关键词: 网络流量检测, 图神经网络, 对比学习, 自监督表征学习, InfoNCE损失函数, 图表示学习, 深度学习, 图数据增强

Abstract:

Traditional methods for detecting network traffic anomalies suffer from issues such as neglecting network topology and high costs associated with acquiring labeled data, leading to lower model accuracy and generalization. This study proposes a detection approach based on graph neural networks and self-supervised learning. Based on the characteristics of network traffic data, the self-supervised graph comparison learning task is constructed, and the traffic graph is enhanced by edge feature transformation and edge masking to generate comparison samples. The graph encoder based on GraphSAGE(Graph SAmple and aggreGatE)is improved to make full use of correlation to enrich the feature representation of nodes, and the parameters of the graph encoder are trained with InfoNCE loss function suitable for comparative learning to achieve self-learning feature representation, get rid of the dependence on network traffic label data, and improve the accuracy of network abnormal traffic detection. The experimental results show that the proposed model performs well in detecting abnormal network traffic without label data, with F1 values reaching 92.64% and 90.97% on two public data sets, respectively.

Key words: network intrusion detection, graph neural networks, contrastive learning, self-supervised learning, InfoNCE loss function, graph representation learning, deep learning, graph data enhancement