Towards More Practical Adversarial Attacks on Graph Neural Networks