基于图对比学习的自监督网络流量检测模型

doi:10.16180/j.cnki.issn1007-7820.2025.03.004

Abstract

Abstract:

Traditional methods for detecting network traffic anomalies suffer from issues such as neglecting network topology and high costs associated with acquiring labeled data, leading to lower model accuracy and generalization. This study proposes a detection approach based on graph neural networks and self-supervised learning. Based on the characteristics of network traffic data, the self-supervised graph comparison learning task is constructed, and the traffic graph is enhanced by edge feature transformation and edge masking to generate comparison samples. The graph encoder based on GraphSAGE(Graph SAmple and aggreGatE)is improved to make full use of correlation to enrich the feature representation of nodes, and the parameters of the graph encoder are trained with InfoNCE loss function suitable for comparative learning to achieve self-learning feature representation, get rid of the dependence on network traffic label data, and improve the accuracy of network abnormal traffic detection. The experimental results show that the proposed model performs well in detecting abnormal network traffic without label data, with F1 values reaching 92.64% and 90.97% on two public data sets, respectively.

Key words: network intrusion detection, graph neural networks, contrastive learning, self-supervised learning, InfoNCE loss function, graph representation learning, deep learning, graph data enhancement

CLC Number:

TP393

WANG Ziyi, CHEN Shiping. Self-Supervised Network Intrusion Detection Model Based on Graph Contrastive Learning[J].Electronic Science and Technology, 2025, 38(3): 22-31.

Figures/Tables 16

Figure 1.

Figure 2.

Figure 3.

Figure 4.

Figure 5.

Figure 6.

Table 1.

Table 2.

Table 3.

Table 4.

Table 5.

Table 6.

Figure 7.

Figure 8.

Table 7.

Figure 9.

References 25

[1]	张天奇, 张顺康. 基于主成分分析的实时全网络异常检测方法[J]. 电子科技, 2019, 32(12):17-21.
	Zhang Tianqi, Zhang Shunkang. A real-time full network performance anomaly detection algorithm based on principal component[J]. Electronic Science and Technology, 2019, 32(12):17-21.
[2]	He H, Sun X, He H, et al. A novel multimodal-sequential approach based on multi-view features for network intrusion detection[J]. IEEE Access, 2019, 20(7): 183207-183221.
[3]	Wu P, Guo H. LuNET:A deep neural network for network intrusion detection[C]. Xiamen: IEEE Symposium Series on Computational Intelligence,2019:617-624.
[4]	Rusek K, Suarez Varela J, Almasan P, et al. RouteNet: Leveraging graph neural networks for network modeling and optimization in SDN[J]. IEEE Journal on Selected Areas in Communications, 2020, 39(9):1-7.
[5]	Zhou J, Xu Z, Rush A M, et al. Automating botnet detection with graph neural networks[EB/OL].(2020-3-13) [2023-08-12].https://doi.org/10.48550/arXiv.2003.06344.
[6]	Benaddi H, Jouhari M, Ibrahimi K, et al. Anomaly detection in industrial IoT using distributional reinforcement learning and generative adversarial networks[J]. Sensors, 2022, 22(21):8085-8086.
[7]	Zhu H, Lu J. Graph-based intrusion detection system using general behavior learning[C]. Rio de Janeir: IEEE Global Communications Conference,2022:2621-2626.
[8]	Wang Z, Li Z, Wang J, et al. Network intrusion detection model based on improved BYOL self-supervised learning[J]. Security and Communication Networks, 2021, 47(2):1-23.
[9]	Chen T, Kornblith S, Norouzi M, et al. A simple framework for contrastive learning of visual representations[C]. Online: International Conference on Machine Learning,2020:1597-1607.
[10]	Liu Y, Jin M, Pan S, et al. Graph self-supervised learning:A survey[J]. IEEE Transactions on Knowledge and Data Engineering, 2022, 35(6):5879-5900.
[11]	Sun F Y, Hoffmann J, Verma V, et al. Infograph: Unsupervised and semi-supervised graph-level representation learning via mutual information maximization[EB/OL].(2019-6-31)[2023-08-12].https://doi.org/10.48550/arXiv.1908.01000.
[12]	You Y, Chen T, Sui Y, et al. Graph contrastive learning with augmentations[J]. Advances in Neural Information Processing Systems, 2020, 33(1):5812-5823.
[13]	陈娜, 黄金诚, 李平. 结合对比学习的图神经网络防御方法[J]. 计算机科学与探索, 2023, 17(8):1949-1960.
	Chen Na, Huang Jincheng, Li Ping. Graph neural network defense combined with contrast learning[J]. Journal of Frontiers Computer Science and Technology, 2023, 17(8):1949-1960.
[14]	Hamilton W, Ying Z, Leskovec J. Inductive representation learning on large graphs[J]. Advances in Neural Information Processing Systems, 2017, 30(2):47-51.
[15]	Lo W W, Layeghy S, Sarhan M, et al. E-graphSAGE:A graph neural network based intrusion detection system for IoT[C]. Budapest: NOMS IEEE/IFIP Network Operations and Management Symposium,2022:1-9.
[16]	Hadsell R, Chopra S, Yang L C. Dimensionality reduction by learning an invariant mapping[C]. New York: IEEE Computer Society Conference on Computer Vision and Pattern Recognition,2006:1735-1742.
[17]	Oord A, Li Y, Vinyals O. Representation learning with contrastive predictive coding[EB/OL].(2018-6-10) [2023-08-12].https://doi.org/10.48550/arXiv.1807.03748.
[18]	He Z, Xu X, Deng S. Discovering cluster-based local outliers[J]. Pattern Recognition Letters, 2003, 24(9-10): 1641-1650.
[19]	Xu K, Li C, Tian Y, et al. Representation learning on graphs with jumping knowledge networks[C]. Stockholm: International Cconference on Machine Learning,2018: 5453-5462.
[20]	Sarhan M, Layeghy S, Portmann M. Towards a standard feature set for network intrusion detection system datasets[J]. Mobile Networks and Applications, 2022, 47(7): 1-14.
[21]	邹承明, 陈德. 高维大数据分析的无监督异常检测方法[J]. 计算机科学, 2021, 48(2):121-127.
	Zou Chengming, Chen De. Unsupervised anomaly detection method for high-dimensional big data analysis[J]. Computer Science, 2021, 48(2):121-127.
[22]	Sinha J, Manollas M. Efficient deep CNN-BiLSTM model for network intrusion detection[C]. Xiamen: The Third International Conference on Artificial Intelligence and Pattern Recognition,2020:223-231.
[23]	Chang L, Branco P. Graph-based solutions with residuals for intrusion detection: The modified E-graphSAGE and E-ResGAT algorithms[EB/OL].(2021-11-26)[2023-08-12].https://doi.org/10.48550/arXiv.2111.13597.
[24]	Wang W, Jian S, Tan Y, et al. Robust unsupervised network intrusion detection with self-supervised masked context reconstruction[J]. Computersand Security, 2023, 72(8): 103131-103132.
[25]	Zakroum M, François J, Ghogho M, et al. Self-supervised latent representations of network flows and application to darknet traffic classification[J]. IEEE Access, 2023, 26(4):74-83.

预测	真实
预测	True	False
Positive	TP	FP
Negative	TN	FN

参数	数值
node_features	[39,1,39]
edge_features	[33 464,1,39]
ndim_in	39
ndim_out	128
edim	33 464
全连接层神经元	128

模型	NF-ToN-IoT-v2			NF-UNSW-NB15-v2
模型	Precision/%	Recall/%	F1/%	Precision/%	Recall/%	F1/%
CNN-BiLSTM	73.65	80.63	76.98	70.99	71.56	71.27
E-GraphSAGE	84.95	69.03	74.43	76.57	89.79	81.11
E-ResGAT	87.26	94.76	90.63	85. 05	87.65	86.28
BYOL-NIDS	80.76	82.88	81.77	87.05	88.72	87.86
RUIDS	87.93	93.58	90.67	90.91	89.26	90.08
VGAE	87.16	86.63	86.89	87.63	90.32	88.96
本文	87.69	99.32	92.64	87.25	95.65	90.97

模型	参数量/10⁶
CNN-BiLSTM	0.03
E-GraphSAGE	0.01
E-ResGAT	0.03
BYOL-NIDS	0.18
RUIDS	0.3
VGAE	0.68
本文	0.23

方案	Precision/%	Recall/%	F1/%
w/o图对比学习	84.95	69.03	74.43
w/o对比损失	86.52	87.66	87.08
w/o知识跳跃网络	85.75	72.97	77.84
本文模型	87.69	99.32	92.64

Self-Supervised Network Intrusion Detection Model Based on Graph Contrastive Learning

RichHTML

PDF (PC)

Like

Knowledge

Abstract

Cite this article

share this article

Figures/Tables 16

References 25

Related Articles 15

Metrics

Comments

Recommended 0

方法	NF-ToN-IoT-v2/%	NF-UNSW-NB15-v2/%
BCE Loss	90.23	90.61
Focal Loss	89.18	88.96
InfoNCE Loss	92.64	90.97

[1]	ZHAO Yunfei, XUE Cunjin. A Remote Sensing Image Water Extraction Method by Combining Atrous Convolution and Pooling Models [J]. Electronic Science and Technology, 2025, 38(3): 40-46.
[2]	ZHENG Fangliang, WANG Yannian, LIAN Jihong, RUAN Pei. Face Image Super-Resolution Reconstruction Based on Conditional Priori Swin Transformer [J]. Electronic Science and Technology, 2025, 38(2): 35-41.
[3]	LAI Ying, JU Zhiyong, YE Yuxin. A Vehicle Detection Algorithm Based on Improved YOLOv4 [J]. Electronic Science and Technology, 2025, 38(1): 81-87.
[4]	HE Zhiqiang, SUN Zhanquan. Swin-Transformer-Based Carotid Ultrasound Image Plaque Segmentation [J]. Electronic Science and Technology, 2024, 37(9): 48-56.
[5]	YANG Xiao, LI Gaolei. Persistent Clean-Label Backdoor Attack for Semi-Supervised Graph Node Classification [J]. Electronic Science and Technology, 2024, 37(9): 57-63.
[6]	CAO Chunping, XU Zhihua. A Self-Supervised CT Image Classification Method Incorporating Intra-Slice Semantic and Inter-Slice Structural Features [J]. Electronic Science and Technology, 2024, 37(7): 43-52.
[7]	HE Xing, HUANG Yongming, ZHU Yong. Pavement Pothole Detection Method Based on Improved YOLOv5 [J]. Electronic Science and Technology, 2024, 37(7): 53-59.
[8]	YE Yuxin, JU Zhiyong, LAI Ying. Traffic Sign Detection Algorithm Incorporating Receptive Field Enhancement Module and Attention Mechanism [J]. Electronic Science and Technology, 2024, 37(6): 8-16.
[9]	YUAN Ao, QI Jinpeng, JIA Can, XUE Yuxin, GUO Yangyang. A Classification Method of Time Series Pathological Data Segments Based on Deep Learning [J]. Electronic Science and Technology, 2024, 37(6): 84-91.
[10]	ZHU Zihao, SONG Yan. Lightweight Capsule Network Fusing Attention and Capsule Pooling [J]. Electronic Science and Technology, 2024, 37(5): 1-8.
[11]	XIA Rongcheng, LIU Deer. Vehicle Detection and Analysis in Urban Waterlogging Area Based on Deep Learning [J]. Electronic Science and Technology, 2024, 37(5): 18-24.
[12]	MA Wenjie, ZHANG Xuanxiong. Research on Blind Roads and Obstacle Recognition Algorithm Based on Deep Learning [J]. Electronic Science and Technology, 2024, 37(3): 75-83.
[13]	CUI Jingnan, HUANG Chunyan, LI Yanling. Improvement of YOLOv5s Algorithm for Steel Surface Defect Detection [J]. Electronic Science and Technology, 2024, 37(12): 48-55.
[14]	LIANG Shuifen, GUO Zhiyong. Advancements of Deep Learning in Imaging Diagnosis of Kidney Stone [J]. Electronic Science and Technology, 2024, 37(12): 67-72.
[15]	LI Yunpeng, XI Zhihong. Dynamic Face Recognition System Design Based on RetinaFace and FaceNet [J]. Electronic Science and Technology, 2024, 37(12): 79-86.