Enhanced Feature Extraction for IoT Network Intrusion Detection Using GNNs and KAN
2026-07-03 • Cryptography and Security
Cryptography and SecurityArtificial Intelligence
AI summaryⓘ
The authors created a new method called SKGFusionKAN to improve security in Internet of Things (IoT) networks, which are tricky because devices and traffic vary a lot. Their method enhances a type of graph neural network to better understand connections and features in these complex IoT setups by using an attention mechanism that focuses on important information at different scales. They also use a special classifier called Kolmogorov-Arnold Networks to better detect rare and complex cyber attacks. Tests on multiple datasets showed their approach works better than current methods for spotting intrusions in IoT systems.
Internet of Things (IoT)Graph Neural Networks (GNN)GraphSAGESelective Kernel AttentionEdge-oriented Message PassingGated FusionKolmogorov-Arnold Networks (KAN)Intrusion Detection Systems (IDS)Network SecurityAnomaly Detection
Authors
Long Zhao, Shixun Ji, Bin Cheng, Bin He
Abstract
Recent advancements in the Internet of Things (IoT) emphasize the urgent need for advanced network security, as IoT networks feature dynamic topologies, imbalanced traffic, and complex attack patterns. Unlike general IT networks, IoT environments exhibit extreme heterogeneity and sparse topologies. Traditional GNN-based intrusion detection methods often struggle to efficiently model node and edge features or capture fine-grained anomalies in such settings. To address this, we propose SKGFusionKAN, a novel IoT-tailored approach enhancing GraphSAGE with a multi-scale selective kernel attention mechanism. This enables adaptive extraction of node and edge features under diverse traffic conditions. Specifically, our edge-oriented message passing strengthens information propagation, while selective kernel attention adaptively weights edge-derived information from different scales to handle heterogeneity. We also introduce a gated fusion process to dynamically integrate multi-scale features, improving robustness against evolving attacks. Finally, we leverage Kolmogorov-Arnold Networks (KAN) for classification, offering superior nonlinear modeling capabilities essential for detecting intricate, low-frequency attacks. To our knowledge, this work presents a comprehensive integration of GNNs and KAN with dedicated architectural innovations for IoT intrusion detection. Extensive experiments on four NIDS benchmarks show that SKGFusionKAN consistently outperforms state-of-the-art approaches in binary and multiclass tasks, demonstrating its potential for IoT security.