Search papers, labs, and topics across Lattice.
This paper introduces a self-supervised GNN-based framework for network intrusion detection that incorporates real timestamps to enhance the modeling of temporal dependencies among network traffic flows. By constructing temporal graphs and utilizing an E-GraphSAGE and LSTM encoder, the approach effectively captures both temporal and spatial information without relying on computationally expensive attention mechanisms. Experimental results show that this method not only surpasses existing self-supervised models but also achieves performance on par with supervised state-of-the-art methods while ensuring high efficiency.
Self-supervised GNNs leveraging real timestamps can outperform traditional models in network intrusion detection, achieving state-of-the-art results without the overhead of attention mechanisms.
Given their effectiveness in modeling the relational structure among network traffic flows, graph neural networks (GNNs) have been widely adopted in network intrusion detection systems (NIDSs). However, most existing GNN-based NIDS approaches focus on the relational structure of traffic flows, and treat them as temporally independent, which limits their ability to cope with evolving attack behaviors. Moreover, their reliance on supervised or semi-supervised learning often restricts generalization to unseen attacks. To address these limitations, we propose a novel self-supervised GNN-based framework. To the best of our knowledge, the proposed model is among the first self-supervised GNN-based NIDS models to explicitly leverage real timestamps, which provides faithful temporal dependencies for representation learning. We first construct a series of temporal graphs from network traffic flows according to their timestamps, and then employ an E-GraphSAGE and LSTM based encoder to fully extract temporal information and spatial dependencies of network traffic, without introducing time-costly attention mechanisms. A multi-view graph contrastive learning (GCL) scheme is introduced, where temporal, spatial, and feature contrasts are jointly performed to capture temporal continuity, preserve structural consistency, and improve the generalization and robustness of the learned representations, respectively. In addition, a gradient-norm-based adaptive weighting strategy is designed to optimize the contrastive loss weights. Experimental results on four representative NIDS datasets with real timestamps demonstrate that our method significantly outperforms existing self-supervised approaches and achieves performance comparable to the supervised state-of-the-art GNN method, while maintaining high computational efficiency.
