Systematic Review of Graph Neural Network for Malicious Attack Detection

Analysis

Why This Paper Matters

As cyberattacks grow in frequency and sophistication, traditional machine learning approaches often struggle with the relational and structural nature of network data. This systematic review is timely because it consolidates the emerging body of work on graph neural networks (GNNs) for malicious attack detection, a domain that has not been systematically explored in depth. By analyzing 28 studies from 2020 to 2025, the paper provides a structured overview that helps practitioners and researchers understand where GNNs have been successfully applied—particularly in IoT, web services, phishing, and network traffic—and where critical gaps remain.

The review is especially relevant for AI practitioners deploying security solutions in complex environments. GNNs naturally model the graph-structured relationships in network traffic, user behavior, and system logs, making them a promising tool for detecting subtle, multi-step attacks that evade traditional methods. This paper serves as a roadmap for selecting appropriate GNN architectures and datasets, and it highlights the need for standardized benchmarks to accelerate progress.

Technical Contributions

• Systematic classification: Studies are categorized by attack domain (IoT, web, phishing, network traffic), GNN model architecture (e.g., GCN, GAT, GraphSAGE), and dataset type (e.g., CICIDS2017, Bot-IoT, custom datasets).
• Gap analysis: The review identifies key limitations, such as lack of real-world evaluation, imbalanced datasets, and limited explainability of GNN decisions.
• Future directions: It outlines promising research avenues, including adversarial robustness, temporal GNNs for streaming data, and integration with federated learning for privacy-preserving detection.
• Structured comparison: A comparative table of methodologies is provided, enabling quick assessment of which GNN variants are most effective for specific attack types.

Results

The review does not report quantitative performance metrics (e.g., accuracy, F1-score) from individual studies, as it is a qualitative synthesis. Instead, it finds that GNNs have been applied predominantly to IoT attack detection, with Graph Convolutional Networks (GCNs) being the most common architecture. The paper notes that many studies rely on simulated or outdated datasets, and there is a lack of cross-domain evaluation. The authors emphasize that no single GNN model dominates across all attack types, and performance varies significantly with dataset characteristics.

Significance

This review provides a foundational reference for AI researchers and cybersecurity engineers looking to leverage GNNs for threat detection. By systematically mapping the current landscape, it helps avoid redundant efforts and directs attention to underexplored areas such as adversarial robustness and real-time detection. The paper also underscores the importance of developing standardized, publicly available benchmarks to enable fair comparison and accelerate deployment of GNN-based security systems in production environments.