GNN-Guided Selection of Benign-like Anomalies for Backdoor Attacks Against Network Intrusion Detection Systems

Abstract

AI-driven network intrusion detection systems (NIDSs) have improved the detection of sophisticated and previously unseen attacks. However, the adoption of machine learning also introduces new attack surfaces, most notably backdoor attacks, in which a model is deliberately poisoned so that it misclassifies inputs carrying a specific trigger. This paper investigates a backdoor attack strategy that uses the embedding space of a Graph Attention Network (GAT) to select anomalous samples lying close to benign traffic in the learned representation. These benign-like anomalies are modified with a feature-level trigger drawn from the benign distribution and relabeled as benign, so that the poisoned records remain plausible under domain constraints. Unlike approaches that poison data uniformly at random, the proposed method uses embedding-based sample selection guided by a trained GAT surrogate. The poisoned dataset is then used to retrain non-graph tabular classifiers, namely, TabNet, ACID, and AlertNet. Experiments on three benchmark NIDS datasets—NSL-KDD, CICIDS2017, and UNSW-NB15—show that the attack attains high attack success rates (ASRs) with model- and dataset-dependent effects on clean-test performance. The advantage over random selection, however, is uneven: it is clear where the random baseline is not already saturated, and it is marginal or absent elsewhere. These results indicate that representation-aware poisoning deserves attention as a threat model for AI-based NIDS and that evaluation of such attacks should account for baseline saturation.