Poster: Enhancing GNN Robustness for Network Intrusion Detection via Agent-based Analysis

TL;DR

This paper introduces a novel method that uses Large Language Models as cybersecurity agents to analyze and improve the robustness of Graph Neural Networks in network intrusion detection, especially against adversarial attacks.

Contribution

It presents a new agent-based framework employing LLMs to enhance GNN robustness in NIDS, addressing limitations of synthetic evaluation methods and real-world attack scenarios.

Findings

LLM agents improve GNN resilience against adversarial attacks

Framework tested with realistic datasets from physical testbeds

Significant robustness gains demonstrated in experiments

Abstract

Graph Neural Networks (GNNs) show great promise for Network Intrusion Detection Systems (NIDS), particularly in IoT environments, but suffer performance degradation due to distribution drift and lack robustness against realistic adversarial attacks. Current robustness evaluations often rely on unrealistic synthetic perturbations and lack demonstrations on systematic analysis of different kinds of adversarial attack, which encompass both black-box and white-box scenarios. This work proposes a novel approach to enhance GNN robustness and generalization by employing Large Language Models (LLMs) in an agentic pipeline as simulated cybersecurity expert agents. These agents scrutinize graph structures derived from network flow data, identifying and potentially mitigating suspicious or adversarially perturbed elements before GNN processing. Our experiments, using a framework designed for realistic evaluation and testing with a variety of adversarial attacks including a dataset collected from physical testbed experiments, demonstrate that integrating LLM analysis can significantly improve the resilience of GNN-based NIDS against challenges, showcasing the potential of LLM agent as a complementary layer in intrusion detection architectures.