PPT-GNN: a practical pre-trained temporal graph neural network for intrusion detection
Recent works have demonstrated the potential of Graph Neural Networks (GNN) for network intrusion detection. Despite their advantages, a significant gap persists between real-world scenarios, where detection speed is critical, and existing proposals, which operate on large graphs representing severa...
| Autor: | |
|---|---|
| Tipo de recurso: | tesis de maestría |
| Fecha de publicación: | 2024 |
| País: | España |
| Institución: | Universitat Politècnica de Catalunya (UPC) |
| Repositorio: | UPCommons. Portal del coneixement obert de la UPC |
| Idioma: | inglés |
| OAI Identifier: | oai:upcommons.upc.edu:2117/417495 |
| Acceso en línea: | https://hdl.handle.net/2117/417495 |
| Access Level: | acceso abierto |
| Palabra clave: | Neural networks (Computer science) Computer security Artificial intelligence Computer networks Xarxes neuronals de gràfics Detecció d'intrusions a la xarxa Seguretat de la xarxa Intel·ligència artificial Xarxes d'ordinadors Monitorització de xarxes Graph Neural Networks Network Intrusion Detection Network security Computer Networks Network monitoring Xarxes neuronals (Informàtica) Seguretat informàtica Ordinadors, Xarxes d' Àrees temàtiques de la UPC::Informàtica::Seguretat informàtica Àrees temàtiques de la UPC::Informàtica::Intel·ligència artificial |
| Sumario: | Recent works have demonstrated the potential of Graph Neural Networks (GNN) for network intrusion detection. Despite their advantages, a significant gap persists between real-world scenarios, where detection speed is critical, and existing proposals, which operate on large graphs representing several hours of traffic. This gap results in unrealistic operational conditions and impractical detection delays. Moreover, existing models do not generalize well across different networks, hampering their deployment in production environments. To address these issues, we introduce PPT-GNN, a practical spatio-temporal GNN for intrusion detection. PPT-GNN enables near real-time predictions, while better capturing the spatio-temporal dynamics of network attacks. PPT-GNN employs self-supervised pre-training for improved performance and reduced dependency on labeled data. We evaluate PPT-GNN on three public datasets and show that it significantly outperforms state-of-the-art models, such as E-ResGAT and E-GraphSAGE, with an average accuracy improvement of 10.38 %. Finally, we show that a pre-trained PPTGNN can easily be fine-tuned to unseen networks with minimal labeled examples. This highlights the potential of PPTGNN as a general, large-scale pre-trained model that can effectively operate in diverse network environments. |
|---|