arXiv:2503.00961cs.LG2025-03中稿 · 38th International…被引 13

融合对比注意力与图注意力机制,提升小样本网络入侵检测准确率。

CAGN-GAT Fusion: A Hybrid Contrastive Attentive Graph Neural Network for Network Intrusion Detection

  • 结合对比学习与图注意力机制,自适应构建网络结构。
  • 在5000样本小数据集上实现稳定高召回与F1分数。
  • 适合资源受限环境,对数据不平衡有较强鲁棒性。

网络安全威胁持续增长,网络入侵检测日益重要。传统机器学习模型因参数少、计算效率高,在资源受限环境中仍具优势,但处理短样本和高度不平衡数据仍具挑战。本文提出对比注意力图神经网络与图注意力网络的融合模型(CAGN-GAT Fusion),并在四个基准数据集(KDD-CUP-1999、NSL-KDD、UNSW-NB15、CICIDS2017)上与15种其他模型进行对比评估。实验采用固定大小为5000样本的短且比例失衡数据集,确保比较公平。结果表明,尽管在部分数据集未达最高性能,CAGN-GAT Fusion在准确率、召回率和F1分数上均表现稳定且具有竞争力。分析还发现,自适应图构造技术——如边扰动和特征掩码——能有效提升检测性能。研究证实,尤其是该模型,图神经网络在资源受限环境下具备强鲁棒性与高计算效率。未来工作将探索GraphSAGE层与多视图图构造以进一步提升适应性与精度。

原文摘要 · Abstract (English)

Cybersecurity threats are growing, making network intrusion detection essential. Traditional machine learning models remain effective in resource-limited environments due to their efficiency, requiring fewer parameters and less computational time. However, handling short and highly imbalanced datasets remains challenging. In this study, we propose the fusion of a Contrastive Attentive Graph Network and Graph Attention Network (CAGN-GAT Fusion) and benchmark it against 15 other models, including both Graph Neural Networks (GNNs) and traditional ML models. Our evaluation is conducted on four benchmark datasets (KDD-CUP-1999, NSL-KDD, UNSW-NB15, and CICIDS2017) using a short and proportionally imbalanced dataset with a constant size of 5000 samples to ensure fairness in comparison. Results show that CAGN-GAT Fusion demonstrates stable and competitive accuracy, recall, and F1-score, even though it does not achieve the highest performance in every dataset. Our analysis also highlights the impact of adaptive graph construction techniques, including small changes in connections (edge perturbation) and selective hiding of features (feature masking), improving detection performance. The findings confirm that GNNs, particularly CAGN-GAT Fusion, are robust and computationally efficient, making them well-suited for resource-constrained environments. Future work will explore GraphSAGE layers and multiview graph construction techniques to further enhance adaptability and detection accuracy.

入侵检测图神经网络小样本学习安全防御

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。