K-GetNID: Knowledge-Guided Graphs for Early and Transferable Network Intrusion Detection

Developing early and transferable Network Intrusion Detection Systems (NIDSs) is essential for robust network security. Early detection prevents further damage, while transferable NIDSs enables reuse across diverse networks. For Machine Learning (ML) and Deep Learning (DL)-based NIDSs, transferability significantly reduces data collection and annotation costs for timely attack mitigation. Current DL-based early intrusion detection studies often focus on identifying attacks from the first few packets, neglecting the crucial aspect of adjustable early detection. Additionally, most DL-based NIDS methods overlook transferability during both design and evaluation phases. To address these limitations, we propose K-GetNID, a knowledge-guided graph learning-based NIDS that excels in both early and transferability. We introduce a Heterogeneous Temporal Graph (HTGraph) to represent the dynamic feature series of network flows, providing enough information for early detection. Additionally, we construct this HTGraph format based on prior knowledge about feature types and correlations to assist the neural network in learning general and transferable knowledge for intrusion detection. We develop a corresponding Heterogeneous Temporal Graph Neural Network (HTGNN) model to learn from the HTGraph format. Furthermore, an Adjustable Early Detection Decoder is designed to enhance the generalization of the proposed model to the input distribution shifts caused by early detection. Experiments on CIC-IDS-2017 and UNSW-NB15 datasets show that K-GetNID matches the performance of deep learning methods, excelling in adjustable early intrusion detection and transferability.