Graph-based Intrusion Detection System Using General Behavior Learning.

With the flood of different attacks in the network environment, the Network-based Intrusion Detection System (NIDS) has become an important tool to ensure information security. The quick development of neural networks has made it one of the main approaches for the implementation of NIDS. However, nowadays more sophisticated attacks have appeared and the analysis of a single traffic cannot ensure the detection of the attack. To make full use of the network traffic data, we proposed a flow-based NIDS using Graph Neural Network (GNN) to explore the structural information of the network and the correlation between traffics. We represented the traffic data in graph structure to capture the topological information and aggregated the general behavior of each node. Moreover, we introduced a discriminator to correct the data imbalance and to improve the flow representations. We evaluated our proposed model on three benchmark datasets. The experiment results showed that our model had improvements of performance in both binary classification tasks and multi-class classification tasks, which demonstrates the value of graph structure in the detection of some attacks.