CAGN-GAT Fusion: A Hybrid Contrastive Attentive Graph Neural Network for Network Intrusion Detection

2025-03-02

AI Summary

To address network intrusion detection under resource-constrained conditions—characterized by short sequences and severe class imbalance—this paper proposes CAGN-GAT, a hybrid framework integrating contrastive learning with Graph Attention Networks (GAT). It introduces a novel adaptive graph construction mechanism based on edge perturbation and feature masking, enabling lightweight and robust anomaly representation learning. The method demonstrates the feasibility of Graph Neural Networks (GNNs) in ultra-low-resource settings, validated on merely 5,000 samples. Evaluated on four benchmark datasets—KDD-CUP1999, NSL-KDD, UNSW-NB15, and CICIDS2017—CAGN-GAT achieves superior recall and F1-score compared to both conventional models and state-of-the-art GNN-based approaches, while also attaining higher inference efficiency. This work establishes a deployable paradigm for edge-side intrusion detection.

Technology Category

• Machine Learning: Graph-based Machine Learning
• Data Mining & Knowledge Management: Graph Mining, Social Network Analysis & Community
• Computer Vision: Generative Adversarial Networks (GANs) for Vision

Application Category

• Graph Algorithms and Modeling for the Web: Graph neural networks and deep learning approaches for Web-related graphs
• Web Mining and Content Analysis: Large pretrained models with web data
• Security and Privacy: Large-scale security measurements

Abstract

Cybersecurity threats are growing, making network intrusion detection essential. Traditional machine learning models remain effective in resource-limited environments due to their efficiency, requiring fewer parameters and less computational time. However, handling short and highly imbalanced datasets remains challenging. In this study, we propose the fusion of a Contrastive Attentive Graph Network and Graph Attention Network (CAGN-GAT Fusion) and benchmark it against 15 other models, including both Graph Neural Networks (GNNs) and traditional ML models. Our evaluation is conducted on four benchmark datasets (KDD-CUP-1999, NSL-KDD, UNSW-NB15, and CICIDS2017) using a short and proportionally imbalanced dataset with a constant size of 5000 samples to ensure fairness in comparison. Results show that CAGN-GAT Fusion demonstrates stable and competitive accuracy, recall, and F1-score, even though it does not achieve the highest performance in every dataset. Our analysis also highlights the impact of adaptive graph construction techniques, including small changes in connections (edge perturbation) and selective hiding of features (feature masking), improving detection performance. The findings confirm that GNNs, particularly CAGN-GAT Fusion, are robust and computationally efficient, making them well-suited for resource-constrained environments. Future work will explore GraphSAGE layers and multiview graph construction techniques to further enhance adaptability and detection accuracy.

Problem

• Addresses growing cybersecurity threats with network intrusion detection.
• Handles short, imbalanced datasets using CAGN-GAT Fusion model.
• Improves detection performance with adaptive graph construction techniques.

Innovation

• Fusion of Contrastive Attentive Graph Network and Graph Attention Network
• Adaptive graph construction with edge perturbation and feature masking
• Evaluation on imbalanced datasets with 5000 samples