Anomal-E: A Self-Supervised Network Intrusion Detection System based on Graph Neural Networks
arXiv:2207.06819 · doi:10.1016/j.knosys.2022.110030
Abstract
This paper investigates Graph Neural Networks (GNNs) application for self-supervised network intrusion and anomaly detection. GNNs are a deep learning approach for graph-based data that incorporate graph structures into learning to generalise graph representations and output embeddings. As network flows are naturally graph-based, GNNs are a suitable fit for analysing and learning network behaviour. The majority of current implementations of GNN-based Network Intrusion Detection Systems (NIDSs) rely heavily on labelled network traffic which can not only restrict the amount and structure of input traffic, but also the NIDSs potential to adapt to unseen attacks. To overcome these restrictions, we present Anomal-E, a GNN approach to intrusion and anomaly detection that leverages edge features and graph topological structure in a self-supervised process. This approach is, to the best our knowledge, the first successful and practical approach to network intrusion detection that utilises network flows in a self-supervised, edge leveraging GNN. Experimental results on two modern benchmark NIDS datasets not only clearly display the improvement of using Anomal-E embeddings rather than raw features, but also the potential Anomal-E has for detection on wild network traffic.
Accepted by Knowledge-Based Systems
References in corpus (2)
Cited by in corpus (6)
- Deep transfer learning for intrusion detection in industrial control networks: A comprehensive review
- Online Self-Supervised Deep Learning for Intrusion Detection Systems
- 3D-IDS: Doubly Disentangled Dynamic Intrusion Detection
- X-CBA: Explainability Aided CatBoosted Anomal-E for Intrusion Detection System
- Few Edges Are Enough: Few-Shot Network Attack Detection with Graph Neural Networks
- Learning Feature Encoder with Synthetic Anomalies for Weakly Supervised Graph Anomaly Detection