Scholarlink

<p>The rapid expansion of Internet of Things networks has made the detection of anomalies in network nodes a critical task, directly impacting the security of the network. Graph Neural Networks, as powerful deep learning models based on graph structures, have garnered intensive attention for Network Intrusion Detection Systems(NIDS). However, existing GNN-based intrusion detection approaches often rely on labeled traffic data, a limitation that reduces their various applicability to potentially complex attacks. To address this issue, this paper introduces a novel anomaly intrusion detection model, Anomal-EF, which identifies the specific types of network flows in an unsupervised manner. First, an encoder was designed by using Multi-head self-attention module for more precise node aggregation. It can dynamically adjust the influence weights of neighboring nodes based on their features, positions and relationships with the central node, thereby effectively overcoming the problem that traditional average aggregation methods ignore the differences between nodes. Then, a self-supervised module utilizes the contrastive learning mechanism, by minimizing the Wasserstein distance between positive sample pairs, to ensure that the embeddings of normal nodes and their neighbors are as close as possible, thereby forming stable clusters. Beyond detecting anomalous nodes, Anomal-EF can further categorize the types of anomalies. Experiments conducted on the IoT intrusion detection datasets (NF-BoT-IoT-v2 and NF-CSE-CIC-IDS2018-v2) and compare Anomal-EF with the state-of-the-art supervised and self-supervised models.</p>

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

Anomal-EF: self-supervised learning and multi-head attention based anomalous node detection in IoT networks

  • 期刊论文

  • 发表日期：

    2026年7月23日

查看全文
  • Gaojuan Fan,
  • Qingyi Huang,
  • Junchao Ma,
  • Hafiz Muhammad Sanaullah Badar,
  • Chongsheng Zhang,
  • Ke Yuan

摘要

The rapid expansion of Internet of Things networks has made the detection of anomalies in network nodes a critical task, directly impacting the security of the network. Graph Neural Networks, as powerful deep learning models based on graph structures, have garnered intensive attention for Network Intrusion Detection Systems(NIDS). However, existing GNN-based intrusion detection approaches often rely on labeled traffic data, a limitation that reduces their various applicability to potentially complex attacks. To address this issue, this paper introduces a novel anomaly intrusion detection model, Anomal-EF, which identifies the specific types of network flows in an unsupervised manner. First, an encoder was designed by using Multi-head self-attention module for more precise node aggregation. It can dynamically adjust the influence weights of neighboring nodes based on their features, positions and relationships with the central node, thereby effectively overcoming the problem that traditional average aggregation methods ignore the differences between nodes. Then, a self-supervised module utilizes the contrastive learning mechanism, by minimizing the Wasserstein distance between positive sample pairs, to ensure that the embeddings of normal nodes and their neighbors are as close as possible, thereby forming stable clusters. Beyond detecting anomalous nodes, Anomal-EF can further categorize the types of anomalies. Experiments conducted on the IoT intrusion detection datasets (NF-BoT-IoT-v2 and NF-CSE-CIC-IDS2018-v2) and compare Anomal-EF with the state-of-the-art supervised and self-supervised models.