NeFut Logo NeFut
Admin Login

[CS.AI] Revolutionary Timestamp-Aware Graph Contrastive Learning in NIDS

Published at: 2026-06-18 22:00 Last updated: 2026-06-20 13:47
#algorithm #AI #Graph

Graph Neural Networks (GNNs) have been widely adopted in Network Intrusion Detection Systems (NIDSs) due to their effectiveness in modeling the relational structure among network traffic flows. However, most existing GNN-based NIDS approaches focus on the relational structure of traffic flows, treating them as temporally independent, which limits their ability to cope with evolving attack behaviors. Furthermore, their reliance on supervised or semi-supervised learning often restricts generalization to unseen attacks.\n\nTo address these limitations, we propose a novel self-supervised GNN-based framework. To the best of our knowledge, our model is among the first self-supervised GNN-based NIDS models to explicitly leverage real timestamps, providing faithful temporal dependencies for representation learning. We first construct a series of temporal graphs from network traffic flows according to their timestamps, and then employ an E-GraphSAGE and LSTM-based encoder to fully extract temporal information and spatial dependencies of network traffic, without introducing time-costly attention mechanisms.\n\nA multi-view graph contrastive learning (GCL) scheme is introduced, where temporal, spatial, and feature contrasts are jointly performed to capture temporal continuity, preserve structural consistency, and improve the generalization and robustness of the learned representations, respectively. Additionally, a gradient-norm-based adaptive weighting strategy is designed to optimize the contrastive loss weights.\n\nExperimental results on four representative NIDS datasets with real timestamps demonstrate that our method significantly outperforms existing self-supervised approaches and achieves performance comparable to the supervised state-of-the-art GNN method while maintaining high computational efficiency.\n\nBlogger's Review: The proposed timestamp-aware graph contrastive learning method effectively addresses the oversight of temporal dependencies in traditional NIDS, enhancing model generalization through self-supervised learning. Its innovative encoder design and multi-view contrastive learning strategy provide new insights for future research in network security.

Original Source: https://arxiv.org/abs/2606.17109

[h] Back to Home