Abstract:

[Objective] As the network environment becomes increasingly complex, the threats it faces are also becoming increasingly serious. As one of the important means of Active Defense for network security, intrusion detection needs to provide more robust and effective detection methods to meet these challenges. [Methods] The graph neural network performs excellently in anomaly detection. This article is based on GATv2 (an improved graph neural network method) to construct the graph neural network method E-ResGATv2 for network intrusion detection. Specifically, we first construct network traffic data into a network traffic graph and then convert the graph into a graph suitable for graph neural network processing through graph transformation to detect intrusion anomaly traffic. We integrate residual learning into the process of graph neural network aggregation information. [Results] The experimental results on two publicly available intrusion detection datasets show that the E-ResGATv2 method has better detection performance than the original graph neural network method and stronger noise resistance. [Conclusions] When achieving similar detection results with machine learning methods, graph neural network methods exhibit stronger anti-interference ability, which is more practical in complex and ever-changing network environments.

Key words: intrusion detection, graph neural network, anomaly detection