GraphFaaS: Serverless GNN Inference for Burst-Resilient, Real-Time Intrusion Detection

TL;DR

GraphFaaS introduces a serverless GNN inference system designed for real-time, burst-resilient intrusion detection, significantly reducing latency and improving stability in cybersecurity workflows.

Contribution

It presents a novel serverless architecture for GNN inference that dynamically scales to handle bursty workloads in intrusion detection tasks.

Findings

Reduces average detection latency by 85%.

Decreases coefficient of variation (CV) by 64%.

Ensures stable inference latency under fluctuating workloads.

Abstract

Provenance-based intrusion detection is an increasingly popular application of graphical machine learning in cybersecurity, where system activities are modeled as provenance graphs to capture causality and correlations among potentially malicious actions. Graph Neural Networks (GNNs) have demonstrated strong performance in this setting. However, traditional statically-provisioned GNN inference architectures fall short in meeting two crucial demands of intrusion detection: (1) maintaining consistently low detection latency, and (2) handling highly irregular and bursty workloads. To holistically address these challenges, we present GraphFaaS, a serverless architecture tailored for GNN-based intrusion detection. GraphFaaS leverages the elasticity and agility of serverless computing to dynamically scale the GNN inference pipeline. We parallelize and adapt GNN workflows to a serverless environment, ensuring that the system can respond in real time to fluctuating workloads. By decoupling compute resources from static provisioning, GraphFaaS delivers stable inference latency, which is critical for dependable intrusion detection and timely incident response in cybersecurity operations. Preliminary evaluation shows GraphFaaS reduces average detection latency by 85% and coefficient of variation (CV) by 64% compared to the baseline.