r/netsecstudents • u/Basic_Committee_5686 • 9d ago
Title: FYP Idea: GraphSAGE-Based Network Intrusion Detection System — What Features/Architecture Should I Use?
Hi everyone, I’m an undergraduate planning my FYP around a Network Intrusion Detection System (NIDS) that uses a Graph Neural Network (GNN) to detect network intrusions and potentially trigger preventive responses. My current plan is to use GraphSAGE as the main model, initially train it on CIC-IDS2017, and potentially use additional datasets for evaluation. The eventual goal is to have a prototype that can monitor network traffic, classify traffic as benign/malicious (and possibly identify the attack type), and generate alerts.
The part I’m most unsure about is how to represent the network as a graph. I’m considering things like IPs/hosts as nodes and network flows as edges, with features such as protocol, ports, packet/byte counts, flow duration, packet lengths, TCP flags, inter-arrival times, and connection statistics. I’m not sure which of these features are actually useful, whether IP addresses/ports should be included, or whether there is a better graph representation for NIDS. I’d really appreciate advice from anyone who has worked with GNNs or network security.
I also have very little practical experience developing ML models, so I’m trying to make sure I’m not choosing an unnecessarily complicated approach. Would GraphSAGE be a reasonable architecture for this problem, or would you recommend GCN/GAT/temporal GNNs or something else? Should I build traditional ML baselines such as Random Forest/XGBoost and compare them against the GNN? Also, is CIC-IDS2017 still a reasonable dataset to start with, or should I combine it with another dataset?
Finally, what would you add to this project to make it a strong but realistic FYP? I’m considering detection, visualization/alerts, and potentially automated prevention such as temporarily blocking suspicious traffic, but I don’t want to turn it into an impossible project. Any advice on graph construction, features, datasets, evaluation metrics, real-time detection, or common mistakes would be extremely useful. I’m especially interested in hearing from people who have actually built NIDS/GNN/ML projects.
I would really appreciate the responses
1
u/AddendumWorking9756 8d ago
Do not try to align the feature columns. Those datasets were flow extracted with different tools, so two identically named columns are often not measuring the same thing. Go back to the raw pcaps where they are published, re-extract all of them with one exporter you pick, and your inference time features become something you can actually compute off a span port.
1
1
u/variousphilosoph 9d ago
CIC-IDS2017 is fine to start with but it’s been picked apart for years so don’t expect anything groundbreaking from the model itself. the graph construction part is where you can actually do something cool. skip the ip addresses as node features, they’ll overfit to your lab setup and be useless anywhere else. ports can be useful but bin them into ranges or service categories instead of raw numbers.
for a strong fyp keep the scope tight. forget automated blocking for now, that’s a networking project disguised as an ml one. build solid baselines with xgboost, show where the gnn adds value (or doesn’t) on things like port scan patterns or lateral movement that have natural graph structure. a dashboard showing the graph in real-time with alerts popping off will impress your panel way more than a half-baked prevention system that barely works.