提出双向门控注意力聚合器,提升网络告警预测的时序建模能力。
BiTA: Bidirectional Gated Recurrent Unit-Transformer Aggregator in a Temporal Graph Network Framework for Alert Prediction in Computer Networks

- 设计双向门控机制融合序列依赖与长程上下文关系
- 在真实数据集上显著提升AUC、平均精度等关键指标
- 适合需要实时威胁感知的网络安全系统部署
主动预测计算机网络中的告警对缓解不断演化的网络攻击至关重要。时间图神经网络(TGN)为建模动态交互提供了理论框架,但现有方法多依赖单向或单一机制的时间聚合,难以捕捉真实攻击行为中常见的递归性、多尺度时序模式。本文提出BiTA,一种在时间图网络框架内用于告警预测的双向门控循环单元-变压器聚合器。通过联合编码节点时序邻域内的双向序列依赖和长程上下文关系,重设计了时间聚合函数,实现多尺度互补时序推理,同时保持原始TGN的记忆与消息传递结构。在真实告警数据集上的评估表明,相比现有先进模型,BiTA在曲线下面积(AUC)、平均精度、均倒数排名及类别级预测准确率等方面均有显著提升。无论在归纳还是转导设置下,其性能均优于基线方法,展现出在动态网络环境中的鲁棒性与泛化能力。BiTA是一种可扩展且可解释的实时威胁预测框架,为构建更智能、自适应的入侵检测系统提供支持。
原文摘要 · Abstract (English)
Proactive alert prediction in computer networks is critical for mitigating evolving cyber threats and enabling timely defensive actions. Temporal Graph Neural Networks (TGNs) provide a principled framework for modeling time-evolving interactions; however, existing TGN-based methods predominantly rely on unidirectional or single-mechanism temporal aggregation, which limits their ability to capture recursive, multi-scale temporal patterns commonly observed in real-world attack behaviors. In this paper, we propose BiTA, a Bidirectional Gated Recurrent Unit-Transformer Aggregator for temporal graph learning. Rather than introducing a deeper or higher-capacity model, BiTA redesigns the temporal aggregation function within the TGN framework by jointly encoding bidirectional sequential dependencies and long-range contextual relations over each node's temporal neighborhood. This aggregation strategy enables complementary temporal reasoning at different scales while preserving the original TGN memory and message-passing structure. We evaluate BiTA on real-world alert datasets, demonstrating significant improvements in key performance metrics such as area under the curve, average precision, mean reciprocal rank, and per-category prediction accuracy when compared to state-of-the-art temporal graph models. BiTA outperforms baseline methods under both transductive and inductive settings, highlighting its robustness and generalization capabilities in dynamic network environments. BiTA is a scalable and interpretable framework for real-time cyber threat anticipation, paving the way toward more intelligent and adaptive intrusion detection systems.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。