Adversarial Techniques for Bypassing Graph Neural Networks Based Network Defense

Adversarial Techniques for Bypassing Graph Neural Networks Based Network Defense

Speakers: Kartikeya Sharma, Senior Associate Information Security Engineer @ Equinix

Conference: SAINTCON

YouTube: https://www.youtube.com/watch?v=BnTDWJxOwuQ

Overview

In the realm of modern cybersecurity, Graph Neural Networks (GNNs) have emerged as a promising technology for detecting sophisticated network intrusions, particularly Distributed Denial of Service (DDoS) attacks. These advanced deep learning models, capable of analyzing complex relational patterns within network traffic, have shown remarkable accuracy, with some state-of-the-art implementations claiming up to 99% detection rates on open-source datasets. However, this talk by Kartikeya Sharma, a Senior Associate Information Security Engineer at Equinix, in collaboration with Dr. Jun Lee from the University of Oregon, unveils a critical vulnerability in these seemingly robust defenses.

Sharma's research demonstrates that GNN-based DDoS defenses are "fundamentally broken" when confronted with strategically designed adversarial attacks. The presentation introduces three novel attack techniques capable of manipulating the underlying graph structure that GNNs rely upon, drastically reducing their F1 score (a measure of accuracy considering both precision and recall) to as low as 1% in some scenarios. This research carries immediate and significant implications for the industry, as GNNs are already being deployed by major security vendors for various detection tasks, highlighting an urgent need for re-evaluation and more resilient defense strategies.

Background

▶ Watch: GNN-based DoS defenses are fundamentally broken (1:40)

The increasing complexity and distributed nature of modern cyberattacks, especially DDoS, have pushed traditional machine learning (ML) methods to their limits. Conventional ML models often treat individual network flows independently, failing to capture the coordinated and distributed patterns characteristic of advanced attacks. They also typically ignore the crucial topological information of a network, leading to lower detection rates. This is where Graph Neural Networks (GNNs) offer a significant advantage.

GNNs are a class of deep learning models specifically designed to operate on graph-structured data. A graph consists of nodes (e.g., IP addresses, users, network flows) and edges (relationships between nodes, e.g., a connection between two IPs, a flow from source to destination). Each node and edge can possess features or attributes (e.g., packet duration, total bytes, flags). GNNs excel at capturing relational patterns, learning from the network structure as a whole, and are particularly powerful for analyzing connected data.

At their core, GNNs work by generating new embeddings (vector representations) for nodes based on their neighbors. This process, known as the message passing framework, involves three main steps:

1. Aggregate: Each node collects messages (features) from its neighbors.
2. Update: The node aggregates these messages, often using a neural network layer or simple concatenation, to create a new feature vector.
3. Repeat: This aggregation and update process is repeated multiple times (a hyperparameter to be tuned), allowing nodes to incorporate information from increasingly distant neighbors.

Finally, these learned node representations are passed through a fully connected layer (or dense layer) and an activation function for tasks like flow classification – determining if a flow is malicious or benign.

GNNs are already being leveraged across the industry for security applications: Palo Alto Networks uses them for malicious domain discovery, Darktrace for incident prioritization, Verra AI for anomaly detection, and Microsoft for traffic monitoring. Their application in DDoS detection is particularly appealing due to their ability to capture coordinated and distributed attack patterns that traditional ML misses, leveraging the entire network context to achieve high accuracy.

To apply GNNs to network traffic, raw network flows must be transformed into graphs. Network flows are aggregations of packets, typically defined by a five-tuple: source IP, destination IP, source port, destination port, and protocol. Each flow has various features like packet count, byte totals, and duration. Two common graph structures for network intrusion detection are:

1. Host-Flow Graph: Contains two types of nodes: host nodes (IPs) and flow nodes. An edge connects a flow node to its corresponding source and destination host nodes.
2. Flow Graph: Contains only host nodes (IPs), with network flows represented as edges between source and destination hosts. This is a common structure for flow classification.

The research specifically targeted two state-of-the-art GNN models with high academic citations:

• EGraphSAGE: This model classifies edges (flows) in a Flow Graph. Host nodes are typically initialized with random vectors (not actual IP addresses) to prevent bias and anonymize IPs, as IP addresses can be easily spoofed. EGraphSAGE learns by having destination hosts collect features from their neighboring edges (flows), aggregate them, and then concatenate these aggregated features with the host's own features to update its state. For classification, it takes the updated features of the two host nodes connected by an edge, concatenates them, and passes them through a dense layer to classify the edge (flow).
• GNN RNIDS: This model uses a heterogeneous graph, with distinct host nodes and flow nodes. In each iteration, edges learn new updates by concatenating features from their connected nodes. These updated edge features are then sent back to the connected host and flow nodes, which incorporate them into their current state. The newly updated states of the nodes are then used for classification through a dense layer to determine if a flow is malicious.

The fundamental vulnerability identified in both these models is their reliance on graph topology. By manipulating this structure, adversaries can exploit the very mechanism designed to enhance detection.

Key Findings

▶ Watch: Explaining Graph Neural Network (GNN) fundamentals (2:50)

The research yielded several critical findings that challenge the efficacy of current GNN-based network defense systems:

• Three Novel Adversarial Attacks: The study introduced three distinct and effective adversarial techniques: Spoof Flow Distribution (SFD), Spoof Flow Distribution + Benign Injection (SFD+Benign), and Link Congestion Distribution (LCD). These attacks are designed to specifically target the topological assumptions of GNNs.
• Widespread Efficacy: These attacks were rigorously tested and proven effective across three real-world network traffic datasets – CICIDS 2017, BCICDS 2017, and the more recent and challenging BCICDS DOS 2020.
• Significant Degradation of State-of-the-Art Models: The attacks successfully degraded the detection performance of two highly-cited GNN intrusion detection models, EGraphSAGE and GNN RNIDS. F1 scores, which were near 99% for baselines, plummeted dramatically, often falling below 50% and in some cases to less than 1%.
• Model-Specific Vulnerabilities: The research revealed that different GNN architectures exhibit varying vulnerabilities to specific attack types. For instance, EGraphSAGE showed resilience to simple SFD but was severely impacted by SFD+Benign, while GNN RNIDS proved vulnerable to almost all attack categories, particularly LCD.
• Feasibility in Real-World Scenarios: Crucially, the attacks require no specialized machine learning expertise from the adversary. Basic botnet capabilities, such as IP spoofing and traffic redistribution, are sufficient to execute these techniques, making them highly practical for real-world attackers.
• Resilience of Newer Datasets: While the newer BCICDS DOS 2020 dataset presented a more resilient baseline (GNN F1 scores were 92.6% for EGraphSAGE and 96% for GNN RNIDS, compared to near 100% on older datasets), the adversarial attacks still caused significant degradation, demonstrating that even advanced GNNs struggle against these manipulations.

Technical Deep Dive

▶ Watch: Core GNN mechanism: message passing framework (4:50)

The core premise of the adversarial attacks is to exploit the graph-centric learning of GNNs by manipulating the network's topological structure while maintaining the effectiveness of a DDoS attack.

Threat Model and Attack Philosophy

The adversary's goal is straightforward: evade GNN detection while ensuring the DDoS attack remains effective.

Adversary Capabilities:

• IP Spoofing: Easily spoof source IP addresses, capable of generating thousands of unique spoofed IPs.
• Traffic Mixing: Ability to intersperse malicious traffic with benign-looking traffic.
• Traffic Redistribution: Capable of distributing attack traffic across various source and destination points in the network.
• Topology Knowledge: Assumed knowledge of the target network's subnet structure.

Constraints: The attack must preserve its DDoS functionality; merely evading detection without causing disruption is not the goal.

Philosophy: Change the graph structure, maintain DDoS functionality.

Novel Attack Categories

1. Spoof Flow Distribution (SFD)

• Strategy: The adversary takes a set of malicious source IPs and, for each, generates a large number of spoofed IPs. The malicious traffic is then uniformly or randomly redistributed across these newly created spoofed source IPs.
• Graph Manipulation: This attack fragments the traffic originating from any single malicious IP. Instead of a few IPs sending high volumes of malicious flows, many spoofed IPs send lower volumes. In a Flow Graph, this means edges originating from a few nodes are now distributed across many more nodes, weakening the "burst" signal for any single source.
• Variants: Traffic can be distributed uniformly (each spoofed IP sends the same amount of flows) or randomly (flows are distributed based on a chosen random distribution).

1. Spoof Flow Distribution + Benign Injection (SFD+Benign)

• Strategy: This attack builds upon SFD.
• Phase 1: SFD is applied, fragmenting malicious traffic across spoofed IPs.
• Phase 2: Benign traffic is injected from these same spoofed IPs, creating a mixed behavior pattern.
• Graph Manipulation: In addition to the fragmentation, the presence of benign flows originating from the same spoofed IPs creates mixed-type edges in the graph. For GNNs like EGraphSAGE that learn from neighboring edges, encountering both malicious and benign edges from the same source neighborhood confuses the model's ability to classify. The model expects consistency in a node's neighborhood, but the injected benign traffic introduces noise and conflicting signals.
• Why it breaks EGraphSAGE: As EGraphSAGE learns feature representations from neighboring edges, the injection of benign edges alongside malicious ones makes it difficult for the model to correctly classify the overall malicious intent, leading to a significant drop in its F1 score.

1. Link Congestion Distribution (LCD)

• Strategy: This attack also begins with source IP spoofing but focuses on the destination side of the network.
• Phase 1: Spoofed source IPs are generated (similar to SFD).
• Phase 2: Instead of targeting a single or few destination servers, the malicious flows are redirected to a large number of legitimate or decoy IPs within the target network's subnet.
• Graph Manipulation: This attack aims to congest multiple links within the target network infrastructure. Decoy IPs are crucial here; these are IP addresses within the target's subnet that might not even be assigned to active devices. However, traffic sent to these unassigned IPs still traverses network gateways and internal routing infrastructure, creating congestion on the network links. This fragments the "burst" signal not just on the source side but significantly on the destination side, making it harder for GNNs that rely on high traffic volumes to single destinations (or specific links) to detect the attack.
• Variants:
• Uniform/Random Source IP Distribution: How the spoofed source IPs distribute their traffic.
• Variable Decoy IP Generation: The number and pattern of decoy IPs used.
• Benign Injection: Can optionally be added for further confusion.
• Why it breaks GNN RNIDS: GNN RNIDS often relies on detecting "bursts" or high traffic volumes associated with specific source-destination pairs or links. By distributing traffic across many legitimate and decoy destination IPs, LCD fragments these bursts across numerous links, confusing the model's ability to identify malicious activity based on concentrated traffic.

Experimental Setup

The research utilized three publicly available datasets:

• CICIDS 2017: A foundational dataset with 2.4 million flows, including 128,000 DDoS flows, characterized by 84 features per flow.
• BCICDS 2017: Derived from CICIDS 2017 but processed with a different flow extractor, resulting in 95,000 DDoS flows with 123 features. This highlights how flow aggregation methods can impact data representation.
• BCICDS DOS 2020: The newest and most challenging dataset, specifically designed for DDoS detection. It contains 700,000 flows, with 228,000 classified as DDoS, and offers 321 features per flow, making it harder for models to achieve high baseline accuracy.

The target models were EGraphSAGE and GNN RNIDS, both highly cited in network intrusion detection literature. Evaluation was performed using 10-fold cross-validation to establish robust baselines (model performance without attacks). The primary metric was the F1 score, a harmonic mean of precision and recall, chosen for its suitability in imbalanced classification tasks typical of intrusion detection. Attack intensities were varied, for example, by creating 5,000 or 10,000 spoofed IPs, or injecting 100 benign flows.

Results

The experimental results definitively demonstrated the vulnerability of GNN-based NIDS:

• CICIDS 2017 Dataset:
• Baselines for both models were near 100% F1 score.
• SFD: Showed no significant degradation for either model.
• SFD+Benign: EGraphSAGE's F1 score severely degraded to 4.6%. GNN RNIDS degraded less, to 61%.
• LCD: EGraphSAGE degraded to 47.9%. GNN RNIDS saw a more significant drop to 28%.

• BCICDS 2017 Dataset:
• SFD: Surprisingly, GNN RNIDS's F1 score degraded significantly to 16%, while EGraphSAGE remained resilient. The reason for this specific degradation in GNN RNIDS on this dataset with SFD alone was noted as unexpected.
• SFD+Benign: EGraphSAGE's F1 score dropped to less than 1%. GNN RNIDS degraded slightly to 16%.
• LCD: EGraphSAGE degraded to 68%. GNN RNIDS again took a substantial hit, dropping to approximately 15%.

• BCICDS DOS 2020 Dataset: This dataset proved more challenging even at baseline, with EGraphSAGE achieving 92.6% F1 and GNN RNIDS 96%.
• SFD: EGraphSAGE remained largely resilient. GNN RNIDS's F1 score degraded to 84-85%.
• SFD+Benign: EGraphSAGE's F1 score fell below 50%. GNN RNIDS degraded to 68%.
• LCD: Both models performed similarly, with F1 scores around 56-58%. While not as low as on older datasets, this still represents a significant degradation from their baselines, allowing attacks to pass through.

Attack Effectiveness Patterns:

• SFD alone was generally ineffective against EGraphSAGE.
• SFD+Benign proved devastating for EGraphSAGE due to its reliance on neighboring edge features.
• GNN RNIDS was generally vulnerable to most attacks, with LCD being consistently effective.
• LCD consistently delivered strong performance in degrading both models across datasets, primarily by fragmenting traffic and confusing burst detection mechanisms.

Demo / Proof of Concept

▶ Watch: Transforming network flows into graph structures (8:40)

The talk did not include a live demonstration or a video of a proof-of-concept. Instead, the research meticulously detailed the experimental setup, methodologies, and quantitative results obtained from applying the adversarial techniques against state-of-the-art GNN models across three real-world datasets. This rigorous experimental validation serves as the primary evidence for the claims made regarding the efficacy of the attacks.

Defensive Implications

▶ Watch: Targeted state-of-the-art GNN models for attack (10:00)

The findings of this research carry profound implications for organizations relying on or developing GNN-based network defense systems. The demonstrated vulnerabilities necessitate a proactive and adaptive approach from defenders:

• Mandatory Adversarial Testing: Any organization deploying GNNs for security tasks, whether it's network intrusion detection, internal threat detection, or anomaly detection, must rigorously test their models against adversarial attacks. The attacks presented here (SFD, SFD+Benign, LCD) should be used as a starting point or inspiration to develop architecture-specific tests.
• Re-evaluate Reliance on Graph Topology: The core vulnerability identified is the GNNs' dependence on graph topology. Defenders should be wary of models that solely rely on these structural patterns without robust defenses against their manipulation.
• Consider Hybrid Approaches: A potential strategy is to move away from purely topology-based machine learning or, more practically, to implement hybrid approaches. An ensemble model, combining GNNs with other robust detection mechanisms like LSTM (Long Short-Term Memory networks) or traditional ML, could offer greater resilience. Such a system might use the GNN for its relational insights but cross-validate with other models less susceptible to topological distortions.
• Monitor for Attack Patterns: Security teams should actively monitor network traffic for patterns indicative of these adversarial techniques. This includes looking for:
• Traffic Redistribution: Unusually fragmented traffic from many different, possibly spoofed, source IPs targeting a single or few destinations.
• Benign Injection: Mixed malicious and benign-looking traffic originating from the same source IPs.
• Link Congestion: Distributed traffic targeting a wide range of legitimate or decoy IPs within a subnet, leading to widespread link congestion rather than focused hits on specific servers.
• Adversary Accessibility: It's crucial to understand that these attacks do not require advanced machine learning expertise. Adversaries with basic botnet access already possess the capabilities for IP spoofing and traffic redistribution, making these techniques highly practical and accessible for real-world exploitation. The attack overhead is not significantly higher than standard DDoS attacks.

In essence, the industry must move beyond simply achieving high accuracy on clean datasets and instead focus on building robust, adversarially resilient GNN models, or augmenting them with complementary defense mechanisms.

Key Takeaways

• State-of-the-art Graph Neural Networks (GNNs) used for network intrusion detection are fundamentally vulnerable to manipulation of the underlying graph topology.
• Three novel adversarial attacks—Spoof Flow Distribution (SFD), SFD + Benign Injection, and Link Congestion Distribution (LCD)—can drastically reduce GNN detection performance, often dropping F1 scores below 50% and, in some cases, to less than 1%.
• The effectiveness of these attacks varies by GNN architecture and dataset; for example, SFD+Benign severely impacts EGraphSAGE, while LCD consistently degrades GNN RNIDS by fragmenting traffic and confusing burst detection.
• These adversarial techniques are practical and feasible for real-world attackers, requiring only basic botnet capabilities such as IP spoofing and traffic redistribution, without needing specialized machine learning expertise.
• Organizations employing GNN-based security systems must conduct rigorous adversarial testing and consider implementing hybrid approaches or ensemble models to build more resilient defenses against sophisticated, graph-manipulating attacks.
• Even on newer, more challenging datasets like BCICDS DOS 2020, where GNN baselines are already lower, these attacks still cause significant performance degradation, highlighting an ongoing and evolving challenge for network defense.

About the Speaker(s)

Kartikeya Sharma is a Senior Associate Information Security Engineer at Equinix, a global data center company. Based in Seattle, he focuses his work on the intersection of data analytics, artificial intelligence (AI), and cybersecurity. His research, including the work presented at SAINTCON, demonstrates his commitment to advancing the understanding of security vulnerabilities in AI-driven systems.

This research was conducted in collaboration with Dr. Jun Lee, who is the Director of the Center for Cyber Security and Privacy and a Professor at the University of Oregon.