Semantic-guided edge enhancement for graph self-supervised learning in network intrusion detection.

Anomaly Detection via Contrastive Learning on Graph using Embedding

A graph embedding-based error detection method via contrastive learning that treats each triple as a hyper-node, enabling data-driven modeling of semantic consistency and integrates a semantic matching-based scoring mechanism with a contrastive learning-based scoring mechanism.

GIC-IDS: A Unified Graph Intrusion Detection Framework with Information Bottleneck and Contrastive Learning

TAE-MAGSAGE: Topology Aware Metric Learning for Graph Based Network Intrusion Detection

: The modern network environment, whether enterprise systems or critical infrastructure, is increasingly exposed to sophisticated cyber threats that must be effectively detected. The existing GNN-based approaches construct graphs using feature-similarity heuristics, and connect flows that are statistically similar to one another but not necessarily communicating, hence capturing geometry specific to the dataset. On the other hand, communication topology is a representation of interaction patterns based on real network behaviour. We introduce TAE-MAGSAGE, an edge-centric graph learning model which uses the observed communication structure to construct graphs and applies a line graph transformation to perform flow-level classification without collapsing the interaction relationships. A Mahalanobis-inspired metric warp in message passing re-configures neighborhood similarity with respect to the discriminative feature dimensions, and a Ledoit–Wolf regularized Mahalanobis distance-based classifier learns class-conditional distributions to deal with severe class imbalance. TAE-MAGSAGE achieves an accuracy of 99.31% on the CIC-IDS-2017 dataset, macro F1 of 98.10%, and a false alarm rate of 0.56%, outperforming graph-based baselines. These results show that constructing graphs based on communication structure, combined with metric-conscious embedding and distribution-conscious classification, improves minority attack detection while reducing false alarms.

Dual-autoencoder multi-task self-supervised one-class graph anomaly detection for network traffic

To address the limitations of intrusion detection under unknown attacks and label scarcity, this paper proposes GDAE, a multi-task self-supervised one-class anomaly detection framework for network traffic graphs. It constructs an edge-level directed graph from NetFlow, employs E-GraphSAGE for structure-aware edge embeddings, and captures multi-scale normal patterns via local structure and global semantic autoencoders with a structure consistency prediction task. To compensate for the lack of negative samples, a dual-path pseudo-anomaly generation mechanism using feature perturbation and structural discarding is designed, with an anomaly discriminator to learn the normal-abnormal boundary. Training employs Kendall uncertainty for adaptive multi-task loss weighting and extreme value theory for threshold estimation, demonstrating strong performance on two large-scale benchmark datasets. Experiments on NF-UNSW-NB15-v2 and NF-CSE-CIC-IDS2018-v2 demonstrate GDAE’s superior performance over unsupervised and graph-based baselines in PR-AUC and Macro-F1, with strong stability and efficiency, offering a new pathway for lightweight, robust self-supervised one-class intrusion detection.

A Novel Graph Fraud Detector via Grouped Attribute Completion and Confidence-Aware Contrastive Learning

Graph fraud detection plays a pivotal role in safeguarding the security and integrity of modern digital ecosystems. Graph Neural Networks (GNNs) are commonly adopted for graph fraud detection. However, the practical performance of existing GNN-based detectors is severely hindered by incomplete node attributes and extreme class imbalance within graphs. To mitigate these limitations, this paper proposes a novel framework for Graph Fraud Detection with Grouped attribute completion and Confidence-aware Contrastive learning, named GFD-GC. Specifically, it first imitates heterogeneous neighborhood structures to implement group-wise aggregation, which obtains informative complete node features by capturing fine-grained graph contextual patterns. Further, it introduces a confidence-aware supervised contrastive learning strategy to augment scarce labeled fraud nodes with high confidence pseudo-fraud nodes, which enhances the compactness of fraud representations and their separability from non-fraud nodes. Extensive experiments demonstrate the superiority of the proposed GFD-GC over state-of-the-art baselines on the graph fraud detection task, thereby providing an effective solution for real-world fraud scenarios.

Explainability of Feature Relations in Malicious Network Data Based on Graph Attention Network

Reinforcement learning-based intrusion detection systems achieve strong detection performance in unbalanced network traffic, but offer limited insight into which features have played a significant role in driving their decisions. To determine the key network features in detecting malicious packets, this paper presents a Graph Attention Network (GAT) model architecture applied to a feature dependency graph to analyze inter-feature influence in an RL-based intrusion detection system. Rather than ranking features independently, the framework uses GAT attention weights to reveal which feature relationships the model relies on most and how those relationships differ between malicious and benign traffic networks. Applied to a Rainbow DQN agent, a well-known RL-based agent, and trained on real botnet network traffic, the analysis identifies interpretable behavioral signatures in the feature influence structure that distinguish attack traffic from legitimate connections. The results demonstrate that attention-based influence analysis provides a richer characterization of detection decisions than per-feature importance methods alone.