[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-seo-327631-105":3,"detail-sidebar-cat-0-en-105":81,"doc-detail-327631-en":131},{"code":4,"msg":5,"data":6},0,"ok",{"site_id":7,"language":8,"slug":9,"title":10,"keywords":11,"description":12,"schema_data":13,"social_meta":74,"head_meta":76,"extra_data":78,"updated_unix":80},105,"en","enhanced-feature-extraction-for-iot-network-intrusion-detection-using-gnns-and-kan","Enhanced Feature Extraction for IoT Network Intrusion Detection Using GNNs and KAN","","IoT network security increasingly demands advanced intrusion detection because IoT traffic exhibits dynamic, sparse topologies, highly imbalanced distributions, and diverse stealthy attack behaviors with strong heterogeneity in communication patterns. Existing GNN-based methods often struggle to model node and edge features jointly and capture fine-grained anomalous dynamics under such constraints. The work proposes SKGFusionKAN, which enhances GraphSAGE with multi-scale selective kernel attention for adaptive node/edge feature extraction, gated multi-scale fusion, and KAN-based nonlinear classification. Experiments on four NIDS benchmarks show consistent state-of-the-art performance in binary and multiclass detection tasks.",{"@graph":14,"@context":73},[15,34,56],{"@type":16,"itemListElement":17},"BreadcrumbList",[18,23,27,31],{"item":19,"name":20,"@type":21,"position":22},"https://docshare.wps.com","Home","ListItem",1,{"item":24,"name":25,"@type":21,"position":26},"https://docshare.wps.com/document/","Document",2,{"item":28,"name":29,"@type":21,"position":30},"https://docshare.wps.com/document/research-report/","Research & Report",3,{"item":32,"name":10,"@type":21,"position":33},"https://docshare.wps.com/document/enhanced-feature-extraction-for-iot-network-intrusion-detection-using-gnns-and-kan/327631/",4,{"url":32,"name":10,"@type":35,"image":36,"author":41,"headline":10,"publisher":44,"fileFormat":47,"inLanguage":8,"description":12,"dateModified":48,"datePublished":49,"encodingFormat":47,"isAccessibleForFree":50,"interactionStatistic":51},"DigitalDocument",{"url":37,"@type":38,"width":39,"height":40},"https://docshare.wps.com/thumbnails/enhanced-feature-extraction-for-iot-network-intrusion-detection-using-gnns-and-kan/327631.png","ImageObject",300,407,{"name":42,"@type":43},"Aurora","Person",{"url":19,"name":45,"@type":46},"DocShare","Organization","application/pdf","2026-11-04","2026-09-21",true,{"@type":52,"interactionType":53,"userInteractionCount":55},"InteractionCounter",{"@type":54},"ViewAction",28,{"@type":57,"mainEntity":58},"FAQPage",[59,65,69],{"name":60,"@type":61,"acceptedAnswer":62},"What problem does the paper target in IoT intrusion detection?","Question",{"text":63,"@type":64},"It targets the difficulty of detecting malicious traffic in IoT networks with dynamic, sparse topologies, imbalanced traffic, and highly diverse stealthy attack patterns.","Answer",{"name":66,"@type":61,"acceptedAnswer":67},"How does SKGFusionKAN enhance feature extraction for IoT networks?",{"text":68,"@type":64},"It improves GraphSAGE using multi-scale selective kernel attention for adaptive extraction of both node and edge features, strengthens edge-oriented message passing, and uses gated fusion to integrate multi-scale information.",{"name":70,"@type":61,"acceptedAnswer":71},"Why are KAN networks used in the classification stage?",{"text":72,"@type":64},"KAN networks provide superior nonlinear modeling capability, helping accurately detect intricate and low-frequency attack types common in IoT scenarios.","https://schema.org",{"og:url":32,"og:type":75,"og:title":10,"og:site_name":45,"og:description":12},"article",{"robots":77,"canonical":32},"index,follow",{"doc_id":79,"site_id":7},327631,1790120286,{"code":4,"msg":82,"data":83},"success",[84,88,92,96,101,106,111,115,120,123,127],{"id":22,"doc_module":4,"doc_module_name":25,"category_name":85,"show_sort_weight":86,"slug":87},"Story & Novel",90,"story-novel",{"id":26,"doc_module":4,"doc_module_name":25,"category_name":89,"show_sort_weight":90,"slug":91},"Literature",80,"literature",{"id":33,"doc_module":4,"doc_module_name":25,"category_name":93,"show_sort_weight":94,"slug":95},"Exam",70,"exam",{"id":97,"doc_module":4,"doc_module_name":25,"category_name":98,"show_sort_weight":99,"slug":100},5,"Comic",60,"comic",{"id":102,"doc_module":4,"doc_module_name":25,"category_name":103,"show_sort_weight":104,"slug":105},6,"Technology",50,"technology",{"id":107,"doc_module":4,"doc_module_name":25,"category_name":108,"show_sort_weight":109,"slug":110},7,"Healthcare",40,"healthcare",{"id":112,"doc_module":4,"doc_module_name":25,"category_name":29,"show_sort_weight":113,"slug":114},8,30,"research-report",{"id":116,"doc_module":4,"doc_module_name":25,"category_name":117,"show_sort_weight":118,"slug":119},9,"Religion & Spirituality",20,"religion-spirituality",{"id":118,"doc_module":4,"doc_module_name":25,"category_name":121,"show_sort_weight":118,"slug":122},"World Cup","world-cup",{"id":124,"doc_module":4,"doc_module_name":25,"category_name":125,"show_sort_weight":124,"slug":126},10,"Lifestyle","lifestyle",{"id":128,"doc_module":4,"doc_module_name":25,"category_name":129,"show_sort_weight":97,"slug":130},19,"General","general",{"code":4,"msg":82,"data":132},{"doc_id":79,"user_id":133,"nickname":42,"user_avatar":134,"doc_module":4,"category_id":112,"category_name":29,"doc_title":10,"doc_description":12,"doc_content":135,"file_id":136,"file_url":137,"file_type":138,"file_size":139,"view_count":55,"is_deleted":4,"is_public":22,"is_downloadable":22,"audit_status":22,"page_count":140,"language":141,"language_code":8,"site_id":7,"html_lang":8,"table_of_contents":142,"faqs":143,"seo_title":144,"seo_description":12,"update_tm":145,"read_time":146,"preview_page_count":4},4810365810221,"https://ap-avatar.wpscdn.com/davatar_155a257f0dc6eb9ab79c44ca47cae57d","Enhanced Feature Extraction for IoT Network Intrusion Detection Using GNNs and KAN  \nLong Zhao†, Shixun Ji†, Bin Cheng, Member, IEEE, and Bin He, Senior Member, IEEE  \narXiv :2607 .0298 1v 1 [ cs .CR] 3 Jul 2026  \nAbstract—Recent advancements in the Internet of Things (IoT) have emphasized the urgent need for advanced network security solutions, as IoT networks are characterized by dynamic topologies, highly imbalanced traffic, and a wide variety of complex and stealthy attack patterns.Unlike general IT networks, IoT environments are characterized by extreme heterogeneity in communication patterns and dynamic, sparse topologies. Traditional GNN-based intrusion detection methods often struggle to address these unique challenges, especially in efficiently modeling both node and edge features and capturing finegrained anomalous behaviors. To bridge these gaps, we propose SKGFusionKAN, a novel and IoT-tailored intrusion detection approach that enhances GraphSAGE with a multi-scale selective kernel attention mechanism, enabling adaptive extraction of both node and edge features under diverse and sparse IoT traffic conditions.Specifically, the edge-oriented message passing in our method strengthens information propagation over communication links, while the selective kernel attention adaptively weights edge-derived information from different receptive-field scales to handle heterogeneity. We further introduce a gated fusion process that dynamically integrates multi-scale features, specifically designed to improve model robustness against evolving attack surfaces and the complexity of IoT environments. Finally, we leverage Kolmogorov–Arnold Networks (KAN) for the classification stage, offering superior nonlinear modeling capabilities essential for accurately detecting intricate and low-frequency attack types prevalent in IoT scenarios. To our knowledge, this work presents a comprehensive integration of GNNs and KAN with dedicated architectural innovations for IoT network intrusion detection. Extensive experiments on four recent NIDS benchmark datasets demonstrate that SKGFusionKAN consistently outperforms state-of-the-art approaches in both binary and multiclass classification tasks, demonstrating its potential for IoT intrusion detection tasks.  \nIndex Terms—Graph Neural Networks, Kolmogorov–Arnold Networks, Network Intrusion Detection, Internet of Things  \nI. INTRODUCTION  \nINTERNET of Things (IoT) has experienced rapid adoption  \nin recent years. As networking and big data technologies have advanced, security has become a critical concern for IoT infrastructure. Researchers are focusing on developing  \nintrusion detection systems to identify and prevent malicious †These authors contributed equally to this work.  \nThis work was supported in part by the National Natural Science Foundation of China under grants 62573322, 62495094 and 62088101, by Shanghai Rising-Star Program under grant 24QA2709400, by the Shanghai Chenguang Program under grant 22CGA19, and by the Shanghai Municipal Science and Technology Major Project under grant 2021SHZDZX0100 . (Corresponding author: Bin Cheng.)  \nThe authors are with the Department of Control Science & Engineering, Tongji University, Shanghai 201804, China, and also with the National Key Laboratory of Autonomous Intelligent Unmanned Systems, Shanghai 201203, China (e-mail: [superzhaolong@tongji.edu.cn](superzhaolong@tongji.edu.cn);[jsx@tongji.edu.cn](jsx@tongji.edu.cn);  \n[bincheng@tongji.edu.cn](bincheng@tongji.edu.cn); [hebin@tongji.edu.cn](hebin@tongji.edu.cn)).  \nactivities [1]–[3] . When suspicious or abnormal behaviors are detected, alerts are triggered to protect devices against potential threats. However, the diversity of connected devices and the large volume of data generated present significant challenges regarding data storage capacity, computational efficiency, and network security.  \nThe increasing openness of digital environments exposes IoT networks to a range of cyberattacks, inc","cbCaipLLCAP1vcIp","https://ap.wps.com/l/cbCaipLLCAP1vcIp","pdf",7956227,14,"English","# Introduction\n## Challenges in IoT security and NIDS\n## Network intrusion detection fundamentals\n## Prior intrusion detection approaches","[{\"question\":\"What problem does the paper target in IoT intrusion detection?\",\"answer\":\"It targets the difficulty of detecting malicious traffic in IoT networks with dynamic, sparse topologies, imbalanced traffic, and highly diverse stealthy attack patterns.\"},{\"question\":\"How does SKGFusionKAN enhance feature extraction for IoT networks?\",\"answer\":\"It improves GraphSAGE using multi-scale selective kernel attention for adaptive extraction of both node and edge features, strengthens edge-oriented message passing, and uses gated fusion to integrate multi-scale information.\"},{\"question\":\"Why are KAN networks used in the classification stage?\",\"answer\":\"KAN networks provide superior nonlinear modeling capability, helping accurately detect intricate and low-frequency attack types common in IoT scenarios.\"}]","Enhanced Feature Extraction for IoT Network Intrusion Detection Using GNNs and KAN | PDF",1789977674,35]