Network Intrusion Detection with Neo4j and Snowflake
Building a network intrusion detector with Neo4j Graph Analytics for Snowflake. We use KNN to connect similar attack events, then train GraphSAGE on those relationships to classify malicious traffic - all natively in Snowpark Container Services. We'll match the academic benchmark (macro-F1 0.811) using nothing but SQL.
Guests: Olga Razvenskaia ( https://www.linkedin.com/in/olga-razvenskaya/ ) & Stu Moore ( https://www.linkedin.com/in/stujamesmoore/ )
Blog: https://stu-moore.medium.com/9e202e56d55c
Notebook: https://github.com/neo-technology/nf-bot-iot-knn-graphsage-demo
NODES 2025 - Graph Analytics in Snowflake: Beyond Traditional SQL with Neo4j: https://youtu.be/NQG4s8l5Pag?t=593
Neo4j Graph Analytics on Snowflake: https://app.snowflake.com/marketplace/listing/GZTDZH40CN/neo4j-neo4j-graph-analytics
Snowflake Graph Analytics: https://neo4j.com/docs/snowflake-graph-analytics/current/introduction/
KNN: https://neo4j.com/docs/graph-data-science/current/algorithms/knn/
GraphSAGE: https://neo4j.com/docs/graph-data-science/current/machine-learning/node-embeddings/graph-sage/
Chapters
- 00:00Introduction & Guest Welcome
- 04:23The Problem: IoT Network Intrusion Detection
- 07:51How KNN & GraphSAGE Work Together
- 13:13KNN Explained: Similarity-Based Graph Construction
- 17:17Neo4j Graph Analytics on Snowflake: Architecture Overview
- 20:16Demo Setup: The IoT Network Dataset
- 26:43Step 1: Running KNN to Build the Similarity Graph
- 34:22Step 2: Training GraphSAGE for Intrusion Classification
- 53:52Step 3: Heterogeneous Graph with IP
@SnowflakeInc
Related Videos
070 ESG Supply Chain Knowledge Graph – NODES2022 – Dr. Julian Gruemmer
Introducing Workspace — The Fastest Way To Build Your Neo4j Database
