Temporal flow-based dynamic graph neural network with robustness interpretation for DoS/DDoS IoT intrusion detection

ABSTRACT With the increasing use of Internet of Things (IoT) devices, volumetric network intrusions have expanded significantly. Various detection systems for network intrusions face complications in distinguishing between Distributed Denial-of-Service (DDoS) attacks and single-source Denial-of-Service (DoS) attacks an aspect that remains insufficiently investigated. Conventional Deep learning (DL) approaches rely on flat feature representations that often fail to capture underlying distributed topological structure inherent to multi-source flooding attacks. We propose adversarial-trained Graph Attention Network v2 (GATv2) framework that models network flows as temporal graphs, enabling topology-level discrimination of attack origins. A subset of network traffic from TON_IoT dataset of one million flow with DoS, DDoS, and benign classes, is represented as flow-level graph with directed edges, encoding node and edge features derived via entropy-aware feature engineering pipeline. We introduce source dispersion entropy, Gini concentration coefficients-based graph node features and the output yielding a Cohen's d separation score of 2.486 between DoS and DDoS classes. These temporal PyG graphs are examined with graph level feature selection using Kruskal-Wallis H-test, MI filtering, and Boruta wrapper selection to reduce the feature set. The GATv2 classifier was trained with test balanced accuracy of 0.9996, macro F 1-score of 0.9979, MCC of 0.9956 and hardened via projected gradient descent (PGD) adversarial training with a progressive ε schedule, maintaining a balanced accuracy of 0.9698 at ε = 0.20 and 0.9558 at ε = 0.35. GNN (Graph Neural Networks) Explainer identifies most attribution-significant subgraph structures for each traffic class, providing interpretable insights into attack topology.