Temporal-Gated Graph Neural Network with Graph Sampling for Multi-step Attack Detection

The emergence of new network attacks, especially multi-step attacks which exhibit complex patterns, presents challenges to network security. Intrusion detection in network traffic is one of the core means to ensure network operation security. Traditional intrusion detection methods identify abnormal traffic by modeling the patterns of normal traffic. This strategy focuses on the spatial characteristics of data, ignoring the temporal characteristics of traffic evolution, and may not fully capture the patterns of multi-step network attacks. To address this problem, we propose a Temporal-Gated Graph Neural Network (TGGNN) framework based on graph clustering sampling. Firstly, each network traffic data is viewed as a graph node. We use hierarchical graph clustering methods to sample representative points and further construct local evolutionary structures with their temporally adjacent nodes. Then, we design a novel way of constructing graph data that balances both local and global aspects of network traffic data. Based on the GGNN (Gated Graph Neural Network), we designed a Temporal-Gated Mechanism in the information propagation part, emphasizing the learning of the local evolutionary structure of the graph. Furthermore, a bidirectional LSTM network is used to further enhance the learning of dynamic patterns in network traffic data. Experimental results based on the UNSW-NB15 dataset demonstrate that our approach not only surpasses the performance of four recent baselines but also eliminates the need for feature engineering by adopting an end-to-end approach.