \gets \frac{\exp(e_{uv})}{\sum_{k \in \mathcal{N}(v)} \exp(e_{uk})}
        \]
    \EndFor

    \For{each node $v \in V$}
        \State Compute the new node embeddings:
        \[
        h_v^{(l+1)} \gets \sigma \left( \sum_{u \in \mathcal{N}(v)} \alpha_{uv} W^{(l)} h_u^{(l)} \right)
        \]
    \EndFor

    \If{multi-head attention is used}
        \For{each node $v \in V$}
            \State Combine attention heads:
            \[
            h_v^{(l+1)} \gets \Vert_{k=1}^{H} \sigma \left( \sum_{u \in \mathcal{N}(v)} \alpha_{uv}^{(k)} W^{(k)} h_u^{(l)} \right)
            \]
        \EndFor
    \EndIf

    \For{each node $v \in V$}
        \State Apply activation and dropout:
        \[
        h_v^{(l+1)} \gets \sigma(h_v^{(l+1)})
        \]
        \State Apply dropout with probability $p$
    \EndFor
\EndFor

\State \Return $H' \gets \{ h_v^{(L)} | v \in V \}$
\label{algorithm_gat}
\end{algorithmic}
\end{algorithm}
The Graph Attention Network (GAT) is a neural network architecture designed for processing graph-structured data. Unlike graph convolutional networks (GCNs), which use a fixed aggregation function, GAT uses self-attention mechanisms to dynamically learn the importance of each neighbouring node. This allows the model to focus more on important connections.
\begin{enumerate}
\item  Inputs to the Algorithm\newline
The algorithm takes as input:
\begin{itemize}
    \item \textbf{Graph} \( G = (V, E) \): A set of nodes \( V \) and edges \( E \).
    \item \textbf{Node Features} \( H \in \mathbb{R}^{|V| \times d} \): Each node has a feature vector of dimension \( d \).
    \item \textbf{Number of Attention Heads} \( H \): GAT can use multiple attention heads to capture diverse relationships.
    \item \textbf{Weight Matrices} \( W^{(l)} \): A learnable transformation matrix at each layer \( l \).
    \item \textbf{Attention Parameters} \( a \): Parameters used in the attention mechanism.
    \item \textbf{Activation Function} \( \sigma \): A non-linear function (e.g., ReLU) applied after aggregation.
    \item \textbf{Dropout Rate} \( p \): A regularization technique to prevent overfitting.
\end{itemize}
\item Processing Steps\newline
\subsubsection{Step 1: Feature Transformation}
This step projects \ref{algorithm_gat} line 3 the node features into a new space where attention can be applied.
\subsubsection{Step 2: Compute Attention Scores for Each Edge}
For each edge \( (u,v) \in E \), line 6 in algorithm \ref{algorithm_gat} we compute an attention score that measures the importance of node \( u \) in the neighborhood of node \( v \).\newline
Here, the feature vectors of the nodes \( u \) you and \( v \) are concatenated, then a learnable parameter
\( a \) a is applied to calculate their importance.

\subsubsection{Step 3: Apply Softmax Normalization}
Line 9 in algorithm \ref{algorithm_gat} we Since there are multiple neighbours, the attention scores need to be normalized using a softmax function.
\subsubsection{Step 4: Aggregate Neighbor Information}
As shown in line 12 \ref{algorithm_gat}, each node\( v \) aggregates the transformed feature vectors of its neighbours using attention weights.
This ensures that the sum of all attention weights is equal to 1, making them interpretable as probability distributions.
\subsubsection{Step 5: Multi-Head Attention (Optional)}
Instead of using a single attention mechanism, multi-head attention can be applied. Several independent attention managers compute different attention scores and their outputs are concatenated, as shown in line 16. This allows different aspects of the relationships between nodes to be captured.
\subsubsection{Step 6: Apply Activation and Dropout}
Subsequent to aggregation, a non-linearity (e.g. ReLU) is applied, and then a loss is applied to prevent overlearning, line 20.

\end{enumerate}

\subsection{E-GraphSage}
It's clear that traditional Graph Neural Networks (GNNs), like GraphSAGE, have found success in various applications. However, these methods mainly focus on using node features for tasks like node classification, which means they often overlook the potential of edge features when it comes to classifying tiles. On the other hand, Lo et al. \cite{Lo2021} introduced an E-GraphSAGE algorithm that allows for the integration of edge information, such as flows, into the process. This improvement makes it possible to calculate the relevant edge plunges, which is crucial for classifying edges, especially when distinguishing between benign and attack network flows.
\begin{algorithm}
\caption{E-GraphSAGE Edge Embedding}
\begin{algorithmic}[1]
\State \textbf{Input:} Graph \( G(V, E) \)
\State \textbf{Input:} Edge features \( e_{uv}, \forall uv \in E \)
\State \textbf{Input:} Node features \( x_v = \{1, 1, \dots, 1\} \)
\State \textbf{Input:} Depth \( K \)
\State \textbf{Input:} Weight matrices \( W^k, \forall k \in \{1, \dots, K\} \)
\State \textbf{Input:} Non-linearity \( \sigma \)
\State \textbf{Input:} Differentiable aggregator functions \( AGG^k \)
\State \textbf{Output:} Edge embeddings \( z_{uv}, \forall uv \in E \)

\State Initialize node embeddings: \( h^0_v \gets x_v, \forall v \in V \)

\For{$k = 1$ to $K$} 
    \For{each node $v \in V$}
        \State Compute aggregated neighborhood embedding:
        \[
        h^k_{N(v)} \gets AGG^k\left(\{ e^{k-1}_{uv}, \forall u \in N(v), uv \in E \} \right)
        \]
        \State Update node embedding:
        \[
        h^k_v \gets W^k \cdot \operatorname{CONCAT}(h^{k-1}_v, h^k_{N(v)})
        \]
    \EndFor
\EndFor

\State Assign final node embeddings: \( z_v = h^K_v \)

\For{each edge $uv \in E$}
    \State Compute edge embedding:
    \[
    z^K_{uv} \gets \operatorname{CONCAT}(z^K_u, z^K_v)
    \]
\EndFor
\State \Return $ z$
\label{E-GraphSage-Algo}
\end{algorithmic}
\end{algorithm}

E-GraphSAGE is an extension to GraphSAGE that integrates edge functionalities to integrate and classify edges. Below is a step-by-step breakdown:
\begin{enumerate}
\item Initialization:\newline
The graph \( G(V,E) \)  is given as input.
The edge characteristics \( e_{uv} \) and the functionalities of node \( x_v \) (initialized as units) are provided.
Additional parameters such as the depth \( k \), weight matrices \( W^k \), nonlinearity \( \sigma \), and aggregation functions \( \mathrm{AGG}^k \) are defined.

\item Neighborhood Aggregation:\newline
The algorithm is characterised by its iteration over a specified number of layers, denoted by \( k \). For each node, \( v \), the aggregation of the edge features of its neighbourhood, \( N(v) \), is conducted using the aggregation function, \( AGG^k \). The node embedding is subject to an update through the application of a transformation matrix, \( W^k \), to the concatenation of the previous node's embedding and the aggregated neighbourhood information.
\item Final Node Embeddings:\newline
Following \( K \) iterations, the node embeddings  \( z_v \) are assigned.
\item Edge Embedding Computation:\newline
For each edge \( u_v \), the final edge coating \( z_{UV}^k\)is obtained by concatenating the plunges of its two nodes \( u \) and \( v \).
\end{enumerate}

\subsubsection{Edge Embedding}
It is evident that GraphSAGE was originally developed to exclusively consider node features, while disregarding those of the edges. In order to incorporate edge information, it is imperative to utilise a sampling and clustering approach to derive edge features from the graph. Furthermore, in contradistinction to the generation of node embeddings as employed in the original approach, the ultimate objective should be the production of edge embeddings.
A comparison of the original GraphSAGE algorithm \cite{Hamilton2017} with the modified version reveals three main differences. Firstly, the original GraphSAGE algorithm input has been altered, and secondly, the message passing/clustering functionality has been modified. Thirdly and finally, the output has also been changed.
The input now incorporates edge features:
\[
\{ e_{uv}, \forall \, uv \in E \}
\]
This is in contrast to GraphSAGE, which does not include these features. As flow-based NIDS datasets predominantly comprise flow (edge) features as opposed to node features, reliance is placed exclusively on edge features. The initialisation of node representations is achieved through the implementation of a specific methodology.
\[
x_v = \{1, \dots, 1\}
\]
Instead of applying the standard GraphSAGE node aggregation function \eqref{eq:aggregation}, our modified neighbourhood aggregation function computes aggregated embeddings of the sampled neighbourhood edges in the layer \cite{Hamilton2017}.
\begin{equation} \label{eq:aggregation}
h_v^{(k)} = \text{AGG}^{(k)} \left( \{ h_u^{(k-1)}, \forall u \in \mathcal{N}(v) \} \right)
\end{equation}
\subsubsection{Time and Space Complexity:}
As demonstrated in line 12 of Algorithm 20, the most computationally expensive element of the model is the looping process over K-hop neighborhood edges. The higher time complexity of E-GraphSAGE can be expressed as  \( O(eKnd^2) \), where \( n \) signifies the total number of nodes in the network, \( e \) denotes the number of neighbouring edges sampled for each node, \( K \) represents the number of layers, and  \( d \) indicates the dimension of hidden features of a node. The complexity of the E-GraphSAGE space is  \(  O(beKd + Kd^2)\), where \( b \) is the batch size \cite{Lo2021}. As E-GraphSAGE is designed to support a small batch setting, it samples a predetermined number of neighbouring edges with a view to enhancing the efficiency of the training process and reducing the amount of memory usage \cite{Lo2021}. In lieu of the utilisation of full neighbourhood sets as delineated in Algorithm 1, the space per batch and time complexity of E-GraphSAGE, which samples a fixed-size set of K-neighbouring edges uniformly at random, is \( O(E_i . i = 1 . K) \) \cite{Lo2021}

\subsection{Graph-Fusion Model}
GRAPH-FUSION is a deep learning-based method that combines two state-of-the-art graph technologies—E-GraphSAGE and Graph Attention Networks (GAT)—for node class prediction in graph-structured data. In this paper, we aim to propose a robust Intrusion Detection System (IDS) that can address IoT security issues. The architecture is meticulously designed and well-organized, which can provide strong results such as a high-performance network. The power of GRAPH-FUSION lies in its ability to model and distinguish complex relationships among nodes and edges by exploiting the structural and relational features of the graph.
The construction of the Graph Fusion model follows a series of key steps. The process begins with an E-GraphSAGE layer, which gathers information from neighboring nodes and edges to build initial node representations. This involves aggregating the messages exchanged between nodes to capture their structural relationships. Following this, a GAT (Graph Attention Network) layer refines these representations by applying attention mechanisms that assign varying weights to neighboring nodes based on their relative importance. Finally, the output from both layers is passed through a Multi-Layer Perceptron (MLP), which combines the learned features to generate a distinct representation for each node.

A visual representation of the proposed model architecture is provided in the accompanying figure \ref{fig:proposed_model}.
\begin{figure}
    \centering
    \includegraphics[width=1\linewidth]{Com.jpg}
    \caption{The architecture of the proposed model is based on GNN and GAT aims to calculate the messages.}
    \label{fig:proposed_model}
\end{figure}
\section{Graph Fusion NIDS}
The network graph is generated based on network flow data, which is then fed into the supervised training stage of the graph fusion model. In the final stage, edge embeddings are generated, which form the basis for classifying edges (network flows) into benign or offensive classes. The following subsections describe these three steps in detail.
\begin{enumerate}
\item  Network Graph Construction:\newline 
Network flows, such as NetFlow, are widely used to log network connections in production environments, and are also a popular format in network intrusion detection systems (NIDS). These flow captures typically contain information that identifies the source and destination of the connection, as well as additional information such as the number of packets, bytes, flow duration, and more. The structure of the graph naturally lends itself to modelling such data. When identifying flow endpoints and corresponding graph nodes, this study utilises four main flow fields: The source IP address and source port (L4) together with the destination IP address and destination port (L4). The first two fields together identify the source node, while the latter two define the destination node. Additional flow fields contribute edge attributes, which represent data exchanges between the source (e.g., 10.0.0.1:1024) and the destination (e.g., 203.0.113.5:443).
In order to generate the graph from the flow data, we remap the original source IP addresses to randomly assigned IPs in the range of 10.0.0.1 to 10.0.0.255. This approach mitigates a common problem in many NIDS datasets, where a limited set of IPs often appear as sources of attack traffic. In doing so, we ensure a more generalised and representative graph structure.
Thus, our graph is constructed by mapping the interactions between source and destination IP addresses, effectively capturing the network communication patterns for analysis. This approach helps address an issue common to many of the NIDS datasets used in this study, where only a limited set of IP addresses are frequently used as the source of attack traffic. By randomly assigning source IP addresses, we mitigate the risk of inadvertently using source IP addresses as labels for attack traffic, which could lead to model bias.
In the graph construction process, the remaining flow record fields (such as source port, destination port, and number of packets) are set as edge parameters. Since the graph nodes in this approach are featureless, The initialisation of each node is conducted by assigning a vector of ones, providing a uniform feature vector for all nodes. As shown in Algorithm 1, this method is implemented in our algorithm, with the dimensionality of the fixed-all vector in each node being determined by the number of edge features.
\item Graph Training:\newline 
The neural network model implemented in our study consists of three E-GraphSAGE layers (K = 3), signifying that neighbour information is aggregated from a three-hop neighbourhood. For the aggregation function AGG, as shown in line 12 algorithm \ref{E-GraphSage-Algo}, we use the mean
 function which simply finds the element-wise mean of the
 edge features in the sampled neighborhood. The definition of
 the mean aggregator function in E-GraphSAGE is provided in
 Equation \eqref{equationaggregate} below \cite{Lo2021}
 \begin{equation}
     h_k^{(N(v))} = \sum_{u \in N(v)} e_{k-1}^{uv}, \quad \forall uv \in E, \quad u \in N(v)
\label{equationaggregate}
 \end{equation} 
In the subsequent stage of the process, the graph is entered into the Graph Attention Network (GAT) layer, which employs graph-based learning through multiple attention mechanisms across vertices. In the context of the proposed model, the task of each vertex is to calculate attention scores for its neighbouring nodes based on their feature vectors \cite{Hu2021}.
The attention mechanism layer performs a linear transformation on the feature vectors of two neighbouring nodes. The resulting attention scores dynamically determine the relative importance of each neighbour.Feature Transformation: The fully connected (fc) layer projects the input node features into new feature representations, considering all attention vertices, and the output dimension is $out_feats * num_heads$, which corresponds to the updated node features \cite{He2023}.
In the final analysis, the output of E-GraphSage and GAT is combined with a MLP to investigate the process of concatenating x1 and x2 along dimension dim=1, termed the feature dimension. This process entails the combination of features from both inputs into a single tensor, thereby enhancing the input representation.Subsequently, the concatenated features undergo a linear transformation, which maps the input to a new feature space.This facilitates the learning of complex relationships by the model. Subsequently, a non-linear activation function, such as ReLU, is applied to introduce non-linearity, thereby facilitating the network's ability to learn more expressive representations.
Another linear transformation is then applied to refine the learned features, thus further processing the data and preparing it for the final output layer.
\item  Edge Classification:\newline
Once the model parameters have been optimised during training, the model is ready to be evaluated by classifying unseen test samples. Test flow records are initially processed into graphs and fed through trained graph fusion layers to generate combined edge embeddings from E-GraphSage and the GAT model. These embeddings are then passed through the final Softmax layer to obtain class probabilities, which are then compared to real class labels to calculate classification performance metrics.
\end{enumerate}
\section{Experimental results and dataset}
\subsection{Limitations of Existing Datasets}
Researchers have developed planned Network Intrusion Detection System (NIDS) benchmark datasets in response to the complexity of obtaining realistic network traffic with proper labeling. A network testbed has been specifically engineered to mimic the network behavior of multiple end nodes. The use of a simulated network environment has proven effective in addressing security and privacy concerns inherent in real-world networks. 
Furthermore, organizing real-world networks presents a significant challenge due to their inherently unpredictable behavior. But in laboratory settings, the labeling of network flows is more exact and dependable. In this work, different network attack scenarios were emulated and launched in a testbed environment. At the same time, packet capture (PCAP) files were generated, providing a precise readout of network activity for subsequent examination. The large amount of data makes highly advanced technical skills necessary for network feature extraction, especially in big data processing frameworks like Apache Spark and Hadoop. The goal of this process is to produce labeled tabular datasets that model benign and malicious network behaviors.
Such datasets are instrumental for training and evaluating deep learning-based Network Intrusion Detection Systems (NIDS). The datasets supporting the conclusions of this article are publicly available, thereby promoting reproducibility, enabling further investigation, and facilitating applications in the field.

These datasets contain high-fidelity network features, including flow-level information measured at up to per-millisecond intervals, along with ground truth labels for a variety of network attacks, which can be used to build security defenses. Their structure enhances the ability of deep neural networks (DNNs) to accurately differentiate between normal and attack traffic. Additionally, NIDS must be capable of handling the complexity involved in data processing and feature extraction.
The main objective of this work is to provide useful input for IoT network security research, addressing both scalability and the real-world deployment of intelligent intrusion detection techniques \cite{Sarhan2021}.

Choosing suitable data characteristics is one of the most important aspects in the design of deep learning-based NIDS. An ongoing issue in this area is the lack of a standardized feature set for NIDS dataset generation. As a result, feature selection is commonly performed subjectively by researchers, who make their own determinations regarding a feature's relevance and importance.
As a result, each dataset comprises a distinct set of features tailored to optimize performance during the classification phase. It is important to highlight that the feature sets currently in use vary significantly across studies, with limited overlap in the features selected. This inconsistency complicates benchmarking efforts and hinders the generalizability of models across different datasets \cite{Ring2019}.
Evaluating Deep Learning and Machine Learning Models on Multiple Datasets
The importance of exploiting the characteristics of distinct datasets has been proven. However, inconsistencies in the security information represented by these characteristics have raised concerns about the reliability of evaluation methods.
There are three main issues arising from the lack of a unified feature set that must be considered:
The complex extraction of multiple features from network traffic, some of which are irrelevant due to the rarity of security events;
The limited ability to evaluate the generalization of an automatic learning model to a targeted set of features on multiple datasets;
The lack of a unified dataset to include them.
\begin{itemize}
\item The Australian Center for Cyber Security (ACCS) created the BoT-IoT network environment in 2018.  Both regular and botnet traffic are included in the Cyber Range Lab.  In a research published in 2019 \cite{Koroniotis2019}, Koroniotis et al. described the architecture of this network environment.  The researchers used tools like Ostinato and Node-RED to simulate both IoT and non-IoT traffic.  The study's dataset had 3,668,522 flows in total, of which 477 (0.01\%) were characterized as benign flows and the rest 3,668,045 (99.99\%) as assault flows.
\item ToN-IoT is a newly released heterogeneous dataset in 2019 that encompasses telemetry data of Internet of Things (IoT) services, network traffic of IoT networks, and operating system logs. The focus of this research paper is on the network traffic portion of the dataset.
The dataset consists of a significant number of attack scenarios that were carried out in a simulation of a large-scale network at the Cyber Range Lab by the Advanced Cyber Security Center (ACCS). The Bro-IDS, now known as Zeek, was used to extract the original 44 features of the dataset.
\item NF-Ton-IoT and NF-BoT-IoT: The absence of a uniform structure and feature set among the various NIDS datasets has resulted in significant challenges in achieving the performance levels exhibited by machine learning-based network traffic classifiers across different datasets. Moreover, an evaluation of their capacity to generalize to different network scenarios is necessary. Sarhan et al \cite{Sarhan2021} intervention has addressed the issue at hand by providing the NetFlow version of the three aforementioned NIDS datasets. The authors used publicly available packet capture files of the original NIDS datasets were used and subsequently transformed into NetFlow format through the nprobe tool \cite{Sarhan2021}. A total of 12 fields were selected for extraction.
This process has resulted in two new variants of the original datasets, NF-ToN-IoT and NF-BoT-IoT.The NF-ToN-IoT variant has a total of 1,379,274 network flows, of which 1,108,995 (80.4\%) are classified as attack flows and 270,279 (19.6\%) as benign flows. The NF-BoT-IoT dataset contains a total of 600,100 flows, of which 586,241 (97.69\%) are classified as attack flows and 13,859 (2.31\%) as benign.
\end{itemize}

\subsection{ EXPERIMENTAL RESULTS}
\subsubsection{Performance of Binary Classification}
Evaluating the classification performance in different IoT datasets, including BoT-IoT, NF-BoT-IoT, ToN-IoT, and NF-ToN-IoT, reveals important information on the behavior and performance of the models used.
In order to evaluate the performance of the proposed neural network model, the standard metrics documented in Table I are used.
The notation TP, TN, FP, and FN represent true positive, true negative, false positive, and false negative cases, respectively.

\begin{table}[h!]
\centering
\caption{Evaluation metrics utilised in this study}
\label{tab:evaluation_metrics}
\begin{tabular}{|l|c|}
\hline
\textbf{Metric}            & \textbf{Definition}                                              \\ \hline
Detection Rate (Recall)    & $\frac{TP}{TP + FN}$                                            \\ \hline
Precision                  & $\frac{TP}{TP + FP}$                                            \\ \hline
F1-Score                   & $2 \times \frac{\text{Recall} \times \text{Precision}}{\text{Recall} + \text{Precision}}$ \\ \hline
Accuracy                   & $\frac{TP + TN}{TP + FP + TN + FN}$                             \\ \hline
False Alarm Rate (FAR)     & $\frac{FP}{FP + TN}$                                            \\ \hline
\end{tabular}
\end{table}

Initially, the results of the binary classification problem are presented, the objective of which is to distinguish between attack and benign traffic. Thereafter, the results of the multiclass classification experiments are presented, the objective of which was to identify the specific attack type of each flow.

\subsubsection{Binary Classification Results}\label{subsubsec1}
Initially, the results of the binary classification problem are presented, the objective of which is to distinguish between attack and benign traffic. Thereafter, the results of the multi-class classification experiments are presented, the objective of which was to identify the specific attack type of each flow.
For binary classification tasks, the models showed high performance in most datasets. In particular, the BoT-IoT dataset achieved perfect precision 100\%, reflecting the model's ability to distinguish between attack and benign traffic flawlessly. Similarly, NF-ToN-IoT showed remarkable precision of 99. 85\% and Ton-IoT showed 98.21\%, while the NF-BoT-IoT data set lagged behind in accuracy of 94\%. This discrepancy can be attributed to the increased complexity and diversity of traffic in the NF-BoT-IoT data set.
\begin{table}[h]
\centering
\caption{Graph Fusion binary classification results}
\label{tab:binary_results}
\begin{tabular}{|c|c|c|c|c|}
\hline
\textbf{Dataset}    & \textbf{Accuracy} & \textbf{Precision} & \textbf{F1-Score} & \textbf{Recall (DR)} \\ \hline
BoT-IoT             & 1.00& 1.00               & 1.00              & 1.00\\ \hline
NF-BoT-IoT          & 94.00& 1.00               & 0.97              & 94.00\\ \hline
ToN-IoT            & 98.21& 98.68& 98.35& 98.30\\ \hline
NF-ToN-IoT          & 99.85& 99.85& 99.85& 99.85\\ \hline
\end{tabular}
\end{table}
In order to provide a more illustrative representation of the results, a graphical representation is provided in \ref{fig:comparaison_binary_models}, which visualises the Graph Fusion results.
\begin{figure}[h]
    \centering
    \begin{tikzpicture}
        \begin{axis}[
            ybar,
            bar width=10pt,
            symbolic x coords={Accuracy, Precision, Recall, F1-Score},
            xtick=data,
            ymin=0, ymax=1.2,
            ylabel={Metric values},
            xlabel={},
            legend style={at={(0.5,-0.2)}, anchor=north, legend columns=2},
            nodes near coords,
            enlarge x limits=0.2,
            title={Comparison of binary model metrics by dataset}
        ]

        % BoT-IoT
        \addplot coordinates {(Accuracy,1.00) (Precision,1.00) (Recall,1.00) (F1-Score,1.00)};
        % NF-BoT-IoT
        \addplot coordinates {(Accuracy,0.94) (Precision,1.00) (Recall,0.94) (F1-Score,0.96)};
        % NF-ToN-IoT
        \addplot coordinates {(Accuracy,0.9985) (Precision,0.9985) (Recall,0.9985) (F1-Score,0.9985)};
        % ToN-IoT
        \addplot coordinates {(Accuracy,0.9821) (Precision,0.9868) (Recall,0.9821) (F1-Score,0.9835)};
        \legend{BoT-IoT, NF-BoT-IoT, NF-ToN-IoT, ToN-IoT}
        \end{axis}
    \end{tikzpicture}
    \caption{Comparison of metrics between binary models for each dataset}
    \label{fig:comparaison_binary_models}
\end{figure}

\subsubsection{Performance of Multiclass Classification}
In the field of Internet of Things (IoT) security, detection of bots is a critical priority due to the increase in cyber-attacks via these devices. In order to evaluate the effectiveness of detection methods, additional games are used. Both Bot-IoT and NF-Bot-IoT are characterised by important references for research and development.
\begin{itemize}
    \item Bot-IoT \ref{tab:BoT-IoT_results}: This dataset includes various classes of traffic networks, and includes data streams and malware such as DDoS, DoS, reconnaissance, and folder attacks. It is designed to simulate real IoT botnet scenarios, and also provides a realistic testing environment for detection algorithms.
    In the Bot-IoT dataset, performances are excellent for all categories such as DR and F1-Scores are of high quality, especially for DDoS, DoS and Reconnaissance categories.
    \item NF-Bot-IoT \ref{tab:NF-BoT-IoT_results}: This dataSet is a derivative of Bot-IoT, with natural features and streaming network filters to represent more complex and diverse network environments. The strength of detection methods should be tested by variations as well as traffic patterns.
    In the NF-BoT-IoT dataSet, the scores are more variable and higher. There are certain categories such as Reconnaissance (DR 84.50, F1-Score 0.92), as well as others such as Bénin, DDoS, and Volume that show results as well as failures.
\end{itemize}
The table \ref{tab:Bot-IoT-families} provides a comparative table for our results:
For Bot-IoT, the maximum accuracy (DR) reaches 99.99\% with an F1 score of 1.00, indicating the algorithm's excellent ability to detect different attack classes.
For NF-BoT-IoT, the maximum accuracy (DR) is 78.16\% with an F1 score of 0.81, indicating average global performance and less effective detection compared to Bot-IoT.
\begin{table}[h]
\centering
\caption{Results of multiclass classification by Graph Fusion on BoT-IoT dataset}
\label{tab:BoT-IoT_results}
\begin{tabular}{|c|c|c|c|c|}
\hline
\textbf{Class}   & \textbf{Precision} & \textbf{Recall} & \textbf{F1-Score} & \textbf{Support} \\ \hline
DDoS              & 99.99& 1.00& 99.99& 360 000          \\ \hline
DoS               & 99.99& 99.99& 99.99& 360 000          \\ \hline
Normal            & 95.92& 82.17& 88.51& 286              \\ \hline
Reconnaissance    & 99.88& 99.97& 99.92& 54 650           \\ \hline
Theft             & 0.0000             & 0.0000          & 0.0000            & 48\\ \hline
\textbf{Accuracy} & \multicolumn{3}{c|}{0.9998}                        & 774 984          \\ \hline
\textbf{Macro avg}& 79.16& 76.42& 77.68& 774 984          \\ \hline
\textbf{Weighted avg}& 99.97& 99.98& 99.98& 774 984          \\ \hline
\end{tabular}
\end{table}
\begin{table}[h]
\centering
\caption{Results of multiclass classification by Graph Fusion on NF-BoT-IoT dataset}
\label{tab:NF-BoT-IoT_results}
\begin{tabular}{|c|c|c|c|c|}
\hline
\textbf{Class}   & \textbf{Precision} & \textbf{Recall} & \textbf{F1-Score} & \textbf{Support} \\ \hline
Benign            & 0.99               & 0.46            & 0.63              & 8 316            \\ \hline
DDoS              & 0.49               & 0.16            & 0.24              & 34 106           \\ \hline
DoS               & 0.49               & 0.23            & 0.31              & 34 100           \\ \hline
Reconnaissance    & 0.86               & 1.00            & 0.92              & 282 392          \\ \hline
Theft             & 0.98               & 0.11            & 0.19              & 1 146            \\ \hline
\textbf{Accuracy} & \multicolumn{3}{c|}{0.83}                           & 360 060          \\ \hline
\textbf{Macro avg}& 0.76       & 0.39            & 0.46              & 360 060          \\ \hline
\textbf{Weighted  avg}& 0.79    & 0.83            & 0.79              & 360 060          \\ \hline
\end{tabular}
\end{table}
\begin{table}[h]
\centering
\caption{Results of multiclass classification by Graph Fusion on BoT-IoT dataset families}
\label{tab:Bot-IoT-families}
\begin{tabular}{|l|c|c|c|c|}\hline
 & \multicolumn{2}{|c|}{\textbf{BoT-IoT}}& \multicolumn{2}{|c|}{\textbf{NF-BoT-IoT}}\\\hline
\hline
\textbf{Class Name} & \textbf{ DR}& \textbf{F1-Score}& \textbf{DR}& \textbf{F1-Score}\\ \hline
Benign         & 1.00& 1.00 & 99.45& 0.42 \\ \hline
DDoS           & 99.99& 1.00 & 40.82& 0.39 \\ \hline
DoS            & 99.99& 1.00 & 57.13& 0.47 \\ \hline
Reconnaissance & 99.98& 1.00 & 84.50& 0.92 \\ \hline
Theft          & 93.75& 0.97 & 99.83& 0.39 \\ \hline
\textbf{Weighted avg}& \textbf{99.99\%} & \textbf{1.00} & \textbf{78.16}& \textbf{0.81} \\ \hline
\end{tabular}
\end{table}
Multi-class classification tasks presented more accurate challenges. The ToN-IoT dataset showed 89.41\% accuracy, significantly outperforming the NF-ToN-IoT dataset, which scored 68.81\%. This gap highlights the model's difficulty in distinguishing between attack categories when exposed to more diverse and realistic traffic patterns.
It is evident that categories such as DDoS and scanning attained high levels of accuracy in the ToN-IoT dataset and exhibited optimal performance in the NF-ToN-IoT dataset. For instance, the DDoS precision rate was recorded at 99.40\%, a figure that signifies a commendable outcome in the classification of DDoS attacks.
\begin{table}[h]
\centering
\caption{Results of multiclass classification by Graph Fusion on ToN-IoT dataset}
\label{tab:Ton-Iot-results}
\begin{tabular}{|c|c|c|c|c|}
\hline
\textbf{Class}   & \textbf{Precision} & \textbf{Recall} & \textbf{F1-Score} & \textbf{Support} \\ \hline
Backdoor          & 0.5798& 0.9994          & 0.7338            & 30 568          \\ \hline
DDoS              & 0.9954             & 0.9490          & 0.9716            & 368 628         \\ \hline
DoS               & 0.7947             & 0.9185          & 0.8521            & 203 002         \\ \hline
Injection         & 0.7712             & 0.7337          & 0.7520            & 27 130          \\ \hline
MitM              & 0.1189             & 0.8832          & 0.2095            & 702             \\ \hline
Normal            & 0.7831             & 0.9217          & 0.8468            & 47 852          \\ \hline
Password          & 0.9681             & 0.7331          & 0.8344            & 102 742         \\ \hline
Ransomware        & 0.9683             & 0.9728          & 0.9706            & 47 980          \\ \hline
Scanning          & 0.9459             & 0.8493          & 0.8950            & 429 392         \\ \hline
XSS               & 0.8151             & 0.9461          & 0.8757            & 126 660         \\ \hline
\textbf{Accuracy} & \multicolumn{3}{c|}{0.8941}                          & 1 384 656       \\ \hline
\textbf{macro avg} & 0.7741       & 0.8907          & 0.7942            & 1 384 656       \\ \hline
\textbf{Weighted avg} & 0.9098    & 0.8941          & 0.8971            & 1 384 656       \\ \hline
\end{tabular}
\end{table}
\begin{table}[h]
\centering
\caption{Results of multiclass classification by Graph Fusion on NF-ToN-IoT dataset}
\label{tab:NF-Ton-Iot-results}
\begin{tabular}{|c|c|c|c|c|}
\hline
\textbf{Classe} & \textbf{Precision} & \textbf{Recall} & \textbf{F1-Score} & \textbf{Support} \\ \hline
Normal          & 0.9979             & 0.9948         & 0.9964            & 216224          \\ \hline
Backdoor        & 0.9993             & 0.9841         & 0.9916            & 13798           \\ \hline
DDoS            & 0.9943             & 0.5600         & 0.7165            & 261076          \\ \hline
DoS             & 0.0000             & 0.0000         & 0.0000            & 14174           \\ \hline
Injection       & 0.5641             & 0.9517         & 0.7083            & 374832          \\ \hline
MitM            & 0.3798             & 0.3707         & 0.3752            & 1036            \\ \hline
Password        & 0.3452             & 0.1964         & 0.2504            & 125038          \\ \hline
Ransomware      & 0.1334             & 0.9737         & 0.2347            & 114             \\ \hline
Scanning        & 0.1201             & 0.1522         & 0.1342            & 17174           \\ \hline
XSS             & 0.0000             & 0.0000         & 0.0000            & 79954           \\ \hline
\textbf{Accuracy}    & \multicolumn{4}{c|}{68.81}                          \\ \hline
\textbf{Macro avg}   & 0.4534    & 0.5184    & 0.4407    & 1103420 \\ \hline
\textbf{Weighted avg}& 0.6763    & 0.6881    & 0.6486    & 1103420 \\ \hline
\end{tabular}
\end{table}

\begin{table}[h]
\centering
\caption{Results of multiclass classification by Graph Fusion on ToN-IoT dataset families }
\label{tab:ToN_Iot_families}
\begin{tabular}{|l|c|c|c|c|}\hline
 & \multicolumn{2}{|c|}{\textbf{ToN-IoT}}& \multicolumn{2}{|c|}{\textbf{NF-ToN-IoT}}\\\hline
\hline
\textbf{Class Name} & \textbf{ DR}& \textbf{F1-Score}& \textbf{ DR}& \textbf{ F1-Score}\\ \hline
Backdoor      & 99.94& 0.73 & 98.41& 0.99 \\ \hline
DDoS          & 94.90& 0.97 & 56.00& 0.71 \\ \hline
DoS           & 91.85& 0.85 & 00.00& 0.00 \\ \hline
Injection     & 73.37& 0.75 & 95.17& 0.70 \\ \hline
MITM          & 88.32& 0.20 & 37.07& 0.37 \\ \hline
Password      & 73.31& 0.83 & 19.64& 0.25 \\ \hline
Ransomware    & 97.28& 0.97 & 97.37& 0.23 \\ \hline
Scanning      & 84.93& 0.90 & 15.22& 0.13 \\ \hline
XSS           & 94.61& 0.88 & 00.00& 0.00 \\ \hline
\textbf{Weighted avg} & \textbf{89.07}& \textbf{0.89} & \textbf{68.81}& \textbf{0.65} \\ \hline
\end{tabular}
\end{table}
\section{Discussion}
The table \ref{tab:binary_results_comparaison} compares several robot and IoT detection methods using different dataset and evaluates their performance in terms of F1-Score and accuracy. Here's a summary of the results:
Graph Fusion: This method performs well in all dataset, with an F1-Score and an accuracy level (1.00) on Bot-IoT and NF-Ton-IoT. The results for NF-Bot-IoT and Ton-IoT are also high.
MLP \cite{Atuhurra2024}: In Bot-IoT, this method has an F1 score of 99.86\% and an accuracy of 99.99, which means the next place is Graph Fusion.
Multi Graph \cite{Altaf2023}: Bot-IoT performance (F1-Score of 99.96\%) and NF-Ton-IoT performance (F1-Score of 99.28), this method combines solid results.
E-GraphSage \cite{Lo2021}: This method displays exceptional results on NF-Ton-IoT, giving an equal F1-Score of 1.00 and an accuracy of 99.69\%.
DBN \cite{Malik2022}: A series of moderate performances on Ton-IoT with an F1-Score of 86.33\% and an accuracy of 84.00\%.
Machine Learning-Based \cite{Sarhan2021}: High scores on NF-Bot-IoT (F1-Score of 97.00\%) and Ton-IoT (F1-Score of 99.00\%).
DNN \cite{Altaf2023}: Shows good results on NF-Ton-IoT with an F1-Score of 99.00\% and an accuracy of 98.00\%.
In the CV, Graph Fusion emerges as the most effective and consistent method in passing various dataset, followed by MLP and Multi Graph. Other methods are presented in addition to the competitive results, but they vary with performance depending on the dataSet.
\begin{table}[h]
    \centering
    \caption{Binary classification performance}
    \begin{tabular}{l l l c}
        
        \textbf{Method} & \textbf{Dataset} & \textbf{F1} & \textbf{Accuracy} \\
         \toprule
     Graph Fusion   & Bot-IoT & 1.00 & 1.00\\ 
      MLP \cite{Atuhurra2024}  & Bot-IoT & 99.86 & 99.99 \\ 
    Multi Graph \cite{Altaf2023}  & Bot-IoT &  99.96 &  99.95 \\
     \toprule
     \midrule
       Graph Fusion  & NF-Bot-IoT & 97.00 & 94.00\\ 
       E-GraphSage \cite{Lo2021}   & NF-Bot-IoT & 97.00 & 93.57 \\ 
       ML-based \cite{Sarhan2021} &  NF-Bot-IoT &  97.00 &  93.82 \\
        \toprule
     \midrule
       Graph Fusion & Ton-IoT & 98.35 & 98.21\\ 
      DBN \cite{Malik2022} & Ton-IoT & 86.33 & 84.00\\ 
       ML-based \cite{Sarhan2021}& Ton-IoT & 99.00& 97.86\\
       
     \toprule
     \midrule
       Graph Fusion & NF-Ton-IoT & 99.85 & 99.85 \\ 
       Multi Graph \cite{Altaf2023} & NF-Ton-IoT & 99.28  & 99.28\\ 
       E-GraphSage \cite{Lo2021}   & NF-Ton-IoT & 1.00& 99.69  \\ 
       DNN \cite{Altaf2023}   & NF-Ton-IoT & 99.00 & 98.00  \\ 
    \end{tabular}
    \label{tab:binary_results_comparaison}
\end{table}

The performance comparison of different classification methods across multiple datasets is presented in \ref{tab:classification-Multiclass}. The results demonstrate that the proposed \textit{Graph Fusion} method consistently outperforms existing approaches in most scenarios.
For the \textbf{Bot-IoT} dataset, \textit{Graph Fusion} achieves the highest accuracy of 99.98\%, significantly outperforming the \textit{MVO} method \cite{Dahou2022}, which attains 99.03\%, and the \textit{bcGAN model} \cite{Ullah2021}, which only reaches 77.01\%. This suggests that the fusion-based approach is particularly effective in handling the complex patterns present in Bot-IoT traffic.

In the case of the \textbf{NF-Bot-IoT} dataset, \textit{Graph Fusion} again provides the best accuracy of 83.00\%, surpassing \textit{GraphSage} \cite{Lo2021}, which achieves 78.16\%. This further highlights the robustness of the proposed method in learning network flow representations.

For the \textbf{Ton-IoT} dataset, the \textit{Graph Fusion} model continues to excel, reaching an accuracy of 89.41\%, outperforming \textit{DBN} \cite{Malik2022} (86.33\%) and \textit{GraphSage} (78.16\%). The notable margin indicates that integrating graph-based learning significantly enhances classification performance.

In a similar fashion, the \textbf{NF-Ton-IoT} dataset showcases that \textit{Graph Fusion} achieves the highest accuracy rate of 68.81\%, showing a slight improvement over both \textit{DNN} \cite{Altaf2023} (68.39\%) and \textit{GraphSage} (67.16\%). It is noteworthy that the margin of performance difference among the various models on this dataset is comparatively narrow, suggesting a heightened degree of complexity in classification tasks.

Furthermore, the Recurrent Neural Network (RNN) method as cited by Shaker et al. \cite{Shaker2023}, when evaluated on the NF-Bot-IoT dataset, demonstrates a performance accuracy of 67.60\%. This result, although lower than that achieved by the Graph Fusion method, is still on par with other established deep learning models.
In summary, these findings support the notion that Graph Fusion presents a more effective classification strategy when compared to both traditional and deep learning-based methodologies. The enhanced accuracy observed underscores the benefits of incorporating graph-based techniques for feature extraction and classification tasks within IoT-centric cybersecurity datasets. Nonetheless, the suboptimal performance observed in NF-Ton-IoT dataset warrants further exploration into potential optimization strategies or hybrid approaches to bolster classification accuracy, particularly in more complex environments.
    
\begin{table}[h]
    \centering
    \caption{Graph-Fusion Multi-class classification performance}
    \label{tab:classification-Multiclass}
    \begin{tabular}{l l c}
        \toprule
        \textbf{Method} & \textbf{Dataset}  & \textbf{Accuracy} \\
         \toprule
     \midrule
     Graph Fusion   & Bot-IoT & 99.98 \\
    MVO \cite{Dahou2022}  & Bot-IoT & 99.03 \\
     bcGAN model \cite{Ullah2021}  & Bot-IoT & 77.01 \\
      \toprule
     \midrule
       Graph Fusion  & NF-Bot-IoT & 83.00\\ 
       GraphSage \cite{Lo2021} & NF-Bot-IoT & 78.16  \\ 
     \toprule
     \midrule 
       Graph Fusion & Ton-IoT & 89.41 \\ 
      DBN \cite{Malik2022} & Ton-IoT & 86.33   \\
      GraphSage \cite{Lo2021} & Ton-IoT & 78.16  \\  
     \toprule
     \midrule
       Graph Fusion & NF-Ton-IoT & 68.81 \\
       DNN \cite{Altaf2023} & NF-Ton-IoT & 68.39  \\ 
       GraphSage \cite{Lo2021} & NF-Ton-IoT & 67.16  \\  
       RNN \cite{Shaker2023}  & NF-Bot-IoT & 67.60 \\ 
    \end{tabular}
\end{table}

\section{Conclusion}
This article addresses a critical issue in the IoT context: security. We present an all-in-one pipeline that analyzes a selection of commonly used publicly available datasets, describes their key features, and details the required pre-processing stage for creating robust deep learning models.
Next, we propose a novel IDS solution to address the variability in the structural properties of IoT networks. Our architecture outperforms (detect better) binary related works.
Thus, our idea is to use innovative, cutting-edge approaches to progress in this field which are graph based deep learning that is a novel application of the cutting-edge technique GNN based on the combination of the output vectors from two collaborative models, GATs and GNN.
These vectors are concatenated and input to MLP for making the network traffic classify efficiently and accurately. This allows the network to rapidly identify and classify attack flows and defend against them timely.
We introduce GRAPH-FUSION, the first full deployment and evaluation of a graph fusion-based NIDS made specifically with IoT in mind and seeking to gather evidence with network flow data. 
We experiment the proposed model on four benchmark IoT NIDS datasets to evaluate its performance.
Observe that the results are consistent as Graph-Fusion NIDS clearly achieves the best performance. surpasses well known deep models such as LSTM, CNN and GNNs, demonstrating its efficiency for intrusion detection in IoT networks.
In the future, we will also investigate advanced sampling approaches to further improve the efficiency of the graph fusion model. 
In particular, we intend to study non-uniform and adaptive sampling methods,which may be able to capture the dynamics of real-life network traffic  more effectively. Furthermore, we plan to incorporate interpretable graph neural network algorithms like multi-head GAT (MGAT) to achieve more insights loss into the decision making process of the model, to further enhance there transparency and interpretability.

\bibliography{sn-bibliography}% common bib file
%% if required, the content of .bbl file can be included here once bbl is generated
%%\input sn-article.bbl

\end{document}
