GRID: Graph-Based Robust Intrusion Detection Solution for Industrial IoT Networks

Amid the accelerating pace of global digital transformation, the Industrial Internet of Things (IIoT) has progressively emerged as a vital force in promoting industrial upgrading and economic restructuring. The proliferation of IIoT devices has augmented the complexity of security management, making the deployment of intrusion traffic detection solutions imperative. Existing solutions for network traffic classification have certain limitations. This article presents GRID, a graph-based robust intrusion detection solution for IIoT, encompassing two main modules: 1) the hierarchical traffic graph constructor (HTGC) and 2) the cascaded graph attention network (CGATN). The HTGC exploits the inherent packet-flow-conversation hierarchy of traffic data to construct the graph structure and fuse packet-level and behavioral features. The CGATN addresses the issues faced by conventional multilayer graph neural networks (GNNs) and employs contrastive representation learning during training to enhance the robustness of the solution. GRID demonstrates significant advantages compared to state-of-the-art solutions. The experimental results in both closed-world and open-world scenarios reveal an average increase of 3.09% in classification accuracy, 0.23% in balanced accuracy, and 10.03% in Matthews correlation coefficient.