FlagThis

Abstract

Recent advancements in the Internet of Things (IoT) have emphasized the urgent need for advanced network security solutions, as IoT networks are characterized by dynamic topologies, highly imbalanced traffic, and a wide variety of complex and stealthy attack patterns.Unlike general IT networks, IoT environments are characterized by extreme heterogeneity in communication patterns and dynamic, sparse topologies. Traditional GNN-based intrusion detection methods often struggle to address these unique challenges, especially in efficiently modeling both node and edge features and capturing finegrained anomalous behaviors. To bridge these gaps, we propose SKGFusionKAN, a novel and IoT-tailored intrusion detection approach that enhances GraphSAGE with a multi-scale selective kernel attention mechanism, enabling adaptive extraction of both node and edge features under diverse and sparse IoT traffic conditions.Specifically, the edge-oriented message passing in our method strengthens information propagation over communication links, while the selective kernel attention adaptively weights edge-derived information from different receptive-field scales to handle heterogeneity. We further introduce a gated fusion process that dynamically integrates multi-scale features, specifically designed to improve model robustness against evolving attack surfaces and the complexity of IoT environments. Finally, we leverage KolmogorovArnold Networks (KAN) for the classification stage, offering superior nonlinear modeling capabilities essential for accurately detecting intricate and low-frequency attack types prevalent in IoT scenarios. To our knowledge, this work presents a comprehensive integration of GNNs and KAN with dedicated architectural innovations for IoT network intrusion detection. Extensive experiments on four recent NIDS benchmark datasets demonstrate that SKGFusionKAN consistently outperforms state-of-the-art approaches in both binary and multiclass classification tasks, demonstrating its potential for IoT intrusion detection tasks.