Timestamp-Aware Spatio-Temporal Graph Contrastive Learning for Network Intrusion Detection

2026-06-15

AI Summary

This work addresses the limitations of existing graph neural network–based network intrusion detection systems, which often overlook the temporal dependencies in traffic and suffer from poor generalization to unseen attacks due to reliance on supervised learning. To overcome these issues, we propose a self-supervised temporal graph learning framework that explicitly leverages real-world timestamps to construct temporal graphs—a first in NIDS. The framework integrates an E-GraphSAGE module with an LSTM encoder to efficiently capture spatiotemporal features and introduces a multi-view graph contrastive learning mechanism with gradient-norm adaptive weighting to jointly optimize temporal continuity, structural consistency, and feature robustness. Experiments on four real-world datasets with authentic timestamps demonstrate that our method significantly outperforms current self-supervised approaches and achieves performance comparable to state-of-the-art supervised models, all while maintaining high computational efficiency.

Abstract

Given their effectiveness in modeling the relational structure among network traffic flows, graph neural networks (GNNs) have been widely adopted in network intrusion detection systems (NIDSs). However, most existing GNN-based NIDS approaches focus on the relational structure of traffic flows, and treat them as temporally independent, which limits their ability to cope with evolving attack behaviors. Moreover, their reliance on supervised or semi-supervised learning often restricts generalization to unseen attacks. To address these limitations, we propose a novel self-supervised GNN-based framework. To the best of our knowledge, the proposed model is among the first self-supervised GNN-based NIDS models to explicitly leverage real timestamps, which provides faithful temporal dependencies for representation learning. We first construct a series of temporal graphs from network traffic flows according to their timestamps, and then employ an E-GraphSAGE and LSTM based encoder to fully extract temporal information and spatial dependencies of network traffic, without introducing time-costly attention mechanisms. A multi-view graph contrastive learning (GCL) scheme is introduced, where temporal, spatial, and feature contrasts are jointly performed to capture temporal continuity, preserve structural consistency, and improve the generalization and robustness of the learned representations, respectively. In addition, a gradient-norm-based adaptive weighting strategy is designed to optimize the contrastive loss weights. Experimental results on four representative NIDS datasets with real timestamps demonstrate that our method significantly outperforms existing self-supervised approaches and achieves performance comparable to the supervised state-of-the-art GNN method, while maintaining high computational efficiency.

Problem

• network intrusion detection
• graph neural networks
• temporal dependencies
• self-supervised learning
• unseen attacks

Innovation

• self-supervised learning
• timestamp-aware
• spatio-temporal graph
• graph contrastive learning
• network intrusion detection