arXiv:2604.22781cs.LGcs.AI2026-04

提出双向门控注意力聚合器,提升网络告警预测的时序建模能力。

BiTA: Bidirectional Gated Recurrent Unit-Transformer Aggregator in a Temporal Graph Network Framework for Alert Prediction in Computer Networks

论文配图:BiTA: Bidirectional Gated Recurrent Unit-Transformer Aggregator in a Temporal Graph Network Framework for Alert Prediction in Computer Networks
图 1 · 摘自论文原文
  • 设计双向门控机制融合序列依赖与长程上下文关系
  • 在真实数据集上显著提升AUC、平均精度等关键指标
  • 适合需要实时威胁感知的网络安全系统部署

主动预测计算机网络中的告警对缓解不断演化的网络攻击至关重要。时间图神经网络(TGN)为建模动态交互提供了理论框架,但现有方法多依赖单向或单一机制的时间聚合,难以捕捉真实攻击行为中常见的递归性、多尺度时序模式。本文提出BiTA,一种在时间图网络框架内用于告警预测的双向门控循环单元-变压器聚合器。通过联合编码节点时序邻域内的双向序列依赖和长程上下文关系,重设计了时间聚合函数,实现多尺度互补时序推理,同时保持原始TGN的记忆与消息传递结构。在真实告警数据集上的评估表明,相比现有先进模型,BiTA在曲线下面积(AUC)、平均精度、均倒数排名及类别级预测准确率等方面均有显著提升。无论在归纳还是转导设置下,其性能均优于基线方法,展现出在动态网络环境中的鲁棒性与泛化能力。BiTA是一种可扩展且可解释的实时威胁预测框架,为构建更智能、自适应的入侵检测系统提供支持。

原文摘要 · Abstract (English)

Proactive alert prediction in computer networks is critical for mitigating evolving cyber threats and enabling timely defensive actions. Temporal Graph Neural Networks (TGNs) provide a principled framework for modeling time-evolving interactions; however, existing TGN-based methods predominantly rely on unidirectional or single-mechanism temporal aggregation, which limits their ability to capture recursive, multi-scale temporal patterns commonly observed in real-world attack behaviors. In this paper, we propose BiTA, a Bidirectional Gated Recurrent Unit-Transformer Aggregator for temporal graph learning. Rather than introducing a deeper or higher-capacity model, BiTA redesigns the temporal aggregation function within the TGN framework by jointly encoding bidirectional sequential dependencies and long-range contextual relations over each node's temporal neighborhood. This aggregation strategy enables complementary temporal reasoning at different scales while preserving the original TGN memory and message-passing structure. We evaluate BiTA on real-world alert datasets, demonstrating significant improvements in key performance metrics such as area under the curve, average precision, mean reciprocal rank, and per-category prediction accuracy when compared to state-of-the-art temporal graph models. BiTA outperforms baseline methods under both transductive and inductive settings, highlighting its robustness and generalization capabilities in dynamic network environments. BiTA is a scalable and interpretable framework for real-time cyber threat anticipation, paving the way toward more intelligent and adaptive intrusion detection systems.

告警预测时序图神经网络网络安全双向建模

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。