Empowering Digital Twin for Future Networks with Graph Neural Networks: Overview, Enabling Technologies, Challenges, and Opportunities

Abstract

As the complexity and scale of modern networks continue to grow, the need for efficient, secure management, and optimization becomes increasingly vital. Digital twin (DT) technology has emerged as a promising approach to address these challenges by providing a virtual representation of the physical network, enabling analysis, diagnosis, emulation, and control. The emergence of Software-defined network (SDN) has facilitated a holistic view of the network topology, enabling the use of Graph neural network (GNN) as a data-driven technique to solve diverse problems in future networks. This survey explores the intersection of GNNs and Network digital twins (NDTs), providing an overview of their applications, enabling technologies, challenges, and opportunities. We discuss how GNNs and NDTs can be leveraged to improve network performance, optimize routing, enable network slicing, and enhance security in future networks. Additionally, we highlight certain advantages of incorporating GNNs into NDTs and present two case studies. Finally, we address the key challenges and promising directions in the field, aiming to inspire further advancements and foster innovation in GNN-based NDTs for future networks.

1. Introduction

The emergence of 5G networks holds the potential to reshape industries, moving beyond the revolution of mobile communication to provide instantaneous connectivity for billions of Internet of things (IoT) devices, fueling the digital transformation of Industry 4.0. As networking technologies continue to evolve in complexity and scale, cutting-edge paradigms such as Software-defined network (SDN), Network function virtualization (NFV), and network slicing offer exceptional flexibility and programmability in network management and service delivery. However, the deployment and optimization of these advanced networking paradigms present new complexities and challenges that require innovative solutions.

To address these challenges and enhance the capabilities of future networks, the concept of Network digital twin (NDT) has gained prominence [1,2,3]. Digital twin often refers to the digital replication of a physical object enabled by a two-way synchronization. With the advantage of modeling accurately complex dynamic systems, digital twin coupled with data-driven methodologies emerges as a technology to enhance performance, to enable smart monitoring, low-cost trials, and predictive maintenance on any complex system. This includes the next-generation network. Aiming at the accurate data-driven network models operating in real time, the leverage of Machine learning and Artificial intelligence (ML/AI) techniques inside an NDT is inevitable. Moreover, among the diverse bodies of the ML/AI literature, Graph neural network (GNN) is naturally one of the most suitable to model networking systems. GNN excels in processing graph-structured data where nodes represent elements and edges depict relationships. By effectively propagating information across interconnected nodes, GNN captures both local and global insights, making them particularly potent in addressing the intricacies of network behavior [4].

In this paper, we explore the potential of GNNs in empowering NDTs to address these challenges and drive the advancement of future networks. Through a comprehensive analysis of state-of-the-art research, this paper aims to contribute to the understanding and adoption of GNN-based NDTs as powerful tools for future network management and evolution.

1.1. Existing Reviews

To this end, several existing surveys have been dedicated to reviewing the various applications, development, and deployment of Digital twins (DTs) and GNNs within next-generation networks. However, these surveys typically address the two topics separately.

On one hand, Vesselinova et al. [5] reviewed several combinatorial optimization problems on graphs while having a special eye on the applications in the telecommunications domain. The combinatorial optimization problems discussed in the paper include tasks such as network design, routing, bandwidth allocation, scheduling, and network reliability. While this survey does not explicitly focus on GNNs, a majority of the ML-based approaches to combinatorial problems, and telecommunications problems as well, are GNNs. Also, Zhu et al. [6] conducted a brief review of the existing literature on deep graph generation from various emerging methods to its wide application areas. He et al. [7] provided a review of GNN focused on wireless networks. This work provides a comprehensive survey of the literature of GNNs and their application in wireless networks such as resource allocation, channel estimation, traffic prediction, and so on. Another closely related work, Jiang [4], proposed, for the first time, a comprehensive survey of the huge body of research leveraging various graph-based deep learning models for solving problems in different types of communication networks including wireless, wired, and software-defined networks. In the same direction, Suárez-Varela et al. [8] presented a brief overview of GNN for communication networks including wired and wireless networks. Furthermore, for technical issues in designing and implementing specific GNNs, various works surveyed them from the perspectives of explainability [9], dynamics [10], and hardware-software accelerators [11]. In addition, there are several overviews on applying GNN to solve problems in the IoT [12] and traffic forecasting in urban rail transit systems [13].

On the other hand, several valuable contributions have been made in recent literature on DTs for networking systems. For instance, Nguyen et al. [14] presented briefly how digital twins could be a powerful tool to fulfill the potential of 5G networks and beyond. Wu et al. [15] conducted a survey on DT networks, which exploit DT technology to simulate and predict network dynamics, as well as enhance and optimize network management. The survey provides a comprehensive review of DT networks, covering key features, technical challenges, and potential applications in detail. In the comprehensive survey by Kuruvatti et al. [3], the main contributions can be divided into two parts. In the first part, the survey focuses on reviewing potential use cases and scenarios in a 6G communication network where a DT could play an essential role. The second part focuses on reviewing the activities of the Standards Development Organization on NDTs including a description of key elements, requirements, and reference architecture. Khan et al. [16] presented a taxonomy including twins for wireless and vice-versa. Moreover, Almasan et al. [1] introduced the general architecture of the NDT and provided some potential use cases. Two perspectives of NDTs were briefly discussed including leveraging GNNs for the core components of NDTs and coupling a network optimizer with the NDT. Quantitative results for routing optimization are provided as examples of NDTs. Furthermore, Suhail et al. [17] conducted an extensive review of the state-of-the-art research results on blockchain-based DT, highlighting their key benefits.

However, to the best of our knowledge, no survey has thoroughly investigated the GNN-based DTs for networks. This gap in the existing literature highlights the need for further exploration and research in this area. We summarize the comparison between related works and our paper in

Table 1. Summary of related reviews on DT and GNN related topic (✓, x, and * indicate that the topic is totally, not, or partially covered, respectively).

Ref.	Contributions	GNN	DT	Networking Applications
[5]	A comprehensive review of various combinatorial optimization problems on graphs, with a particular emphasis on their applications in the telecommunications domain.	*	x	*
[7]	A comprehensive overview of the application of GNN in wireless networks.	✓	x	*
[4,8]	A comprehensive review of graph-based deep learning models for solving problems in different types of communication networks including wireless, wired, and software-defined networks.	✓	x	✓
[12]	A comprehensive review of recent advances in the application of GNN to the IoT field, including a deep dive analysis of GNN design in various IoT sensing environments.	✓	x	*
[13]	A survey on traffic forecasting in the intelligent transportation system.	✓	x	x
[14]	A brief review on the application of DT with 5G networks and beyond.	x	✓	✓
[15]	A comprehensive survey on the digital twin network including the key features, technical challenges, and potential applications.	x	✓	*
[3]	A review of the potential use cases and scenarios in a 6G communication network where a digital twin could play an essential role.	x	*	✓
[16]	A comprehensive survey on the benefits of twins for wireless and wireless for twins.	x	✓	✓
[1]	Presentation of the application of GNN for the core components of network digital twins and coupling a network optimizer with the network digital twins.	*	✓	✓
Ours	A review of DT, GNN, and Graph neural network-based network digital twin (GraphNDT) in innovating the communication networks.	✓	✓	✓

.

1.2. Our Contributions

Given the identified gap in the existing literature, our key contributions are outlined as follows:

• A review of DTs applications and use cases for future networks, including both access and core networks.
• A review of several GNN-based models for network management, classified by problems and network domains.
• An analysis of potential applications of DTs based on GNNs for the Next-generation networks (GraphNDTs) and a study of existing works in this direction.
• Insights into challenges and future directions to be taken in order to improve the GraphNDTs to handle large-scale networks and their inherent sub-challenges.

1.3. Structure of the Survey

The rest of our survey is organized as described in Figure 1. Section 2 provides an overview of DTs in the context of future networks, while Section 3 delves into the applications of GNNs for future networks. In Section 4, we analyze the fusion between GNNs and DTs, which we refer to as a Graph neural network-based network digital twin (GraphNDT), with a focus on their potential use cases. We specifically investigate two prominent scenarios: routing optimization and network slicing management. Finally, Section 5 concludes the review by highlighting promising directions and challenges in this evolving field.

2. Digital Twins for Next-Generation Networks

Digital twins (DTs) emerged in the early 2000s when Michael Grieves introduced them during a course presentation on product lifecycle management. By 2011, implementing DTs was regarded as a challenging process that demanded advancements in various technologies. Although the term “digital twin” emerged in 2003, NASA provided the first detailed account of its application in Technology Roadmaps several years later. In this context, a twin was employed to replicate space conditions and conduct tests for flight preparation. Initially rooted in the aerospace sector, the adoption of DTs expanded to the manufacturing industry around 2012.

Other than the three main components, the digital (virtual part), the real physical product, and the connection between them, according to Tao et al. [18], a DT can be extended to five components by including data and service as a part of it. While sharing a similar purpose with simulations, a digital twin is expected to be more potent by adopting a data-driven approach to model physical objects. Furthermore, the bidirectional synchronization in the connection allows for the real-time updating of the digital replica in response to changes in the mirrored physical object and facilitates the monitoring of the associated product through a virtualization layer. Simulations, on the other hand, focus on modeling the physical entity in specific scenarios or time frames. At the simplest level, a DT is a digital counterpart of a single, atomic, physical thing/system. In a web-based context, at this stage, the DT is a mere proxy of an IoT device with eventually augmented capabilities. However, the digital twin concept can be applied to larger systems in a cascading manner [19], where it can be considered as Things in the Web Of Things vision: they are components of a larger graph of Things and can be composed in a bottom-up or top-down fashion to realize large-scale cyber-physical systems in different application domains, e.g., transportation networks [20,21,22], water distribution networks [23], smart manufacturing systems [24], etc. In this context, Graph neural networks (GNNs) can be a relevant tool that can help in building additional AI-based services on top of this graph of DTs.

The application of the digital twin paradigm to network management and operation fits into the continuation of global network digitization. It is seen as a high-value target by network operators, and thus there are parallel efforts to offer a standardized definition of what is a Network DT, i.e., DTN or NDT. One can be found in the International Telecommunication Union (ITU) recommendation document [25]: “A digital twin network (DTN) is a virtual representation of the physical network. DTN is useful for analyzing, diagnosing, emulating, and controlling the physical network based on data, model, and interface, to achieve a real-time interactive mapping between physical networks and virtual twin networks. According to the definition, DTN contains four key characteristics: data, mapping, model, and interface [...]”. ITU also proposes a reference architecture of a Network digital twin (NDT) (see Figure 2), including three layers, three domains, and a double closed-loop. The three layers consist of the physical network layer, the Network digital twin (NDT) layer, and the network application layer. Inside the NDT layer, three domains are defined corresponding to three key subsystems: unified data repository, unified data models, and DT entity management. While the unified data repository serves as a single source of data for this layer, and provides the capability to collect, store, serve, and manage data, the unified data model is the ability source of this layer, equipped with specific model instances for different network applications. Within the model domain, an inner closed-loop optimization and emulation is defined between two model types: (i) basic models, which help verify and emulate control changes and optimization solutions before the new configuration is sent to the physical network, and (ii) functional models, which are established for specific use cases and help optimize network configurations to gain better performance. Additionally, the DT entity management enforces the NDT layer with three key controllers: model management, security management, and topology management. Finally, the outer closed loop control feedback is defined based on the three-layer architecture.

Like in many other fields (e.g., IoT, Industry 4.0, and healthcare), the DT paradigm can be applied to a diverse set of use cases. The sections hereafter detail the most notable use cases and associated related work for the NDT.

2.1. Digital Twins for Access Networks

In this section, we provide a survey of existing use cases of DTs in next-generation access networks, spanning across four principle subdomains: radio, Internet of things (IoT), vehicular, and edge networks.

2.1.1. Radio Networks

In 6G THz networks, Line-Of-Sight signal establishment is required to enable high bandwidth and low latency; however, obstacles in the path may absorb THz signals, which makes Line-Of-Sight signal establishment impossible. Pengnoo et al. [26] tackle the problem of signal reflection to avoid obstacles for the signals between a Base station (BS) and a user in indoor amenities, using a digital twin to model and control the signal propagation. The DT uses a set of cameras to stream images of the indoor space. The described system includes modules to perform calculations, e.g., ray tracing, path loss prediction, reflector, and mobile endpoint alignment, allowing the DT estimation of the THz Potential Field (THzPF) and use of this estimation to redirect the signal in real time. The authors present simulation results to show the effectiveness of the system.

In a similar context for outdoor applications, Jiang and Alkhateeb [27] address the adjustment of narrow beams in large-scale MIMO systems. This traditionally requires a large amount of data acquisition/beam sweeping, which scales with the system size/number of antennas. The authors propose to (i) construct a 3D digital replica, i.e., a digital twin, of the real-world communication system, and (ii) use ray tracing algorithms to simulate the signal’s propagation. The authors demonstrate that the DT can be used to pre-train Machine learning (ML) models, thus reducing the data acquisition overhead as an important part of the data collection can be simulated. The expected mismatches between the real world and the DT “can be calibrated by a small amount of real-world data”.

2.1.2. Internet of Things Networks

Akbarian et al. [28] develop a DT for industrial control systems with the support of an intrusion detection algorithm allowing the detection of attacks and the diagnosis of the types of attack by classification. There exists literature regarding the implementation of DTs for intrusion detection systems but with limitations: one [29] considers only the rule-based detection algorithm, and one [30] shows limitations in the data synchronization between the physical system and its DT. Accordingly, in this work, the authors emphasize the novelty of the detection algorithm and the synchronization ability of the DT enabling continuous synchronization without a need for a specification of the system’s correct behavior.

In another study, Benedictis et al. [31] introduce a self-adaptive architecture for DTs aimed at Industrial internet of things (IIoT) anomaly detection. This architecture incorporates ML algorithms and draws inspiration from the MAPE-K [32] (Monitor-Analyze-Plan-Execute over a shared Knowledge base) feedback loop. The authors also demonstrate a Proof Of Concept (PoC) by developing a digital twin for a real-world IIoT system, specifically the European Railway Traffic Management System. The PoC showcases the reference architecture of the DT and includes quantitative evaluation to assess its performance.

2.1.3. Vehicular Networks

In [33], Hui et al. propose an architecture to solve (generic) Federated learning (FL) tasks in heterogeneous vehicular networks (HetVNets). In their simulation scenario, roadside units (RSUs) (i.e., cellular BSs or aerial vehicles) act as FL endpoints with FL capabilities/training resources, while vehicles hold data that can be used in training processes. In their approach, DTs of vehicles and RSUs are deployed, and the FL multi-tasks are considered as a matching game between learning task requests and available data within the RSUs range, which must be optimized in terms of training cost and model accuracy.

Similarly, Zhao et al. [34] deal with optimizing software-defined vehicular networks where the DT acts as a centralized controller of the network, enabling more computation resources than what is available at the edge. In this centralized configuration, the DT controller provides optimal per-flow routing computation adapted to the demands of vehicles. The authors implement a simulation where the vehicular network state is considered as a temporal graph, constructed as a Hidden Markov Model, and the routing scheme optimization is a temporal graph routing task. The centralized DT can run different routing scheme simulations by prioritizing different parameters, e.g., historical routing or vehicle density, and then apply the best routing scheme found to improve routing efficiency, maintenance, traffic flow, and security in the physical network.

2.1.4. Edge Networks

To achieve 6G ambitions such as ubiquitous connectivity, extremely low latency, and enhanced edge intelligence, Multiple-access edge computing (MEC) plays a crucial role. Lu et al. [35] propose a wireless digital twin edge network model that aims to provide hyper-connected user experience and low-latency edge computing. They tackle the DT to edge association problem concerning the dynamic network states and varying network topology, where DTs can be either twins of user devices or twins of services that users are using. The authors propose to use Deep reinforcement learning (DRL) for digital twin placement and transfer learning for digital twin migration to follow dynamically placed users, thus trying to minimize the latency and energy costs of users in the network.

In a different context, Van Huynh et al. [36] focus on the integration of MEC offloading with Ultra-reliable low-latency communication (URLLC) and short packet transmission, specifically in the IIoT context. The authors aim to minimize the latency of task offloading by optimizing the user association, transmission power, and processing rate of User equipments (UEs) and edge servers (ESs). To achieve this, a DT of the edge network architecture is constructed, while the wireless communications between UEs and ESs are established via URLLC links, realizing a DT-empowered URLLC edge network. In this work, the DT replicates the physical system (hardware information, operating applications, real-time states), optimizes resources, and makes decisions to control the whole system in real time. To achieve this, the DT optimizes a variety of variables, e.g., user association, offloading policies, transmission power, processing rates, energy consumption budget, and computation resources budget of UEs and ESs. Similarly, Do-Duy et al. [37] introduce the use of DTs for intelligently offloading the computing tasks of UEs onto MEC servers. They formulate the problem as an optimization problem with the main objective of minimizing the total digital twin latency by choosing the optimal user association, transmit power, offloading policies, and processing rate of UE and MEC servers.

Furthermore, Duong et al. [38] presented a solution to address the challenge of minimizing latency in the context of intelligent offloading of IoT devices, assisted by digital twins, onto edge networks deployed with unmanned aerial vehicles (UAVs). The solution takes into consideration the constraints imposed by URLLC links. The problem is formulated as an optimization task that involves jointly optimizing the transmit power, offloading policies, and processing rate of IoT devices and ESs.

2.2. Digital Twins for Core Networks

As for the core networks, DT also plays an important role in their evolution to the Next-generation network. As an example, Wang et al. [39] propose a DT framework to enhance optical communication networks. The authors describe a generic framework composed of the physical layer, the data layer, the model layer, and the application layer. The approach includes the propositions of three separate Deep learning (DL) models to achieve different objectives. First, a fault management model that uses bidirectional Gated recurrent unit (GRU) [40] to predict faulty equipment and XGBoost [41] to make a fault diagnosis. Second, a flexible hardware configuration model to dynamically configure a programmable optical transceiver (POT) using DRL. Finally, a dynamic transmission simulation system based on bidirectional Long short-term memory (LSTM) [42] that could replace a traditional block-based optical transmission simulation system.

Another approach proposed by Seilov et al. [43] involves building networks of digital twins to tackle problems in complex telecommunication networks with two specific examples in feedback loops and traffic monitoring. In the former case, the network of digital twins allows the developer the tracking of all changes made and intervention in the development of the telecommunication system. In the latter case, the network of digital twins enables the network operators to solve urgent problems in emergencies where the network traffic suddenly changes due to the dysfunction of some network elements.

In another context, Yigit et al. [44] present a digital twin-enabled framework aimed at Distributed denial of service (DDoS) attack detection for autonomous core networks. Since existing DDoS solutions are insufficient for data centers and edge networks in terms of scalability, detection rates, and latency, the authors develop an online ML-based algorithm for effective DDoS detection. This algorithm processes the data that can be captured in real time with the support of the digital twin designed for the core network. Moreover, the Yet another next generation (YANG) model and automated feature selection are also involved in reducing the complexity of the provided data before feeding it to the ML algorithm. Finally, the authors evaluate and show the outperformance of their proposed system using two different DDoS attack datasets as the simulation of the core network.

Lessons Learned

DTs have emerged as valuable tools in Next-generation networks, offering advanced capabilities in network optimization, monitoring, and security across various domains, including core networks, access networks, edge networks, and vehicular networks. In the context of optimization, digital twins function as centralized controllers that collect data from the physical network and propose optimal policies. For monitoring, they operate as a closed-loop autonomous system, ensuring effective network surveillance. Additionally, this autonomous system coupling with intrusion detection further emphasizes their importance in ensuring network security. Overall, digital twins play a pivotal role in enhancing network performance and safeguarding network integrity.

3. Graph Neural Networks for Next-Generation Networks

This section provides an introduction to Graph neural networks (GNNs), followed by their applications in the access and core network of the next-generation network.

3.1. Backgrounds on Graph Neural Networks

From now, unless otherwise specified, we denote $\mathcal{G}$ as a graph and $\mathcal{G}=(V,E)$, where V is the set of $\left|V\right|=n$ vertices and E is the set of edges $(v_i,v_j)$ for $v_i,v_j\in V$ if there exists an edge between them. The set of edges can also be represented under the form of an adjacency matrix $\mathit{A}$, which is a binary matrix of size $n\times n$, ${\mathit{A}}_{ij}\in \{0,1\}$ where 1 (or 0) means the existence (or the nonexistence) of the edge $(v_i,v_j)$.

Based on the design patterns of the models, we can classify GNNs into two groups: (i) Spectral-based GNNs and (ii) Message-Passing-based (or spatial-based) GNNs.

3.1.1. Spectral-Based Graph Convolutional Networks

Convolutional neural networks (CNNs) dominate image processing due to their ability to extract information from local neighborhoods of pixels (i.e., receptive field) in images. This property can also be leveraged in designing GNNs, where nodes can be seen as pixels, and a GNN layer acts like a CNN layer, capturing local information from node neighborhoods. However, defining a translation-invariant operator in the vertex domain is challenging. Graph signal processing (GSP) theory offers a solid foundation to formulate convolution operators in the spectral domain [45,46].

In GSP, a Graph fourier transformation (GFT) is defined for an undirected graph with a symmetric adjacency matrix $\mathit{A}$. The graph signal $\mathit{x}\in {\mathbb{R}}^n$ represents the scalar signals of each node in V [45]. The graph Laplacian matrix $\mathit{L}=\mathit{D}-\mathit{A}$ is a fundamental operator in GSP, where $\mathit{D}\in {\mathbb{R}}^{n\times n}$ is the diagonal matrix such that ${\mathit{D}}_{ii}={\sum }_{j=1}^n{A}_{ij}$, i.e., the ith node degree. Based on the GFT, Defferrard et al. [46] propose the K-order approximation of the convolution, using the Chebyshev expansion to reduce the learning and computational complexity. The graph convolution is approximated as

$$\begin{array}{c}\hfill g_{\mathit{\theta }}\left(\mathit{x}\right)\approx \sum _{k=0}^K{\theta }_k{\mathit{T}}_k\left(\tilde{\mathit{L}}\right)\mathit{x},\end{array}$$

(1)

where, via the recurrence of the Chebyshev polynomials, we compute ${\mathit{T}}_k\left(\tilde{\mathit{L}}\right)=2\tilde{\mathit{L}}{\mathit{T}}_{k-1}\left(\tilde{\mathit{L}}\right)-{\mathit{T}}_{k-2}\left(\tilde{\mathit{L}}\right)$ and $\tilde{\mathit{L}}=2\mathit{L}/{\lambda }_{max}-{\mathit{I}}_n$ given that ${\lambda }_{max}$ is the largest eigenvalue of the Laplacian, ${\mathit{T}}_0=0$, and ${\mathit{T}}_1=\tilde{\mathit{L}}$. Parameters $\mathit{\theta }$ can be updated to optimize the learning objective. Li et al. [47] extend the spectral-based graph convolution for directed graphs by using the same spectral approach. It is also important to note that K can be interpreted as the kernel size of the convolution, i.e., the radius of the local neighborhood from the central node.

3.1.2. Message-Passing-Based Graph Neural Networks

Kipf and Welling [48] consider convolving the graph signal $\mathit{x}$ with a kernel of size $K=1$. Additionally, they reduce the number of learned parameters to avoid overfitting. Accordingly, the convolutional operator is approximated as

$$\begin{array}{c}\hfill g_{\theta }\left(\mathit{x}\right)\approx \theta \left({\mathit{I}}_n+{\mathit{D}}^{-1/2}\mathit{A}{\mathit{D}}^{-1/2}\right)\mathit{x}.\end{array}$$

(2)

By stacking k first-order convolutional layers together, we can approximate the k-order graph convolution. Although this is often referred to as the Graph convolutional network (GCN), many other GNNs are also designed with the same architectural pattern, which is to stack several sub-modules together. Gilmer et al. [49] propose the generic framework Message-passing neural network (MPNN) to characterize this architectural pattern where these sub-modules could be described in one function:

$$\begin{array}{cc}\hfill {\mathit{h}}_u^{\left(t\right)}& ={\mathrm{Update}}^{\left(t\right)}\left({\mathit{h}}_u^{(t-1)},{\mathrm{Agg}}^{\left(t\right)}\left(\left\{{\mathit{h}}_v^{(t-1)},\forall v\in \mathcal{N}\left(u\right)\right\}\right)\right)\hfill \end{array}$$

(3)

$$\begin{array}{cc}\hfill & ={\mathrm{Update}}^{\left(t\right)}\left({\mathit{h}}_u^{(t-1)},{\mathit{m}}_u^{(t-1)}\right),\hfill \end{array}$$

(4)

where ${\mathit{h}}_u^{\left(t\right)}$ is the hidden embedding of node $u\in V$ before being passed to layer t, and ${\mathit{h}}_u^{\left(0\right)}={\mathit{x}}_u$ is the initial node features. In other words, an MPNN layer defines two important differentiable functions (neural network as an example): Update and Agg (-regation). After the aggregation of the neighboring node embedding of node u into message ${\mathit{m}}_u^{(t-1)}$, the hidden embedding of node u is updated using its previous node embedding and the aggregated message. A simple example of an MPNN is illustrated in Figure 3. The GCN can also be regarded as an MPNN with the addition as Agg and the learnable weighted sum as Update. In the same vein, we can consider the Graph attention network (GAT) [50] as an MPNN as well with the multi-head attention mechanism as Agg and the concatenation as Update. We describe the updated message on node u after the tth layer of deep one-head attention GAT using equations below:

$$\begin{array}{cccc}& {\alpha }_{u,v}\hfill & & =\frac{exp\left(\mathrm{LeakyReLU}\right({\mathit{a}}^{\top }[\mathit{W}{\mathit{h}}_u\left|\right|\mathit{W}{\mathit{h}}_v\left]\right))}{{\sum }_{v^{\prime }\in \mathcal{N}\left(u\right)}exp\left(\mathrm{LeakyReLU}\right({\mathit{a}}^{\top }[\mathit{W}{\mathit{h}}_u\left|\right|\mathit{W}{\mathit{h}}_{v^{\prime }}\left]\right))},\hfill \end{array}$$

(5)

$$\begin{array}{cccc}& {\mathit{m}}_u\hfill & & =\sum _{v\in \mathcal{N}\left(u\right)}{\alpha }_{u,v}{\mathit{h}}_v,\hfill \end{array}$$

(6)

$$\begin{array}{cccc}& {\mathit{h}}_u^{\left(t\right)}\hfill & & =\left[{\mathit{h}}_u^{(t-1)}\right|\left|{\mathit{m}}_u^{(t-1)}\right],\hfill \end{array}$$

(7)

where $\left|\right|$ is the concatenation operator, LeakyReLU [51] is the non-linear activation function, $\mathit{a}$ and $\mathit{W}$ are learnable weights. For the sake of clarity, we omit superscript $(t-1)$ from ${\alpha }_{u,v},\mathit{a},\mathit{W},\mathit{h}$ and $\mathit{m}$ in Equations (5) and (6). The extension to multi-head attention [52] is straightforward.

Overall, the main difference between spectral-based GCNs and MPNNs is their design patterns. While spectral-based GCNs provide a rigorous formulation for graph convolution, MPNNs simplify the computation, enable modularization, and facilitate solution design. In the following discussion, all GNNs are designed based on these two frameworks. Without further clarification, the term GCN refers to spatial-based GCN. Until now, GNNs continue to be a highly active research direction which still presents several challenges in both theoretical and technical aspects. However, in this section, and throughout this survey, our focus is exclusively on their applications in concrete networking problems and within the context of the Digital twin (DT). For a more in-depth exploration of challenges and current progress in this research field, we recommend readers to refer to [53,54,55,56].

3.2. GNN in Access Networks

In this section, we examine the current body of literature that explores the application of graph-based approaches in the management of access networks. Our review specifically centers around three key areas: resource allocation, traffic prediction, and network security, particularly intrusion detection.

3.2.1. Resource Allocation

Resource allocation in access networks that we focus on in this review mainly concerns connection management and link scheduling, as summarized in Table 2.

Table 2. Summary of application of GNN-based models for resource allocation in access networks.

Ref.	Model	Baseline	Objective	Metric
[57]	DRL, GNN	Default	Throughput and coverage maximization and load balancing	Gain percentages
[58]	DRL, GCN	Random, CNN+DRL, PG	Data rate maximization	Data rate and convergence performances
[59]	DQN, GAT, A2C	DQN, A2C, Hard slicing	Data rate maximization while guaranteeing Quality of service (QoS)	Utility performances
[60]	GCN, Spectral clustering	Max. achievable and max. sum of rate and power	Power allocation and user association	Data rate
[61]	GCN, DNN	Default	Sum rate maximization	Accuracy, average sum rate
[62]	GCN, MWIS	Local greedy solver	Delay minimization	Accuracy, average sum rate

Table 2. Summary of application of GNN-based models for resource allocation in access networks.

Ref.	Model	Baseline	Objective	Metric
[57]	DRL, GNN	Default	Throughput and coverage maximization and load balancing	Gain percentages
[58]	DRL, GCN	Random, CNN+DRL, PG	Data rate maximization	Data rate and convergence performances
[59]	DQN, GAT, A2C	DQN, A2C, Hard slicing	Data rate maximization while guaranteeing Quality of service (QoS)	Utility performances
[60]	GCN, Spectral clustering	Max. achievable and max. sum of rate and power	Power allocation and user association	Data rate
[61]	GCN, DNN	Default	Sum rate maximization	Accuracy, average sum rate
[62]	GCN, MWIS	Local greedy solver	Delay minimization	Accuracy, average sum rate

Connection Management

Playing a crucial role in resource management within access networks, connection management aims to achieve smooth, balanced, and fair throughput. Conventional approaches to connection management, particularly user-cell association, often rely on sub-optimal and greedy solutions, such as connecting each user to the cell with the highest received signal strength. However, the performance of networks can be enhanced by harnessing the potential of Machine learning (ML)-based solutions.

The advent of the next-generation software-defined 5G networks, as defined by the Open Radio Access Network (O-RAN) alliance, facilitates the integration of ML/AI-based techniques to address various challenges in access networks. In this context, Orhan et al. [57] propose a novel approach to handle user association and optimize load balancing on top of the O-RAN network architecture using GNNs. The RAN infrastructure and its connections to User equipments (UEs) are conceptualized as a graph of nodes representing radio cells and UEs, and edges encompassing (i) connections between adjacent cells and (ii) association between each UE and its associated cell. GNNs are then proposed as a data-driven method to comprehend and extract features from the underlying graph structure to the end of optimizing connection management based on three quantitive metrics. Accordingly, the optimization involves the joint maximization of the sum of UE throughput, coverage, and the load balancing index.

Similarly, Zhao et al. [58] leverage GNNs to address the resource management in the Radio access network (RAN). Their focus is primarily on the cognitive radio context, where unlicensed secondary users (SUs) can occasionally access the idle resources of licensed primary users (PUs). In line with the previously introduced work [57], they represent the underlay cognitive radio network as a graph, with vertices representing UE-cell links and edges denoting the interference between them. The radio resource management is then formulated as a decision-making problem where an actor proposes jointly the channel and power allocation while ensuring the constrained proportion of resources between PUs and SUs to maximize the data rate for all users. To achieve this, the authors employ GNNs to exploit the interference information embedded in the constructed graph for the generation of allocation policies. Additionally, they consider the modeling of the users’ mobility, resulting in a dynamic graph with a continuous decision-making mechanism. Consequently, the authors adopt a Deep reinforcement learning (DRL) framework for model learning. The simulation results demonstrate the feasibility and convergence of the proposed scheme, showing a significant performance improvement compared to existing approaches.

In the context of network slicing where diverse services are provided over the same communication infrastructure, resource allocation becomes challenging, especially in dense cellular network scenarios with multiple slices and Base stations (BSs). The key difficulty lies in designing a real-time inter-slice resource management strategy that can handle frequent BS handovers and accommodate varying service requirements. To address this challenge, Shao et al. [59] propose a Multi-agent reinforcement learning (MARL) [63] solution, where each agent represents a BS. The authors utilize a GAT to enhance the temporal and spatial cooperation between agents and develop a data-driven inter-slice resource allocation strategy in real time. The effectiveness of GAT in improving DRL in multi-agent systems is demonstrated through experiments. GAT is employed in conjunction with both the value-based technique Deep Q-network (DQN) [64] and a hybrid approach combining policy-based and value-based methods Advantage actor–critic (A2C) [65], showcasing its potential in enhancing performance and efficiency.

Furthermore, Hou et al. [60] aim to optimize radio resource allocation and user association within the context of the Ultra-Dense Network (UDN), where BSs including both micro- and macro-cells are deployed densely. The optimization process is centered on leveraging Channel state information (CSI) and is structured as a synchronous two-stage procedure: user association and power allocation, with the ultimate goal of maximizing the total data rate. To associate UEs to the set of micro- and macro-cells, they propose constructing an undirected graph with nodes as UEs, and edges are weighted based on the similarity between UEs features, which are composed of downlink channel gains from an UE to all the BSs. The spectral clustering algorithm is then employed on this graph to cluster UEs and associate them with appropriate cells. Simultaneously, a GNN model with learnable parameters is employed to capture the interference information and allocate radio power. A graph of BSs is utilized, with node features comprising channel gains of each BS to all users, and unweighted edges connecting cells with overlapping coverage. The GNN updates node features with captured interference information, feeding them into a fully connected network to generate power allocation strategies for every pair of UE and BS. The simulation shows that the method yields superior results and is less time consuming than the existing algorithms within the context of UDN.

Link Scheduling

In access networks, link scheduling involves allocating and managing limited bandwidth resources among multiple users or devices. The goal is to ensure fair and optimal distribution of bandwidth, taking into account individual requirements and the network’s capacity. Efficient link scheduling algorithms aim to minimize congestion, reduce latency, maximize throughput, and maintain fairness among users.

In general, link scheduling for device-to-device (D2D) communications is formulated as an NP-hard non-convex combinatorial problem. Traditional methods predominantly rely on mathematical optimization techniques, often requiring accurate CSI, which can be resource-intensive to obtain. A recent alternative involves the application of GNNs to address this issue. In [61], a graph embedding-based method is introduced to achieve link scheduling in D2D communications, eliminating the need for CSI. This method consists of constructing a fully connected directed graph for the D2D network where each D2D pair represents a node and interference links are edges. Input node features and interference links are computed based on spatial distances between devices in each D2D pair and distances between each pair, respectively. This is followed by a deep learning architecture to capture structure-aware node embeddings. Finally, the link scheduling problem is formulated into a binary classification problem to determine whether a D2D link should be deactivated. Therefore, given extracted node embeddings, a multi-layer classifier can generate a link scheduling strategy. Extensive simulation demonstrates that the proposed method performs near-optimally compared to state-of-the-art methods and requires only hundreds of training network layouts. Furthermore, it proves to be competitive in terms of scalability and generalizability to more complex scenarios.

In wireless multi-hop networks, delay holds significant importance for various applications. However, existing max-weight scheduling algorithms focus on instantaneous optimality and may not perform well in delay-oriented scheduling scenarios. To address this issue, Zhao et al. [62] propose a delay-oriented distributed scheduler based on GCNs. The proposed scheduler employs a GCN model to generate node embeddings, capturing both the network topology and multi-step lookahead backlogs. By considering the relationship between current backlogs and the schedule of the previous time slot, the scheduler can make more informed scheduling decisions. In wireless networks that are small to medium-sized and exhibit heterogeneous transmit power, particularly with central links having numerous interfering neighbors, the proposed distributed scheduler surpasses myopic schedulers that rely on greedy and instantaneously optimal maximum weighted independent set solvers. The solution showcases strong generalizability across various graph models while introducing minimal communication complexity overhead.

3.2.2. Traffic Prediction

Traffic prediction aims to anticipate the volume of network traffic based on historical data. This proactive measure helps to prevent future congestion and allows for dynamic optimization of network resources [66]. Like with IDS, traffic prediction can greatly benefit from GNN-based models due to their ability to comprehend and model network data effectively. In other words, as the traffic at a particular node depends not only on its historical values but also the traffic conditions of its near or far neighboring nodes, GNN combined with some temporal models (e.g., Recurrent neural network (RNN) or Long short-term memory (LSTM) model) can well model these dependencies [67].

In this context, Wang et al. [68] use GNN with RNN to extract spatiotemporal dependency from inter-tower and in-tower traffic and predict cellular traffic at a large scale. The proposed model outperforms the state-of-the-art approaches by 13.2% and 17.5% in terms of $MAE$ and $MAPE$, respectively. He et al. [69] introduce the Graph Attention Spatial-Temporal Network (GASTN) to forecast the mobile traffic. GASTN takes into account spatial dependencies by utilizing a geographical relation graph. Moreover, the model integrates RNN to extract temporal features within sequential data. Additionally, GASTN introduces two attention mechanisms to incorporate two distinct effects holistically. By incorporating the attention mechanism, GASTN can consider various factors and their importance when predicting traffic. In another work, Yang et al. [70] present STEM-GCN, a new GCN exploiting semi-variogram, which is a measure of dissimilarity between two variables across the domain of spatial distance and time lags. This model effectively captures spatial and temporal dependencies from dynamic graphs, includes a correlation smoothing strategy to reduce noise and improve link prediction accuracy, and handles network dynamics by propagating spatial and temporal characteristics by using stacked memory cell structures across sequential time steps.

Kalander et al. [71] propose the Spatio-Temporal Hybrid Graph Convolutional Network model (STHGCN), which uses Gated recurrent units (GRUs) to model temporal dependencies and a hybrid GCN to capture complex spatial dependencies from three perspectives: (i) spatial proximity (SP), (ii) functional similarity (FS), and (iii) recent trend similarity (RTS). As shown in Figure 4, the model processes temporal slices of features from each BS and applies the hybrid graph CNN using the three aforementioned spatial relationships. The output is processed by a GRU along with external information such as weather data or metadata and is then handled by a fully connected network to generate the final traffic prediction.

While the aforementioned approaches have demonstrated efficiency in traffic prediction, they do not take into account the similarity among different types of cellular services (e.g., calls, internet) and regions. To address this issue, Zhou et al. [72] introduce a transfer learning strategy based on a GCN model for large-scale traffic prediction called STA-GCN. The proposed model integrates transfer learning, an attention mechanism, the CNN model, and GCN to capture both temporal and spatial dependencies. The experiments conducted with the Telecom Italia dataset validated the efficacy of transfer learning in enhancing knowledge reusability and accelerating model fitting, without compromising prediction accuracy. Moreover, traffic in a wireless network is impacted not only by historical traffic and cross-domain datasets but also by handover traffic from the BS. Consequently, Zhao et al. [73] propose the STGCN-HO model, which uses a handover graph for cellular traffic prediction. The model leverages the transition probability matrix of the handover graph to enhance network traffic forecasting and fuses features from auxiliary data (e.g., day of the week, hour of the day), spatial, and temporal domains. Evaluations performed with real-world 4G LTE traffic data show that STGCN-HO outperforms the baseline models, including Historical average (HA) [74], Auto-Regressive Integrated Moving Average (ARIMA) [75], and LSTM models [76], at both the cellular and BS levels. However, all those models primarily focus on predicting future traffic load for a city, an urban area, or a BS, which is vague for fine-granular user-level traffic prediction. In this context, a fine-grained prediction is proposed by Yu et al. [77], where the authors present a spatio-temporal fine-granular user traffic prediction mechanism for cellular networks called STEP. Specifically, STEP is based on the integration of GCN and GRU models to capture the spatiotemporal features of the individual user traffic. In addition, Wang et al. [78] introduce an attention mechanism to assign appropriate weights to each node. They propose a time-series similarity-based graph attention network for cellular traffic prediction known as TSGAN. This model uses dynamic time warping [79] to compute the time-series similarity between the network traffic of every pair of cells and GATs to extract spatial features. Comparative experiments conducted on the Telecom Italia and Abilene datasets against GNNs and GRU models demonstrated the superior performance of TSGAN.

To conclude, we summarize the reviewed methods along with their experiment set-ups and quantitative results in

Table 3. Summary of application of GNN-based models for traffic prediction.

Ref.	Models	Dataset	Baselines	Prediction Horizon	Performance
[68]	GNN	Unpublished	ARIMA, HW, LSTM	30 min	MARE: 0.79
[69]	GNN, RNN, Attention mechanism	Telecom Italia	HA, ARIMA, MLP, LSTM, CNN-LSTM	10 min	MAE: 30.93
[71]	GCN, GRU	Unpublished	HA, GCN, Attention GCN, DCRNN, Graph WaveNet	15 min	MAE: 21.7, RMSE: 47.2
[72]	Transfer learning, Attention mechanism, CNNs, and GCN	Telecom Italia	LSRM, STGCN, ASTGCN, DCRNN	1 h	MAE: 55.46, RMSE: 116.92
[73]	GCN, Gated Linear Unit	Unpublished	HW, ARIMA, LSTM	15 min	RMSE: $3.91\times {10}^5$
[77]	GCN, GRU	Unpublished	ARIMA, LSTM, GNN	5 s	MARE: $2.96\times {10}^4$
[78]	GNN, GAT	Telecom Italia	GNN, GRU	10 min	MAE: 25.75, MAPE: 0.13, RMSE: 35.94

.

3.2.3. Intrusive Detection

As Industrial IoT (IIoT) networks increasingly permeate diverse sectors like home, industry, healthcare, and agriculture, the application of learning algorithms has become paramount for enhancing communication processes and real-time analytics. Yet, the rapid expansion of IoT devices brings substantial security concerns. The absence of robust security policies and standardization for IIoT networks exposes these systems to a high risk of malicious attacks. In this scenario, GNN emerges as a promising solution for next-generation IoT/IIoT networks. GNN is one of the potential tools for data representation and processing, enabling effective modeling and analysis of complex relationships within access networks. By leveraging GNN capabilities, it becomes possible to bolster real-time analytics and, consequently, improve the management and protection of the network and devices.

Intrusions are characterized by a sequence of suspicious and benign interactions between networks or processes in a host system. Thus, depending on where the detection takes place, Intrusion Detection Systems (IDS) can be divided into two broad categories, which are network-based intrusions (NIDS) and network host-based intrusions (HIDS) [80]. NIDS consistently monitor and analyze network traffic to detect network attacks. They can effectively detect malicious activities and alert network administrators to take action and mitigate security threats. In this subsection, we focus on the application of GNN to both NIDS and HIDS. However, given our interest in the application of GNN within Next-generation networks, our primary emphasis is on GNN-based strategies for NIDS, as briefly summarized in Table 4.

Table 4. Summary of application of GNN-based models for IDS.

Ref.	Learning	Target	Models	Dataset	Performance
[81]	Supervised	Node	GCN	-	Acc: 99.51%, 99.03%
[82]	Supervised	Node	Inferential SIR-GN	CAIDA + synthetic data	F1: 97.85–99.78%
[83]	Supervised	Node	GNN, GRU	CIC-IDS2017	F1: 99%
[84]	Supervised	Node	Graph network	CTU-13 + synthetic data	ACC: 96%
[85]	Supervised	Edge	E-GraphSAGE, GraphSAGE	BoT-IoT, ToN-IoT, NF-BoT-IoT, NF-ToN-IoT	F1: 100%, 99%, 97%, 100%
[86]	Supervised	Node	E-GraphSAGE, GAT	UNSW-NB15, CIC-Darknet2020, ToN-IoT, CSE-CIC-IDS2018	F1: 99.5%, 92.32%, 99.88%, 96.5%
[87]	Supervised	Node	GDN, GAT	SWaT, WADI	Acc: 99%, 98%
[88]	Semi-supervised	Node	GCN	CTU-13, Honeypot dataset	F1: 98.27%, 98.22%
[89]	Semi-supervised	Edge	GNN, Autoencoder, Attention mechanism	LANL2015, CERT, PicoDomain	F1: 89.28%, 91.28%, 92.68%
[90]	Supervised	Node	GIN, GNNExplainer	-	F1: 99.52%, 99.47%
[91]	Supervised	Node	DB-GNNExplainer	-	F1: 99.14%

Table 4. Summary of application of GNN-based models for IDS.

Ref.	Learning	Target	Models	Dataset	Performance
[81]	Supervised	Node	GCN	-	Acc: 99.51%, 99.03%
[82]	Supervised	Node	Inferential SIR-GN	CAIDA + synthetic data	F1: 97.85–99.78%
[83]	Supervised	Node	GNN, GRU	CIC-IDS2017	F1: 99%
[84]	Supervised	Node	Graph network	CTU-13 + synthetic data	ACC: 96%
[85]	Supervised	Edge	E-GraphSAGE, GraphSAGE	BoT-IoT, ToN-IoT, NF-BoT-IoT, NF-ToN-IoT	F1: 100%, 99%, 97%, 100%
[86]	Supervised	Node	E-GraphSAGE, GAT	UNSW-NB15, CIC-Darknet2020, ToN-IoT, CSE-CIC-IDS2018	F1: 99.5%, 92.32%, 99.88%, 96.5%
[87]	Supervised	Node	GDN, GAT	SWaT, WADI	Acc: 99%, 98%
[88]	Semi-supervised	Node	GCN	CTU-13, Honeypot dataset	F1: 98.27%, 98.22%
[89]	Semi-supervised	Edge	GNN, Autoencoder, Attention mechanism	LANL2015, CERT, PicoDomain	F1: 89.28%, 91.28%, 92.68%
[90]	Supervised	Node	GIN, GNNExplainer	-	F1: 99.52%, 99.47%
[91]	Supervised	Node	DB-GNNExplainer	-	F1: 99.14%

As depicted in Figure 5, conventional ML/Deep learning (DL) models typically rely on statistical features from each network flow for training, without considering the topological structure. In contrast, GNNs incorporate topological information along with network flow features, which enables them to model spatial relationships and dependencies between nodes (for example, traffic). This feature becomes particularly beneficial when the network data’s structure is complex and non-Euclidean. GNN is capable of handling dynamic topologies where nodes and edges can fluctuate over time. Additionally, GNN can detect subtle patterns in the graph structure data. For instance, GNNs can identify abnormal communication patterns between certain nodes, a capability that outperforms traditional ML/DL models. Zhou et al. [81] propose to detect with an End-to-end (E2E) data-driven approach using the GCN model. The experiment results showed that GCN performs better than the logistic regression model. Addressing the potential issue of overfitting with GNN models, Carpenter et al. [82] introduce an approach termed Inferential SIR-GN. This technique is designed to generalize unseen data within large graphs while prioritizing node structural similarity, thereby enhancing the robustness of GNNs in intrusion detection scenarios. In another GNN-based NIDS approach, Pujol-Perich et al. [83] focus on revealing the relationships between flows using a GNN model. They add new nodes to represent each flow GNN model. Specifically, for each flow, there are three nodes: the source host node, the destination host node, and the flow node, and the proposed graph includes heterogeneous elements (i.e., hosts and flows). Subsequently, a message-passing algorithm is proposed to efficiently learn from the host connection graph. The performance of their model was compared with some advanced ML models using the CIC-IDS2017 dataset, showing superior results in terms of the F1 score. Moreover, Protogerou et al. [84] provide an anomaly detection solution within IoT systems by employing a GNN-based model. They propose a multi-agent system based on GNN, where each agent is implemented using a GNN that can learn the representation of physical networks. Such an approach helps to explore the collaboration of intelligent agents to efficiently detect the intrusion. Lo et al. [85] also use the GNN for IoT network intrusion detection, called E-GraphSAGE. E-GraphSAGE enables the collection of information on flow-based features and topological patterns to learn the patterns of network flows and hence to support the detection of malicious edges. Using four benchmark datasets, the simulation results show that the E-GraphSAGE performs better than ML-based classifiers such as XGBoost. Similarly, Chang and Branco [86] extend E-GraphSAGE by proposing an edge-based residual graph attention network (E-ResGAT). E-ResGAT uses an attention mechanism supporting edge features and embedding residual learning to enhance malicious traffic detection. The obtained results show that E-ResGAT outperforms the original model E-GraphSAGE. In the same direction, Deng and Hooi [87] propose a structure learning approach in combination with GNN and use an attention mechanism called GDN. The novelty of their approach lies in using a distance metric to discern the relationships between nodes, primarily by selecting the top-K closest ones as the neighbor dependencies. Subsequently, a graph attention convolution is utilized to encapsulate the process of information propagation. Experiments on two real-world sensor datasets show that GDN can handle high-dimensional time-series data and outperform baseline models. In addition, Sun and Yang [89] introduce a lateral movement (LM) detection system called HetGLM. This system constructs a heterogeneous graph consisting of users, devices, processes, and files. LM detection is redefined as an anomaly link detection task within this heterogeneous graph. The model utilizes meta-paths within the graph to profile each network entity and identify authentication activities that deviate from benign behavior. While a few benign samples are required as input, the model benefits from the use of semi-supervised learning, allowing for more efficient detection of lateral movement.

Despite the performance of the abovementioned works, they are based on the supervised GNN model, where labeling data is often difficult and time-consuming. To handle this issue, semi-supervised learning can be used as an alternative solution. It exploits abundant unlabeled data in combination with a small amount of labeled data [92]. In this, Zhao et al. [88] propose a novel bot detection framework, namely Bot-AHGCN. Bot-AHGCN models fine-grained network flow objects into a heterogeneous graph and transforms the bot detection problem into a semi-supervised node classification task on the graph. The node is one flow entity from the 6-tuple (IP_src, IP_dst, port, protocol, request, response), and edges are actions between flow entities such as access or connect.

The black-box nature of GNN models poses a challenge to both the trust and understanding of the final results. This may raise several questions for the operator, such as the following: On what information do the models base their decisions on when determining whether a node is abnormal? Is the information learned by the model comprehensible? To address these concerns, researchers propose explainable GNN models for botnet detection [90,91]. Specifically, Lo et al. [90] develop an automated botnet detector and a forensic tool called XG-BoT. To overcome the limitations of the GCN regarding the number of layers, XG-BoT integrates group-reversible residual connections with the Graph Isomorphism Network (GIN). To enhance comprehensibility further, it offers explanations via GNNExplainer [93] and saliency maps. GNNExplainer underscores the subgraph structure and node-level features pertinent to the final prediction. Using the dataset proposed in [81], the simulation results demonstrate that XG-BoT achieved state-of-the-art performance in terms of the F1-score. Similarly, Zhu et al. [91] propose an interpretive method for GNN-based botnet detection called BD-GNNExplainer. This method first employs a GNN model to detect a botnet attack; next, BD-GNNExplainer identifies the most informative edges that are heavily focused on during the training process of the GNN models. Finally, an interpretability score is assigned by comparing the identified edges with the ground truth. The proposed approach aids not only in accurately identifying threats but also in understanding the reasoning behind these identifications. The results show that a model with better classification performance is not necessarily more interpretable.

3.3. GNN in Core Networks

In core networks, the two main topics include resource allocation and routing.

3.3.1. Resource Allocation

In this section, we discuss resource allocation within the core network, with the common problems of Virtual network embedding (VNE) and Service function chain (SFC), as summarized in

Table 5. Summary of application of GNN-based models for resource allocation in core networks.

Ref.	Model	Baseline	Objective	Metric
[94]	GCN, DRL	R-ViNE, D-ViNE, GRC, MCVNE, and NodeRank	VNE	Acceptance ratio, average revenue latency, node, and link resource utility
[95]	GNN, DRL	DDQN, MSGAS, Eigendecomposition	VNF placement	SFC rejection ratio, computation time
[96]	GNN, DRL	OFM, size-greedy, pairwise, random	Reduce flow migration cost	Migration cost, computation time
[97]	GNN, Kmeans	FirstFit, BestFit, GRC, NeuroViNE	Improve runtime and performance	Parallelizability, acceptance ratio, revenue and cost, CPU and link utilization
[98]	GNN, RL	NodeRank, MCST-VNE, GCN-VNE	Dynamic VNE, reduce resource fragmentation	Revenue, acceptance rate
[99]	GNN, ILP	DNN-based model	SFC	Cost (delay): average, fail ratio, overmax
[100]	GCN, DRL	LDG, DNN-DDQN	SFC	E2E delay

.

VNE involves the placement of virtual network services onto substrate network components. The performance of VNE algorithms plays a crucial role in determining the effectiveness and efficiency of a virtualized network, making it a critical component of network virtualization technology. To improve performance, VNE algorithms need to autonomously detect and adapt to complex and time-varying network conditions. They should dynamically provide solutions that are best suited to the current network status, considering factors such as resource availability, network topology, and service requirements.

In this context, Yan et al. [94] address the challenge of automatic virtual network embedding by combining DRL with a neural network structure based on GCN. They propose an algorithm that leverages a parallel RL framework and a multi-objective reward function for training. Through extensive simulations under various scenarios, the algorithm demonstrates strong performance across multiple metrics compared to existing state-of-the-art solutions. Notably, it achieves significant improvements in acceptance ratio and average revenue, with up to 39.6% and 70.6% improvements, respectively. The results also highlight the robustness of the proposed solution in handling different network conditions.

Similarly, Sun et al. [95] introduce DeepOpt, a framework where both DRL and GNN are employed to tackle the Virtual network function (VNF) placement challenge. They formulate the task as a sequential decision-making problem with the aim of minimizing the cost of deployment and enhancing the Quality of service (QoS) of network flows, particularly the E2E delay. They also argue that GNNs contribute to improved generalization across diverse network topologies. The simulation results indeed show that the model outperforms existing algorithms without GNN in the VNF placement task.

To ensure QoS while minimizing processing resources, network operators face the challenge of efficiently migrating traffic flows among network function instances in response to unpredictable network traffic. Sun et al. [96] propose DeepMigration, a solution that combines DRL with GNN to dynamically and accurately migrate traffic flows among network function instances (Figure 6). DeepMigration leverages the graph-based relationship deduction capability of their customized GNN and the self-evolution ability of DRL to model the cost and benefit of flow migration such as migration latency and reduction in the number of NF instances. This enables DeepMigration to generate effective and dynamic flow migration policies.

Habibi et al. [97] address the limitations of previous VNE approaches by introducing GraphViNE, a parallelizable VNE solution based on spatial GNNs. By incorporating server clustering, GraphViNE improves runtime and performance. Simulation experiments demonstrate that GraphViNE reduces runtime by a factor of eight and achieves an approximately 18% improvement in the revenue-to-cost ratio compared to other algorithms.

In a similar direction, Zhang et al. [98] propose a novel VNE algorithm that integrates RL and GNNs. This algorithm leverages a self-defined fitness matrix and fitness value to establish an objective function, enabling the efficient implementation of a dynamic VNE algorithm and effectively reducing resource fragmentation. The proposed method is evaluated using comparison algorithms, and simulation experiments validate its effectiveness. The results demonstrate that the dynamic VNE algorithm, which combines RL and GNNs, exhibits favorable VNE characteristics. Additionally, by modifying the resource attributes of both the physical and virtual networks, the algorithm demonstrates its flexibility in adapting to different network configurations.

Software-defined network (SDN) and Network function virtualization (NFV) have significantly advanced software-based control technology and reduced costs. SFC plays a crucial role in efficiently routing traffic through network servers to process the requested NFV while maintaining Service-Level Agreements (SLAs). However, SFC faces challenges in maintaining high QoS in complex scenarios. Existing approaches, such as deep neural networks (DNNs) [101], lack efficiency in utilizing network topology information and cannot handle dynamically changing topologies. To address these limitations, Heo et al. [99] propose a novel SFC model based on GNNs that leverages the graph-structured characteristics of network topology. Comprising an encoder and a decoder, the model functions by having the encoder capture the representation of the network topology, while the decoder estimates probabilities for neighboring nodes to handle a VNF. Experimental results demonstrate that the proposed GNN-based architecture outperforms previous DNN-based baseline models. Furthermore, the GNN-based model offers flexibility in adapting to new network topologies without requiring redesigning and retraining.

With the increasing demand for dynamic SFCs and the growing sensitivity of service providers towards energy consumption in NFV, there is a need to address the Energy-efficient Graph-structured SFC problem (EG-SFC). Qi et al. [100] recognize this problem and formulate it as a combinatorial optimization problem. To tackle EG-SFC, the authors propose an E2E GNN based on the constrained DRL approach. Their method utilizes GCNs to represent the Q-network of the Double Deep Q-Network (DDQN) [102] within the DRL framework. Additionally, the authors introduce a masking mechanism to mask the servers with insufficient remaining resources by assigning them with large negative values so that they are completely ignored from the deployment of new VNFs. This is expected to accelerate the training process. Experimental results demonstrate the effectiveness of the proposed method in handling unseen SFC graphs. It outperforms the least delay greedy (LDG) algorithms and traditional DDQN approaches, showcasing its ability to achieve better performance in terms of energy efficiency.

3.3.2. Routing

Routing optimization is a critical challenge in computer networks, significantly impacting network performance. The traditional routing protocols such as the Open Shortest Path First (OSPF) [103] and the Broader Gateway Protocol (BGP) [104] are performed on individual network devices based on only the local information. In contrast, SDN with its centralized controller offers a holistic network view, revolutionizing routing optimization by considering entire network configurations and topology.

However, the routing optimization in SDN remains a challenging problem cause of the intractability of estimating the per-path E2E metrics (i.e., delay, jitters, and so on). Analytical models and packet-level simulators are classical solutions to this problem. While the analytical network models such as queueing theory and fluid models are constrained by unrealistic hypotheses, the packet-level simulators can accurately estimate those network metrics but at expensive computing costs. Data-driven methods, and especially those with GNN as the core module (

Table 6. Summary of application of GNN-based models for routing in core networks.

Ref.	Model	Baseline	Simulator	Metric
[105,106,107,108,109,110]	MPNN	Queueing theory, Fluid model, RouteNet	OMNeT++	Delays in queuing networks
[111]	MPNN	Genetic Algorithm	-	Edge utilization
[112]	MPNN, DRL	Equal-cost multi-path, DRL [113,114]	OMNeT++	Average E2E delay
[115]	MPNN, DRL	Shortest path, Q-Routing [116]	Mininet, Ryu	Packet delivery ratio and transmission delay
[117]	GCN, DRL	OSPF, DRL [118]	OMNeT++	Packet loss rate, average delay, total number of packets forwarded

), have emerged as an alternative due to their scalability and their capability of accurate modeling. In this section, we review two classes of GNN-based solutions: one focuses only on the estimation of the E2E metrics, and the other concerns the E2E DL architectures involved in the decision-making in plus.

On the one hand, Rusek and Cholda [105] first propose the adoption of the MPNN for the estimation of delays in queuing networks. The framework is further improved with a bidirectional message passing between links–paths, so-called RouteNet [106]. The experiments are also carried out with the data generated by the packet-level simulator OMNeT++ [119] providing more realistic network traffic. Since then, many RouteNet variants have been proposed to improve the model and to adapt to the scenarios of more sophisticated network configurations. Badia-Sampera et al. [107] focus on the capability of modeling the network where forward devices would have different queue sizes. Suárez-Varela et al. [108] evaluate the generalization capabilities of the RouteNet in the larger networks of variable size (up to 50 nodes). TwinNet [109] introduces the notion of a queue state which led to a more complex message-passing scheme of three stages: (i) passing messages from queues, links to the associated paths, (ii) passing messages from paths to queues and (iii) passing messages from paths to links. This enables the model to capture different queue scheduling policies in a real-world network scenario. The most recent variant, RouteNet-F [110], attempts to fill the gap between the scale of the network testbeds or simulations, which are used for training, and the scale of the real network in the deployment. Indeed, this model aims to tackle the two challenges of RouteNet: (i) scaling to larger link capacities and (ii) different output ranges. The former challenges the neural networks to encode out-of-distribution numerical values of link capacities, which can reach infinity. The latter occurs when deploying the trained model into the real larger networks where the delay/jitter values can be very different due to higher link capacities and longer routing paths. Accordingly, the paper proposes to encode the link load in place of link capacity and to aggregate the link-wise effective queue occupancy along a path to infer the delay/jitter.

On the other hand, Sawada et al. [111] aimed to perform routing optimization for a network whose traffic could change every second. The authors propose a GNN-based framework that takes as input the network states (e.g., link bandwidths and traffic demands) and the network topology to generate the routing table. The generated routing tables are then post-processed to guarantee the reachability of the routing path. The model is optimized using the supervised training scheme. The authors apply the Genetic Algorithm onto the given networks to produce the sub-optimal routing tables, which are later used as the ground-truth labels for the training phase. Chen et al. [112] propose a MPNN-based framework for optimizing routing, a so-called AutoGNN. Given the network information as the input, this model combines the graph structural information with the local link information to generate a weight for each link as the output. A weighted shortest path algorithm is then performed on the weighted graph to calculate the shortest path, thus providing automatic routing optimization. The AutoGNN is trained to reduce the overall transmission delay using a Reinforcement learning (RL) mechanism, so-called REINFORCE [120], coupled with an OMNet++ simulator for providing network traffic data. The above methods are centralized in nature, aiming to optimize the routing decisions from a global perspective.

In contrast, Swaminathan et al. [115] propose an MPNN-based model to perform the routing optimization locally. The model, as the core module of a controller, provides the next node for each routing request received on individual nodes. The authors propose the generation of a network state matrix, which is the input for the MPNN-based model. The entire model is trained using the DRL framework which was aimed to maximize the rewards composed of (i) Packet Delivery reward, ensuring that the routing algorithm selects nodes in the neighbor of the current node, and (ii) Delay reward again composing of Queueing delay and Link delay. The training environment is set up using a Mininet Simulator to simulate a SDN and Ryu Software to simulate controller behavior. Similarly, Huang et al. [117] propose a distributed traffic routing control algorithm based on a deep graph reinforcement learning framework that combines the GCN model with a DRL training scheme called Actor–Critic [121]. This framework leverages a GCN model to extract the structural information of the network topology and then generates the next hop policy for each routing request received on individual nodes. The experiments are conducted within an environment interacting with an OMNet++ simulator. It is shown that the framework is capable of reducing packet transmission delay, increasing packet delivery ratio, and reducing the probability of network congestion.

Lesson Learned

GNNs have emerged as a powerful data-driven methodology for network optimization, traffic analysis, and security enhancement. Their applications are diverse, spanning multiple network domains and addressing various fundamental network challenges. Enabled by the holistic view of network topology provided by SDN, GNNs not only optimize networks, but also empower SDN and novel concepts like NFV and network slicing in Next-generation networks. However, the lack of real datasets poses a challenge for benchmarking and comparing different solutions. Nonetheless, their potential for transforming future networks is undeniable.

4. GNN-Based Digital Twins for Next-Generation Networks

As could be observed previously, Network digital twins (NDTs) offer significant advantages for diverse network applications over multiple network domains (Section 2). Additionally, Graph neural networks (GNNs) are emerging as a promising technique that can be leveraged to solve a wide range of network problems (Section 3). To develop the next-generation communication network with unprecedented capabilities, we identified the Graph neural network-based network digital twin (GraphNDT) as an essential research topic where several problems remain open, and a variety of advantages are to be explored. In addition, we reason on various potential usages of a GraphNDT. In the end, we examine two particular cases in existing works where GraphNDTs are leveraged for enhancing routing and network slicing.

4.1. Major Benefits of Using GNN-Based Digital Twins in Next-Generation Networks

We present below three key advantages of integrating the GNN-based Digital twin (DT) into Next-generation networks (Figure 7). These advantages, although distinct, are not mutually exclusive but rather complement and reinforce each other.

4.1.1. Network Optimization

In the context of a Software-defined network (SDN), the integration of an NDT within the control plane enables dynamic optimization of network operations based on insights gained from the digital twin [34]. The synchronization between network systems and their digital replicas allows for real-time updates and accurate representation of the network state. Moreover, the centralized control plane enables the NDTs to capture the entire network topology, providing the collected data with the semantic relationship between network elements, and allowing the control plane the making of optimal decisions based on a holistic view of the network. To effectively leverage the graph structure of the network, NDTs can leverage GNNs. GNNs are well-suited for capturing the dependencies and relationships between network elements, as they can learn from the graph structure and features associated with each element. On the one hand, GraphNDTs equipped with optimization algorithms can function as orchestration components within the control plane [34,122]. They utilize network states collected from the synchronization link and leverage GNN models to propose optimal actions based on the gathered information. By analyzing the real-time data from the network using GNN techniques, GraphNDTs can optimize various aspects such as resource allocation, routing decisions, or traffic management to improve network performance (see Section 3). On the other hand, GraphNDTs can also serve as components for validating optimization policies generated by other algorithms [1,109]. Once an optimization policy is generated by an external algorithm, the NDT can simulate its implementation and evaluate its effectiveness within the digital twin environment. By comparing the outcomes of the generated policy with the expected results, the NDT can provide feedback on the efficacy of the optimization policy. This dual functionality of GraphNDTs—acting as optimizers and validators—makes them versatile tools for network optimization.

4.1.2. Low-Cost Trials

With the capability to accurately model a dynamic complex system, DT equipped with data-driven methodologies is a key technology for the exact simulation and cost-effective trials on network systems [1,27,109]. Moreover, since the network is naturally represented as graphs, it is efficient to leverage GNNs for better analyzing the network systems. Provided with the data collected in real time from the physical system, an NDT empowered by GNN-based models can be trained to capture the behavior patterns of the network in diverse situations. This enables the NDT to play a critical role in low-cost trials where operators can interact with the network, try out several combinations of configurations or various scenarios; the NDT can still provide the predicted behaviors of the network with high precision. With generalized GNN models, users can test diverse sets of inputs, including those that could potentially cause service disruptions, which may be impossible to test in a network with zero fault tolerance [109]. These scenarios could involve increasing traffic loads, simulated link failures, deployment of new Base stations (BSs), or network upgrades. In summary, low-cost trials and simulations benefit from accurate modeling provided by digital twins equipped with data-driven methodologies. The integration of GNNs in NDTs enables operators to experiment with different network configurations and scenarios, predicting network behaviors and assessing the impact of various inputs. This capability allows for cost-effective testing of scenarios that may involve service disruptions, helping operators make informed decisions for network optimization and improvement.

4.1.3. Predictive Maintenance

The capabilities of a GraphNDT to analyze system states over time can be leveraged for predictive maintenance, including predicting failure points, tracing back to root causes, and making maintenance decisions [28,31,43,44]. By providing two-way communication, an NDT not only allows synchronizing the digital twin with the actual network infrastructure, but also provides a means to apply remote reconfiguration, simulate potential changes or maintenance activities, and validate their impact on network performance. Additionally, GraphNDT can facilitate the detection of anomalies or attacks by applying data-driven methods to time series data combined with network topology (see Section 3.2.3). After that, the graph structure, representing the communication between network elements, is crucial for performing root cause analysis. GNNs are well-suited for exploiting this structural information and tracing back to the root cause of anomalies detected within the network. Therefore, the combination of an NDT and GNNs empowers predictive maintenance, enabling a comprehensive understanding of network behavior and proactive maintenance decision making.

4.2. Existing Studies

In the following subsections, we showcase two specific scenarios where GraphNDTs help improve network performance. These scenarios exemplify the practical applications of GraphNDTs in addressing routing optimization challenges and enabling effective network slicing management.

4.2.1. Routing Optimization

We present the use cases of TwinNet [109], which is a GraphNDT that introduces a digital twin empowered by a GNN model to accurately simulate networks with various queuing configurations, routing, topologies, and traffic models. TwinNet is trained using data generated from a packet-accurate network simulator aiming at producing accurate estimates of per-flow Quality of service (QoS) metrics (e.g., delay, jitter, loss). TwinNet could be coupled with an optimizer to find the routing policies that satisfy complex Service level agreements (SLAs) with increasing traffic intensity. Moreover, the predictability of TwinNet is demonstrated through a what-if scenario involving a budget-constrained network upgrade, showcasing its ability to assess the impact of network upgrades, enabling low-cost trials.

Accurate modeling of networks is vital to network optimization. Although there exist traditional network models such as queuing theory and fluid model which are extensively used, they often rely on simplifying assumptions and may have limitations in capturing the complexity and dynamics of real-world network systems. Alternatively, packet-level simulators can accurately model networks but come at a high computational cost. In contrast, Deep learning (DL) techniques, particularly GNNs, offer a promising approach that strikes a balance between accuracy and computational cost. GNNs can accurately model network behaviors by being trained on real data without relying on excessive assumptions. Compared to packet-level simulators, GNNs offer a more computationally efficient solution for network modeling. Once trained, GNN-based models can make predictions on network performance in a timely manner.

TwinNet is trained on the dataset generated from packet-level simulator OMNeT++. Each data sample consists of a simulated network scenario defined by a topology, a source-destination traffic matrix, and a routing and queuing policy. The communication is simulated and the metrics of network performance are obtained to label the corresponding data sample. The traffic matrices are generated to simulate a wide range of network states from low to high traffic loads, including those that may cause congestion and packet loss. Queuing configurations are randomly assigned to each node. The training and evaluation of TwinNet utilize three real-world network topologies. The quantitative results demonstrate the effectiveness of TwinNet, achieving a Mean average percentage error (MAPE) of 3.8%, outperforming baselines that include a multi-layered neural network and a RouteNet [106]. Additionally, TwinNet can be combined with an optimization algorithm for routing optimization. In the paper, experimental results from coupling TwinNet with Direct Search showcase superior performance compared to baselines, which involve the combination of fluid models and the shortest path search. Furthermore, TwinNet enables low-cost trials without impacting the real network. Using TwinNet, the authors can assess the network’s capacity enhancement by selecting an additional link to be added. The results demonstrate that the additional link suggested by TwinNet effectively reduces the delay by 40.1% to 54.3%.

4.2.2. Network Slicing Management

We examine the application of a GNN-based digital twin for network slicing as proposed by Wang et al. [122]. The developed digital twin focuses on network slicing management, utilizing GNNs operating on a multilayered network constructed from slicing configurations. It is capable of performing the prediction of per-slice End-to-end (E2E) metrics, in which the latency was considered as an example of the target metrics. Moreover, three potential what-if scenarios were considered as the showcases for the leverage of the digital twin.

In 5G networks, network slicing can leverage the virtualized and software-defined nature of the network infrastructure to propose a customized slicing configuration that aligns with the specific usage requirements. This approach brings significant enhancements in terms of QoS. However, achieving this goal is a challenging task primarily due to the difficulty of measuring E2E metrics across multiple network slices spanning multiple network domains and involving different network nodes. Moreover, a digital twin targeting the capability of performing what-if scenarios may require the accurate modeling of the network behaviors given different configurations. To fulfill these requirements, the authors made use of GraphSAGE [85], a GNN to build a data-driven network modeling capable of predicting with precision the E2E latency of multiple network slices given the slicing configurations and substrate topology.

To train the GraphNDT, the authors reused the data from [106]. The dataset was initially generated from OMNeT++ for routing scenarios which consist of three different topologies, routing configurations, traffic matrices, and captured network metrics such as delay, latency, and jitter. However, by converting the pair-wise source destination traffic matrices into network slices, that dataset was used to stimulate the network slicing management scenario, and the ground-truth network metrics represent the E2E network slicing metrics. The experimental results demonstrate the accuracy of the proposed framework where the predicted latency has less than a 5% error rate under all three network topologies. Furthermore, three what-if scenarios are introduced to showcase the advantages of an NDT. Firstly, it can simulate an increase in traffic intensity to observe potential SLA violations, thus providing network operators with insights into the need for network slice reconfiguration. Secondly, it can simulate link failures and evaluate the monitoring system’s adaptive capabilities by observing changes in network metrics. Lastly, it can assess the performance of different optimization algorithms by comparing network metrics with the required SLA thresholds. Overall, the combination of the repurposed dataset and the GraphNDT enables accurate simulation and evaluation of network slicing scenarios, allowing for effective network optimization and management.

5. Challenges and Future Directions

We showed that GraphNDT can be a key enabler for innovating communication networks in many aspects including optimization, management, and security. However, the deployment of GraphNDTs may entail overcoming various obstacles. In this regard, we outline some of these challenges along with potential research directions, as summarized in

Table 7. Summary of challenges and future directions for GraphNDTs.

Challenges	Description	Future Directions
Dynamicity	The network topology is dynamic in a way that nodes or edges may appear or disappear, and the input data change over time.	1. Incremental Learning can allow GNN-based models learning from new data without having to retrain from scratch, which could be particularly beneficial in dynamic environments where data continually evolve [123]. 2. FL plays a crucial role within the dynamic GNN model, particularly in handling complex, large scales, and adapting to shifts in the network structure over time [124,125].
Heterogeneity	The different types of nodes and edges have different attributes, which are usually located in different feature spaces.	1. Meta-path Aggregated Graph Neural Network (MAGNN) which can capture both the semantic and structural information in heterogeneous graphs. 2. Contrastive learning-based method, where the model is pre-trained in a self-supervised manner to learn both the semantic and structural properties of heterogeneous graphs.
Robustness	The ability of the model to maintain high performance even when faced with perturbations in the graph structure or feature information.	1. Robust GNN architectures that are inherently more robust against adversarial attacks [126,127]. 2. Adversarial training methods involve integrating adversarial examples into the training process [128].
Generalization	The ability to generalize GNN so that the GraphNDT can still provide accurate predictions in case of abnormal scenarios or configurations. This is mandatory for low-cost trial use cases.	1. Train the models on additional data generated by simulations and testbeds. Transfer learning can be adopted to finetune the pre-trained models on the current NDT. 2. FL enables collaborative learning and model aggregation, allowing the GraphNDT to benefit from a broader understanding of various configurations while preserving the privacy of individual network systems [129,130,131].

.

5.1. Dynamicity

In real-world scenarios, network topologies exhibit dynamic characteristics with nodes and edges appearing or disappearing, or the input data change over time. Within an NDT where the two-way communication enables the real-time collection of data, the ability to exploit and understand these dynamic network behaviors becomes crucial. Static graphs are stable so they can be modeled feasibly, while dynamic graphs introduce changing structures. Thus, new GNN models are needed to adapt to the dynamicity of the network topology because re-training the model can be computationally expensive. Finding more efficient ways to update node representations in response to graph changes in network topology is an ongoing research problem. In this context, GraphSAIL has been proposed for the first time [123]. It addresses the incremental learning on GNN for recommender systems, which deals with the edges between nodes. Incremental learning [132,133] is a method that allows a model learning from new data without having to retrain from scratch, which could be particularly beneficial in dynamic environments where data continually evolve. Also, incorporating other machine learning techniques can enhance the performance of GNNs with dynamic network topology. Integrating FL [130,131,134,135,136] with dynamic GNNs can be a promising direction for building adaptable models for Next-generation networks. For example, FL allows dynamic GNNs adaptation to changes in data distribution across devices. In particular, using an asynchronous update allows procession of fast nodes without waiting for slower or disconnected ones [125]. Another strategy is to train GNNs with FL while accounting for clients that may drop out during the process [124]. All these can be beneficial for dynamic GNNs with Next-generation networks, where the relationships between nodes may be changing over time, for straggler nodes, added, disconnected, or updated nodes.

5.2. Heterogeneity

Although NDTs can collect network configuration data in the form of graphs, effectively processing these data for training machine learning models, such as GNNs, necessitates thoughtful consideration and meticulous engineering. One of the crucial challenges in this process is identifying the suitable entities to be represented as nodes and determining the relationships between them as edges. Real-world graphs such as network topologies are often heterogeneous, containing various types of nodes and edges, each with their unique attributes and typically situated in different feature spaces. The evolving nature of these graph structures and information makes the application of GNNs to Next-generation networks a complex task. Consequently, careful consideration is required during the preprocessing step to accommodate graph heterogeneity. Nevertheless, most existing GNN-based models primarily handle homogeneous graphs with a singular node type and edge type.

Recently, innovative solutions have emerged to address these issues; for example, studies such as those proposed in [137,138]. In particular, the authors in [137] proposed a new model named MAGNN, which employed three major components, (i) the node content transformation to encapsulate input node attributes, (ii) the intra-meta path aggregation to incorporate intermediate semantic nodes, (iii) and the inter-meta path aggregation to combine messages from multiple meta paths. Experimental results demonstrate that MAGNN can significantly outperform state-of-the-art models on various heterogeneous graph mining tasks, including node classification, link prediction, and recommendation. The results indicate that the model successfully captures both the semantic and structural information in heterogeneous graphs, demonstrating the potential for handling complex real-world graph data. Moreover, the work in [138] proposed an innovative Contrastive Pre-Training strategy for GNNs on Heterogeneous Graphs (CPTHG). This strategy captures both the semantic and structural properties of graphs in a self-supervised manner. Contrastive learning is a form of self-supervised learning where the model is trained to identify which samples in the dataset are similar (or contrastive) to each other. The proposed model contains three main components, (i) a semantic-preserving contrast that aims to maximize the similarity between the node pairs that have the same type or share the same semantic information, (ii) a structure-preserving contrast that helps to maximize the similarity between the node pairs that have similar structural roles in the network, and (iii) negative sampling to reduce the similarity between the nodes that do not share similar structural roles or semantic information. These advancements suggest a promising direction for future work involving these techniques, particularly in the domain of network traffic prediction.

5.3. Robustness

GNN-based solutions need to maintain high performance even when faced with perturbations in the graph structure or feature information. Adversarial attacks pose a particular concern, where small, intentionally harmful changes are made to the graph (such as adding, removing edges, or altering node features), or simply dealing with noisy or incomplete data. Within an NDT system, this attack can be performed by exploiting the vulnerabilities in the communication channels between the network and the digital replica. For instance, if data collection involves transmitting data over a network, attackers could attempt to intercept and modify the data packets, altering network statistics, topology information, or node attributes. Adversarial attacks significantly impact the integrity and reliability of GraphNDT systems and can lead to incorrect predictions or interpretations by GNN models. For example, in a semi-supervised node classification task, adversarial modifications can make a GNN misclassify the label of a node. The authors in [139] highlighted this problem, where they demonstrated that most GNNs are highly vulnerable to adversarial attacks.

In addition to securing the communication channels, enhancing the robustness of GNN models against adversarial attacks is an intrinsic solution. This can be achieved through the development of robust GNN architectures and the application of adversarial training techniques. For robust GNN architectures, some research papers have designed new GNN architectures that are inherently more robust against adversarial attacks. For example, RGCN (Robust Graph Convolutional Network) incorporates a smoothing mechanism to reduce the effect of adversarial perturbations [127]. In the same direction, a GNN-Guard against adversarial attacks on GNN was proposed in [126]. The main idea is to monitor the information flow in a GNN during message passing and to control the influence of nodes that have irregular behavior. To achieve this, significant modification is involved in the way GNN aggregates and propagates information. This includes introducing guarded aggregation to limit the influence of suspicious nodes and guarded influence computation to attenuate the impact of adversarial nodes. On the other hand, adversarial training methods involve integrating adversarial examples into the training process. By training the model on both original and adversarial data, GNN models learn to improve their performance in the presence of adversarial perturbations [128]. To further mitigate the effects of some types of adversarial attacks, adding regularization terms to the loss function of the model can help improve the model’s robustness by discouraging complex models that could overfit the perturbed data.

5.4. Generalization

One of the key challenges in deploying GraphNDTs for cost-effective trials in networks is ensuring their generalizability across various scenarios and configurations, including disruptive events that may lead to service disruptions. In zero-tolerance systems, exploring these disruptive scenarios is impossible. As a data-driven approach, GraphNDTs rely on training data to make accurate predictions, but without access to data from such scenarios, they may struggle to accurately predict and simulate disruptions in networking systems.

To address this challenge, two potential solutions can enhance the generalizability of GraphNDTs. On the one hand, we can train GraphNDTs on additional data generated from simulations or testbeds that simulate a wide range of network scenarios and configurations [109,110,140]. By being exposed to diverse simulated disruptive events, GraphNDTs can learn to recognize patterns and dynamics associated with service disruptions. Training on additional data helps GraphNDTs capture the complexities of disruptive scenarios and improves their ability to generalize to unseen disruptions in zero-tolerance systems. After that, we can leverage transfer learning techniques to finetune the pre-trained GraphNDTs to the actual network systems being twinned. This fine-tuning process allows GraphNDT ability to adapt its predictions to the specific dynamics and characteristics of the target system, leveraging the prior knowledge acquired during training on the additional data. On the other hand, the aggregation of different GraphNDTs can also contribute to generalization by capturing the knowledge of the same application (e.g., routing, network slicing) across different networking systems. However, personalization becomes a key challenge due to the varying characteristics of different networking systems, which can be addressed by employing FL techniques. FL enables collaborative learning and model aggregation, preserving the privacy of individual network systems [129,130,131] while allowing GraphNDTs benefit from a broader understanding of various configurations.

6. Conclusions

In this article, we delved into the vast possibilities afforded by GNNs and DT for upcoming network generations. This work was motivated by the lack of a comprehensive survey on the use of GNN and DT within Next-generation networks. To bridge this gap, we first provided an updated survey on the application of DT and GNN for Next-generation networks. Then, we introduced the recent advances and integration of GNN within DT accompanied by highlighting its principal benefits and case studies. Finally, we identified key research challenges and possible directions for further investigation. We believe that this article will stimulate more attention in this emerging area and encourage more research efforts toward the realization of GNN with digital twins.