Multi-stage attack detection in IIoT supply chains using graph neural networks

Abstract

Abstract Industrial internet of things (IIoT) environments connect devices, gateways, hosts, and services in ways that increase both operational visibility and cyber-attack exposure. Conventional intrusion-detection systems commonly produce flat attack labels and may underuse relational information between communicating assets. We investigate an ATT&CK-inspired stage-aware intrusion-detection framework that maps observed behaviour into four operational classes: Benign, Initial Access & Discovery (IAD), Lateral Movement, Execution & Persistence (LMEP), and Impact (IMP). Network-flow observations are represented using leakage-aware feature processing and an asset–time interaction graph, enabling comparison of feature-based, graph-based, temporal, and fusion models. To reduce dependence on a single benchmark, we evaluate the stage-aware formulation on both ToN-IoT and Edge-IIoTset. Following correction of the temporal-windowing pipeline, ToN-IoT contains 34,435 asset–window instances. GAT achieves the strongest ToN-IoT stage-detection performance with Macro-F1 $$0.687\pm 0.041$$ 0.687 ± 0.041 , followed by GraphSAGE ( $$0.671\pm 0.015$$ 0.671 ± 0.015 ) and GCN ( $$0.660\pm 0.039$$ 0.660 ± 0.039 ). The logistic-regression RF–GCN stack reaches $$0.395\pm 0.067$$ 0.395 ± 0.067 and does not outperform the strongest graph learners. A controlled meta-learner ablation increases stacked Macro-F1 to 0.468 with gradient boosting, suggesting that meta-learner choice contributes substantially to the fusion shortfall. On Edge-IIoTset, the feature-based Random Forest performs best with Macro-F1 0.615. We additionally evaluate stage-mapping sensitivity, graph construction, window-size sensitivity, alternative stacking meta-learners, baseline tuning, bootstrap uncertainty, and inference latency. We formulate a strict leakage-controlled pre-impact forecasting protocol; however, although the corrected ToN-IoT representation yields 21,313 candidate forecasting instances, only five are positive and all occur in the training partition, with zero positives in validation and test. We therefore do not report held-out forecasting-performance estimates and limit our empirical claims to stage-aware intrusion detection.