标题： REAL-IoT：在实际对抗攻击下表征GNN入侵检测的鲁棒性 显示英文标题

标题： REAL-IoT: Characterizing GNN Intrusion Detection Robustness under Practical Adversarial Attack

摘要： 基于图神经网络（GNN）的网络入侵检测系统（NIDS）通常在单一数据集上进行评估，这限制了它们在分布漂移下的泛化能力。 此外，它们的对抗鲁棒性通常使用缺乏现实性的合成扰动进行评估。 这种测量差距导致对基于GNN的NIDS韧性进行了高估。 为了解决这些限制，我们提出了\textbf{真实物联网}，一个用于物联网环境中基于GNN的NIDS鲁棒性评估的综合性框架。 我们的框架提出了一种方法，从标准数据集中创建一个统一的数据集，以评估在漂移情况下的泛化能力。 此外，它还具有一种从物理物联网测试床中收集的新型入侵数据集，该数据集在真实环境下捕获了网络流量和攻击场景。 此外，使用 REAL-IoT，我们探索了大型语言模型（LLMs）在分析网络数据中的应用，并通过过滤可疑流来减轻对抗样本的影响。 我们使用 REAL-IoT 进行的评估显示，与标准基准的结果相比，GNN模型的性能有所下降，量化了它们对漂移和现实攻击的敏感性。 我们还展示了基于LLM的过滤方法在增强鲁棒性方面的潜力。 这些发现强调了在开发有弹性的物联网入侵检测系统时，进行现实威胁建模和严格测量实践的必要性。 显示英文摘要

摘要： Graph Neural Network (GNN)-based network intrusion detection systems (NIDS) are often evaluated on single datasets, limiting their ability to generalize under distribution drift. Furthermore, their adversarial robustness is typically assessed using synthetic perturbations that lack realism. This measurement gap leads to an overestimation of GNN-based NIDS resilience. To address the limitations, we propose \textbf{REAL-IoT}, a comprehensive framework for robustness evaluation of GNN-based NIDS in IoT environments. Our framework presents a methodology that creates a unified dataset from canonical datasets to assess generalization under drift. In addition, it features a novel intrusion dataset collected from a physical IoT testbed, which captures network traffic and attack scenarios under real-world settings. Furthermore, using REAL-IoT, we explore the usage of Large Language Models (LLMs) to analyze network data and mitigate the impact of adversarial examples by filtering suspicious flows. Our evaluations using REAL-IoT reveal performance drops in GNN models compared to results from standard benchmarks, quantifying their susceptibility to drift and realistic attacks. We also demonstrate the potential of LLM-based filtering to enhance robustness. These findings emphasize the necessity of realistic threat modeling and rigorous measurement practices for developing resilient IoT intrusion detection systems.