Constructing Weighted Host Communication Networks for Intrusion Detection based on Complex Network Theory

As the scope of the Internet continues to broaden, there is an exponential surge in network data, accompanied by a simultaneous escalation of cybersecurity issues. To accurately identify the source of intrusion within a compromised network, this paper proposes an intrusion detection method based on complex network theory. In this method, the network hosts are regarded as nodes, the communication relationships between hosts are seen as edges, and the communication traffic features are mapped as weights to construct weighted host communication networks. Subsequently, complex network metrics that assess the significance of host nodes are extracted. These metrics are then combined with an anomaly detection model to achieve intrusion detection. The proposed method has been verified through testing on two datasets, namely the CIC-IDS-2017 and DAPT2020 datasets. And the experimental results substantiate that the method demonstrate a positive intrusion detection performance, outperform the compared anomaly detection models.