MGNN-IDS: a multi-graph neural network approach for robust intrusion detection in the internet of things

The rapid development of Internet of Things (IoT) has led to the emergence of complex, heterogeneous, and large-scale networks that are increasingly vulnerable to sophisticated cyberattacks. Conventional Machine Learning (ML) and Deep Learning (DL) based intrusion detection models often struggle to capture the structural and relational dependencies inherent in IoT communications, as they rely heavily on flat feature spaces and have limited adaptability to dynamic network topologies. These limitations hinder cross-domain generalization and reduce detection accuracy in real-world IoT environments. To address these challenges, we propose a novel topology-aware Multi-Graph Neural Network (MGNN) architecture that efficiently models IoT networks by leveraging dual graph representations: a communication topology graph and a feature similarity graph. The MGNN employs Graph Convolutional Networks (GCNs) to extract topological patterns from network-level interactions and Graph Attention Networks (GATs) to learn complex semantic relationships between features. These representations are fused via an attention mechanism, producing a context-aware, high-fidelity embedding that enables accurate attack classification. Experimental results show that the proposed MGNN achieves 97.62% accuracy on the IDS-IoT 2024 dataset, outperforming the GCN-based model (84.29%) and the GAT-based model (90.47%). The MGNN also demonstrates strong generalizability, achieving 96.2% and 97.27% accuracy on the 5G-NIDD and IoT23 datasets, respectively, validating its robustness across dynamic IoT environments.