DIGNN-A: Real-Time Network Intrusion Detection with Integrated Neural Networks Based on Dynamic Graph

The increasing popularity of the Internet and the widespread use of information technology have led to a rise in the number and sophistication of network attacks and security threats. Intrusion detection systems are crucial to network security, playing a pivotal role in safeguarding networks from potential threats. However, in the context of an evolving landscape of sophisticated and elusive attacks, existing intrusion detection methodologies often overlook critical aspects such as changes in network topology over time and interactions between hosts. To address these issues, this paper proposes a real-time network intrusion detection method based on graph neural networks. The proposed method leverages the advantages of graph neural networks and employs a straightforward graph construction method to represent network traffic as dynamic graph-structured data. Additionally, a graph convolution operation with a multi-head attention mechanism is utilized to enhance the model’s ability to capture the intricate relationships within the graph structure comprehensively. Furthermore, it uses an integrated graph neural network to address dynamic graphs’ structural and topological changes at different time points and the challenges of edge embedding in intrusion detection data. The edge classification problem is effectively transformed into node classification by employing a line graph data representation, which facilitates fine-grained intrusion detection tasks on dynamic graph node feature representations. The efficacy of the proposed method is evaluated using two commonly used intrusion detection datasets, UNSW-NB15 and NF-ToN-IoT-v2, and results are compared with previous studies in this field. The experimental results demonstrate that our proposed method achieves 99.3% and 99.96% accuracy on the two datasets, respectively, and outperforms the benchmark model in several evaluation metrics.