基於圖神經網路之新型網路入侵檢測： E-SageGAT架構與集成框架

Abstract

本研究旨在解決偵測網絡入侵的挑戰性任務，以應對日益複雜和精密的網絡攻擊。儘管傳統機器學習方法已廣泛應用於網絡攻擊檢測並取得了可觀的成果，但對於網絡流量數據的內在拓撲結構卻鮮有研究。因此，我們提出了一個基於圖神經網絡（GNN）的新型集成學習框架Ensemble-GNN以及一種具有創新性的模型架構E-SageGAT，該模型在圖的邊層級應用了自注意力機制，使得模型更能夠彈性地聚合鄰居訊息。這些創新性的貢獻有助於挖掘網絡結構信息和流量相關性，從而提高檢測惡意活動的準確性。在應用於三個基準數據集時，隨機指派節點導致節我們的方法在加權F1分數上比現有方法（E-GraphSAGE / E-ResGAT / XGBoost）提高了1-2%，而集成學習框架則進一步提高了2-3%的性能。另外透過保留原始拓撲結構並將網絡數據包流量表格數據轉換為多向圖，我們提出的方法準確地揭示了潛在的網絡流量結構，為網絡入侵檢測領域的重大進步奠定了基礎。

關鍵詞：圖神經網絡、集成學習、網絡入侵檢測、網絡安全

This work aims to addresses the challenging tasks for robust Network Intrusion Detection Systems (NIDS) capable of tackling increasingly sophisticated and complex cyberattacks. Although the conventional machine learning methods have been widely applied to cyberattack detections and show promising results, little attention has been given to the inherent topological structure of network flow data. Therefore, we present a novel ensemble framework for Graph Neural Networks (GNN) and a revolutionary model architecture, E-SageGAT, which applies self-attention mechanisms at the edge level of graphs. These innovative contributions empower the exploration of the structural information of networks and traffic correlations, thereby enhancing the accuracy of detecting malicious activities. When applied to three benchmark datasets, our approach outperforms existing methods (E-GraphSAGE/E-ResGAT/XGBoost) with a 1-2% improvement in weighted F1-score, while the ensemble framework further improves performance by 2-3%. By retaining the original topological structure and transforming network packet flow tabular data into multi-directed graphs, our proposed methods accurately reveal the latent network flow structures and set the stage for significant progress in the field of network intrusion detection.

Keywords: Graph Neural Networks, Ensemble learning, Network Intrusion Detection, Cyber Security