Enhanced GraphSAGE for Multi-Class Intrusion Detection
H.-S. Le, Minho Park · 2024
Nowadays, the number of devices connecting to the Internet is increasing significantly, expanding the size of networks. Along with this development, cyberattacks are rising, targeting sensitive information or even causing critical infrastructure disruption. Hence, it is crucial to detect and thwart attacks before their execution, presenting a significant challenge in protecting businesses from latent threats. In response, various methods have been introduced to enhance network security, with Network Intrusion Detection Systems (NIDS) emerging as a promising solution to monitor traffic and flow within the network. Many years ago, the Graph Neural Network (GNN) was proposed as an effective Deep Learning (DL) algorithm for application in NIDS, demonstrating the ability to capture complex structural data. While NIDS aims to detect attacks based on traffic and flows, traditional GNN studies often concentrate on node features for node classification tasks, without considering edge features that represent the flow information in the network. To overcome this limitation, we propose a method to capture edge features and leverage them to enhance GraphSAGE, a variant of GNN, for the edge classification task. In this paper, we use a two-layer GraphSAGE network to extract edge features. Finally, we use the CICIDS2017 dataset to evaluate the performance of the proposed method. The experimental results show that our proposed model can improve the performance in the detection process of NIDS.