GATs work pretty well, but they suffer from a short memory, or more specifically a limited time window of past events. We might be able to live with that, but we could also consider various temporal GNNs. Currently, there is one such implementation, where a GAT is combined with an LSTM, but it does not seem to perform as well as the GATs.
But there are many ways to take time into account. Check out the many options in
https://pytorch-geometric-temporal.readthedocs.io/en/latest/modules/root.html#
According to ChatGPT, among the layers listed in the PyTorch Geometric Temporal documentation, the ability to recognize or handle different types of relations is a crucial aspect for tasks that involve heterogeneous networks or graphs with multiple types of nodes and edges. Here are some layers that are particularly tailored to handle different types of relationships:
LRGCN (Long Short Term Memory Relational Graph Convolution Layer): This layer explicitly handles different types of relations by allowing different relations to have their convolutional filters. This is particularly important in scenarios where the interactions or connections between nodes are not uniform and can significantly differ (e.g., different types of alerts or events in an intrusion detection system). By considering the number and type of relations, LRGCN can learn how different types of connections between nodes evolve over time.
HeteroGCLSTM (Heterogeneous Graph Convolutional Long Short Term Memory): This is a variant designed for heterogeneous graphs where different types of nodes and edges might exist. It considers a dictionary of in_channels for different node types and leverages the graph's metadata to understand the structure and type of nodes and edges. This could be particularly useful in an IDS scenario where different kinds of nodes (servers, routers, endpoints) and different types of edges (data flow, control commands, etc.) may represent various aspects of the network and its traffic.
These layers are explicitly designed to work with different types of relations, making them potentially more suitable for complex scenarios where understanding the different types of interactions between nodes is crucial. In the context of intrusion detection, recognizing different types of relations might help in identifying patterns of normal vs. malicious activities, understanding how different types of attacks propagate, and how different parts of the network interact under various conditions.