Source-linked AI summary
Anomal-E: A Self-Supervised Network Intrusion Detection System based on Graph Neural Networks
Evan Caville, Wai Weng Lo, Siamak Layeghy, Marius Portmann
TL;DR
Existing NIDSs often depend on labelled traffic, which is scarce and limits handling of unseen attacks, while network-flow topology and edge information remain important. Anomal-E addresses this with a self-supervised GNN that learns edge-aware embeddings and reports improved detection over raw features and baselines on two benchmark datasets. The paper also identifies scope boundaries through benchmark evaluation and planned testing on real traffic.
Problem
NIDS research commonly relies on labelled traffic even though real-world network traffic is severely limited and rarely labelled, especially for zero-day attacks.
Method
Anomal-E combines E-GraphSAGE and modified DGI to learn self-supervised edge embeddings from network-flow edge features and graph topology, followed by traditional anomaly detection.
Results
Anomal-E achieved the highest detection accuracy across all reported metrics on NF-UNSW-NB15-v2 and significantly improved over raw features and baseline methods across two benchmark NIDS datasets.
Takeaways & Limitations
The evaluation demonstrates the potential of self-supervised, edge-aware GNN embeddings for network intrusion detection and generalisation across benchmark datasets.
Takeaways & Limitations
The evaluation uses benchmark datasets, and the authors identify real network traffic as future evaluation needed beyond synthetic network conditions.
Abstract
from arXiv · showhide
This paper investigates Graph Neural Networks (GNNs) application for self-supervised network intrusion and anomaly detection. GNNs are a deep learning approach for graph-based data that incorporate graph structures into learning to generalise graph representations and output embeddings. As network flows are naturally graph-based, GNNs are a suitable fit for analysing and learning network behaviour. The majority of current implementations of GNN-based Network Intrusion Detection Systems (NIDSs) rely heavily on labelled network traffic which can not only restrict the amount and structure of input traffic, but also the NIDSs potential to adapt to unseen attacks. To overcome these restrictions, we present Anomal-E, a GNN approach to intrusion and anomaly detection that leverages edge features and graph topological structure in a self-supervised process. This approach is, to the best our knowledge, the first successful and practical approach to network intrusion detection that utilises network flows in a self-supervised, edge leveraging GNN. Experimental results on two modern benchmark NIDS datasets not only clearly display the improvement of using Anomal-E embeddings rather than raw features, but also the potential Anomal-E has for detection on wild network traffic.
1. Introduction
Anomal-E addresses the limits of label-dependent NIDSs by using a self-supervised GNN that learns from network-flow edge features and topology. Experiments on benchmark datasets report improvements over raw features and baseline methods.
- Supervised NIDS training is often impractical because network traffic is rarely labelled, particularly for zero-day attacks.
- Network-flow topology can expose sophisticated attacks by representing hosts as nodes and flows or packets as edges, including lateral-movement paths.
- Anomal-E combines E-GraphSAGE, modified DGI, and traditional anomaly detectors to generate edge embeddings for intrusion detection.E-GraphSAGE captures edge features and topology, while modified DGI supports self-supervised learning through local mutual edge information.
- Anomal-E uses self-supervised learning to incorporate edge features and topological patterns without requiring labelled data.
- On two benchmark NIDS datasets, Anomal-E showed significant improvements over raw features and baseline graph-learning methods.
2. Related Work
Prior work includes graph embeddings, unsupervised anomaly detection, clustering, autoencoders, and self-supervised GNNs applied outside NIDSs. The reviewed approaches face limitations involving unseen nodes, outdated datasets, false alarms, or application scope.
- 2.1. Graph-Based Approaches for Network Intrusion /Anomaly Detection: Traditional graph embeddings for NIDSs can fail to generalise to unseen IP addresses and port numbers because they are transductive.
- 2.2. Alternate Approaches for Network Intrusion /Anomaly Detection: Unsupervised NIDS research has evaluated algorithms including isolation forests, one-class SVMs, clustering, density-based methods, and autoencoders.
- 2.2. Alternate Approaches for Network Intrusion /Anomaly Detection: The KDD’99 dataset used in one clustering study is over two decades old and does not reflect the current sophistication of network attacks.
- 2.2. Alternate Approaches for Network Intrusion /Anomaly Detection: Four anomaly-detection algorithms evaluated on NSL-KDD achieved accuracies from 57.81% to 78.06%, with an overall false-alarm rate of 20%.
- 2.2. Alternate Approaches for Network Intrusion /Anomaly Detection: Self-supervised GNN methods in the reviewed literature addressed knowledge tracing, attributed network clustering, or heterogeneous information networks rather than NIDSs.
3. Background
Graph neural networks use graph topology and message passing to learn embeddings, making them suitable for network traffic represented as communicating hosts and flows. The section introduces GraphSAGE, E-GraphSAGE, and Deep Graph Infomax as foundations for Anomal-E.
- Graph neural networks: GNNs use message passing over graph topology to learn low-dimensional representations for graph-based data.They aggregate neighbouring information to update node representations and produce embeddings.
- Graph neural networks: Network traffic maps naturally to graphs, with IP addresses as nodes and packet or flow communications as edges.This representation supports analysing topological patterns relevant to network intrusion and anomaly detection.
- GraphSAGE: GraphSAGE samples and aggregates neighbouring node information across k-hop neighbourhoods to generate node embeddings while reducing computational cost.Its aggregation can use functions such as mean, pooling, or LSTM-based networks.
- E-GraphSAGE: E-GraphSAGE extends GraphSAGE by propagating edge features and producing edge embeddings for classifying network flows as benign or attack traffic.This addresses datasets dominated by network-flow features rather than node features.
- E-GraphSAGE: E-GraphSAGE aggregates k-hop edge features with neighbouring node embeddings to collect both flow information and graph topological patterns.The final node representations are produced at depth K, while edge embeddings are formed from node representations.
- Deep Graph Infomax: Deep Graph Infomax learns node representations by maximising mutual information between local patch representations and a global graph representation.It trains an encoder using the original graph and a corrupted graph generated by a corruption function.
4. Anomal-E
Anomal-E combines E-GraphSAGE with modified DGI to learn self-supervised edge embeddings from network graphs, which are then supplied to unsupervised anomaly detectors. The pipeline converts flow data into training and testing graphs, tunes the encoder using true and corrupted embeddings, and evaluates PCA, IF, CBLOF, and HBOS on test embeddings.
- Core approach: Anomal-E combines E-GraphSAGE and DGI-derived graph representation learning to generate edge embeddings without relying on labels.The approach targets existing graph-based NIDS limitations involving supervised learning and node embeddings.
- Graph construction: Flow data are converted into training and testing graphs, with network endpoints as nodes and flows as edges.The raw NetFlow format contains information such as addresses, ports, packet counts, and byte counts before graph conversion.
- Anomaly detection: After encoder training, edge embeddings from the training graph fit PCA, IF, CBLOF, and HBOS, which are then evaluated using test edge embeddings.Experiments also consider training data with attack samples omitted or included, with grid searches for each detector.
- Self-supervised training: E-GraphSAGE extracts true and corrupted edge embeddings, while a corruption function randomly shuffles edge features among edges in the real graph.The encoder uses a one-layer model because the base DGI method benefits from wider rather than deeper models.
- Self-supervised training: A discriminator compares edge embeddings with a real global graph summary, and binary cross-entropy optimization increases scores for true embeddings while decreasing scores for corrupted ones.This objective maximizes mutual information between edge representations and the whole-graph summary.
5. Experiments and Results
Experiments on two benchmark NetFlow intrusion-detection datasets compare raw features with Anomal-E embeddings under non-contaminated and 4% contaminated training. Across datasets and anomaly detectors, Anomal-E generally improves macro F1 and other metrics, while outperforming or generalising better than node-feature baselines.
- Experimental setup: The evaluation uses two benchmark NetFlow datasets, 70% training and 30% testing, with non-contaminated and 4% contaminated training conditions.The datasets were downsampled to 10% of their original size; contamination experiments included 4% attack samples during training.
- Experimental setup: Macro F1, accuracy, and detection rate compare anomaly detection from raw features against Anomal-E embeddings.Macro F1 is emphasized because it addresses potential class imbalance, while PCA, IF, CBLOF, and HBOS serve as anomaly detectors.
- NF-UNSW-NB15-v2: 88.45% was the best NF-UNSW-NB15-v2 macro F1-score with Anomal-E, versus 71.34% using raw features without contamination.Anomal-E embeddings improved macro F1 for every tested anomaly-detection method in this condition.
- NF-CSE-CIC-IDS2018-v2: On NF-CSE-CIC-IDS2018-v2, Anomal-E embeddings outperformed raw features for accuracy and macro F1 without contamination and improved results across all algorithms with contamination.Non-contaminated Anomal-E results were stronger than contaminated Anomal-E results, but contaminated embeddings still exceeded non-contaminated raw-feature results on average.
- Baseline comparison: Across baseline comparisons, Anomal-E generally generalised better across both datasets than GraphSAGE and DGI, despite isolated cases where GraphSAGE slightly led on one dataset.With contamination, Anomal-E-CBLOF and Anomal-E-HBOS averaged 93.04% and 91.89% macro F1, compared with 72.07% and 74.69% for the corresponding GraphSAGE combinations.
6. Conclusion
The paper concludes that Anomal-E is a self-supervised GNN using edge features for network intrusion and anomaly detection. Results on two benchmark datasets show improved attack identification and generalisation over raw features and baseline methods, while real-network evaluation remains planned.
- Contribution: Anomal-E combines self-supervised GNN learning with edge features for network intrusion and anomaly detection.The conclusion presents this combination as the paper’s central contribution.
- Evidence: Experiments on two benchmark NIDS datasets establish benefits from Anomal-E embeddings for attack identification.The comparison includes raw features and baseline methods.
- Implications: Anomal-E shows the ability to generalise across different datasets and performs exceptionally well compared with baseline methods.The conclusion frames this as evidence of the potential of self-supervised GNNs for NIDSs.
- Scope: Evaluation on real network traffic remains future work because the reported experiments use benchmark datasets.The authors also plan further investigation beyond the current evaluation.