Abstract: A method and apparatus for intrusion detection includes generating graph data from a sequence of messages in a communication network. The graph data denotes a node for each message identifier in the sequence of messages and an edge for each pair of consecutive message identifiers. Pair counts are generated for edges in the graph data as a number of times the associated pair of consecutive message identifiers occurs in the sequence. Input feature vectors are generated for nodes in the graph data. The vectors include data content of messages associated with the node and a pair count for each edge connected to the node. The input feature vectors are processed through a first graph neural network, based on the graph data, and then through one or more layers of a classifier to classify the sequence of messages as containing an anomaly or not.