Network intrusion detection is crucial for cybersecurity. However, traditional methods struggle to effectively capture attack characteristics within complex and evolving attack behaviors, resulting in high false-positive and false negative rates. This paper proposes a temporal graph-based intrusion detection model (T-GIDS), combining the spatial modeling capabilities of Graph Neural Networks (GNN) with the sequential pattern extraction abilities of Recurrent Neural Networks (RNN) for detecting malicious intrusions in network traffic. We construct original network flows into temporal graphs represented as Discrete-Time Temporal Graphs (DTTG), aggregating traffic into a series of graph snapshots using fixed time windows. A spatial GNN Encoder extracts features from each graph snapshot, followed by an RNN-based Temporal Modeling Module that captures the evolving patterns of graph sequences over time. Finally, a fully connected classification layer and Softmax layer output intrusion detection results. Experimental results on the CICIDS2017 dataset demonstrate the model achieves a high overall accuracy of approximately 98.9% in multi-class intrusion detection tasks. By incorporating graph structures and temporal dependencies, the model effectively reduces misclassifications and enhances detection robustness against complex attacks.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Research on Network Intrusion Detection Based on Temporal Graph Neural Networks

  • Pengcheng Su,
  • Yi Tang,
  • Tianming Huang,
  • Qian Zhang

摘要

Network intrusion detection is crucial for cybersecurity. However, traditional methods struggle to effectively capture attack characteristics within complex and evolving attack behaviors, resulting in high false-positive and false negative rates. This paper proposes a temporal graph-based intrusion detection model (T-GIDS), combining the spatial modeling capabilities of Graph Neural Networks (GNN) with the sequential pattern extraction abilities of Recurrent Neural Networks (RNN) for detecting malicious intrusions in network traffic. We construct original network flows into temporal graphs represented as Discrete-Time Temporal Graphs (DTTG), aggregating traffic into a series of graph snapshots using fixed time windows. A spatial GNN Encoder extracts features from each graph snapshot, followed by an RNN-based Temporal Modeling Module that captures the evolving patterns of graph sequences over time. Finally, a fully connected classification layer and Softmax layer output intrusion detection results. Experimental results on the CICIDS2017 dataset demonstrate the model achieves a high overall accuracy of approximately 98.9% in multi-class intrusion detection tasks. By incorporating graph structures and temporal dependencies, the model effectively reduces misclassifications and enhances detection robustness against complex attacks.