arXiv:2606.17109cs.CRcs.AI2026-06

利用真实时间戳增强图神经网络,提升入侵检测对动态攻击的识别能力。

Timestamp-Aware Spatio-Temporal Graph Contrastive Learning for Network Intrusion Detection

  • 基于时间戳构建动态图,结合E-GraphSAGE与LSTM捕捉时空特征
  • 多视角对比学习使模型在四个数据集上超越现有自监督方法
  • 无需注意力机制,兼顾性能与计算效率,适合实时系统部署

鉴于图神经网络(GNN)在建模网络流量间关系结构方面的有效性,其已被广泛应用于网络入侵检测系统(NIDS)。然而,多数现有基于GNN的NIDS方法仅关注流量的关系结构,将其视为时序独立,限制了对演变攻击行为的应对能力。此外,依赖监督或半监督学习常导致对未见攻击的泛化受限。为此,本文提出一种新型自监督GNN框架。据我们所知,该模型是首个显式利用真实时间戳的自监督GNN-based NIDS模型,为表征学习提供了真实的时序依赖性。我们根据流量的时间戳构建一系列时序图,并采用基于E-GraphSAGE和LSTM的编码器,无需引入耗时的注意力机制,充分提取网络流量的时序信息与空间依赖性。设计了多视图图对比学习(GCL)方案,联合执行时序、空间和特征对比,分别捕捉时序连续性、保持结构一致性并提升表征的泛化与鲁棒性。此外,提出基于梯度范数的自适应加权策略优化对比损失权重。在四个具有真实时间戳的代表性NIDS数据集上的实验结果表明,该方法显著优于现有自监督方法,性能接近监督态最先进GNN方法,同时保持高计算效率。

原文摘要 · Abstract (English)

Given their effectiveness in modeling the relational structure among network traffic flows, graph neural networks (GNNs) have been widely adopted in network intrusion detection systems (NIDSs). However, most existing GNN-based NIDS approaches focus on the relational structure of traffic flows, and treat them as temporally independent, which limits their ability to cope with evolving attack behaviors. Moreover, their reliance on supervised or semi-supervised learning often restricts generalization to unseen attacks. To address these limitations, we propose a novel self-supervised GNN-based framework. To the best of our knowledge, the proposed model is among the first self-supervised GNN-based NIDS models to explicitly leverage real timestamps, which provides faithful temporal dependencies for representation learning. We first construct a series of temporal graphs from network traffic flows according to their timestamps, and then employ an E-GraphSAGE and LSTM based encoder to fully extract temporal information and spatial dependencies of network traffic, without introducing time-costly attention mechanisms. A multi-view graph contrastive learning (GCL) scheme is introduced, where temporal, spatial, and feature contrasts are jointly performed to capture temporal continuity, preserve structural consistency, and improve the generalization and robustness of the learned representations, respectively. In addition, a gradient-norm-based adaptive weighting strategy is designed to optimize the contrastive loss weights. Experimental results on four representative NIDS datasets with real timestamps demonstrate that our method significantly outperforms existing self-supervised approaches and achieves performance comparable to the supervised state-of-the-art GNN method, while maintaining high computational efficiency.

入侵检测图神经网络自监督学习时序建模

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。