Embedding residuals in graph-based solutions: the E-ResSAGE and E-ResGAT algorithms. A case study in intrusion detection.

Neural network architectures have been used to address multiple real-world problems with high success. Their extension to graph-structured data started recently to be explored. Graph-neural network (GNN) achieved state-of-the-art performance in multiple problems. In highly imbalanced application domains, such as network intrusion problems, GNN was used to model the network topology. However, in this scenario, the class imbalance problem still affects the performance. Another graph-based solution, the graph attention network (GAT) has also been applied to multiple predictive tasks. Although being a promising avenue, graph-based solutions are still under-explored in imbalanced scenarios. This paper proposes two novel graph-based algorithms, the E-ResSAGE and E-ResGAT algorithms, which build on top of the established GraphSAGE and GAT algorithms, respectively. The key idea is to integrate residual learning into the GNN leveraging the available graph information. Residual connections are added as a strategy to deal with the high class imbalance, aiming at retaining the original information and improving the minority classes' performance. A case study on intrusion detection is provided. Extensive experiments on four recent intrusion detection datasets show the excellent performance of our proposed approaches, especially when predicting minority classes. We demonstrate that embedding residuals in graph-based algorithms presents a strong advantage when learning under imbalanced domains. [ABSTRACT FROM AUTHOR]