Temporal-Spatial Attention Graph Neural Network for Detecting Address Resolution Protocol Attacks in Industrial Internet of Things

Due to the low security of devices in Industrial Internet of Things (IIoT) systems, the network is highly vulnerable to potential threats. Among these threats, the Address Resolution Protocol (ARP) attack is a common attack method employed by hackers. Many existing studies have focused on using network traffic data for ARP attack detection. However, they overlook the fact that network traffic data exists in a non-Euclidean space. To address the challenges posed by non-Euclidean space, we adopt graph-based methods instead of Convolutional Neural Networks (CNNs). To detect ARP attacks, we propose a Temporal-Spatial Attention Graph Neural Network (TSAGNN) for detecting ARP attacks. Network traffic inherently contains rich temporal relationships, and our graph construction method combines both temporal graph and spatial graph, enabling us to capture information from both dimensions simultaneously. Furthermore, the introduction of attention mechanisms allows the model to focus on the most representative and critical nodes in the graph, thereby improving both the accuracy and efficiency of the training process. Experimental results show the effectiveness of our approach.

I. Introduction

The advancement of information technology and the rise of smart manufacturing have led to the increasing interconnection of Industrial Control Systems (ICS), giving rise to the Industrial Internet of Things (IIoT) [1]. Physical devices are typically connected to the internet using open communication protocols with low network security protection, making them susceptible to hacking. Among various security challenges, ARP attacks affect both end devices and network controllers, highlighting the critical need for effective detection methods.