arXiv:2510.07285cs.LGcs.AI2025-10中稿 · version will be pu…被引 2

融合图结构与时间特征,提升少数类入侵检测效果

GTCN-G: A Residual Graph-Temporal Fusion Network for Imbalanced Intrusion Detection

  • 用门控时序卷积+图卷积联合建模网络流的时空特性
  • 在UNSW-NB15和ToN-IoT上准确率超现有模型,尤其提升少数类检出率
  • 适合处理不平衡流量数据的网络安全场景,如异常行为检测

网络威胁日益复杂,流量数据中类别不平衡问题严重制约现代入侵检测系统(IDS)性能。尽管图神经网络(GNN)擅长建模拓扑结构,时序卷积网络(TCN)能有效捕捉时间依赖性,但如何协同利用两者并显式解决数据不平衡仍具挑战。本文提出新型深度学习框架GTCN-G,融合门控时序卷积网络(G-TCN)与图卷积网络(GCN),分别提取网络流的分层时序特征与底层图结构信息。核心创新在于引入残差学习机制,通过图注意力网络(GAT)保留原始特征,有效缓解类别不平衡问题,增强对稀有恶意活动的检测敏感性。在两个公开基准数据集UNSW-NB15和ToN-IoT上的实验表明,所提GTCN-G在二分类与多分类任务中均达到当前最优性能,显著优于基线模型。

原文摘要 · Abstract (English)

The escalating complexity of network threats and the inherent class imbalance in traffic data present formidable challenges for modern Intrusion Detection Systems (IDS). While Graph Neural Networks (GNNs) excel in modeling topological structures and Temporal Convolutional Networks (TCNs) are proficient in capturing time-series dependencies, a framework that synergistically integrates both while explicitly addressing data imbalance remains an open challenge. This paper introduces a novel deep learning framework, named Gated Temporal Convolutional Network and Graph (GTCN-G), engineered to overcome these limitations. Our model uniquely fuses a Gated TCN (G-TCN) for extracting hierarchical temporal features from network flows with a Graph Convolutional Network (GCN) designed to learn from the underlying graph structure. The core innovation lies in the integration of a residual learning mechanism, implemented via a Graph Attention Network (GAT). This mechanism preserves original feature information through residual connections, which is critical for mitigating the class imbalance problem and enhancing detection sensitivity for rare malicious activities (minority classes). We conducted extensive experiments on two public benchmark datasets, UNSW-NB15 and ToN-IoT, to validate our approach. The empirical results demonstrate that the proposed GTCN-G model achieves state-of-the-art performance, significantly outperforming existing baseline models in both binary and multi-class classification tasks.

入侵检测图神经网络时序建模不平衡数据

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。