Abstract:In the rapidly evolving field of cybersecurity, the integration of flow-level and packet-level information for real-time intrusion detection remains a largely untapped area of research. This paper introduces "XG-NID," a novel framework that, to the best of our knowledge, is the first to fuse flow-level and packet-level data within a heterogeneous graph structure, offering a comprehensive analysis of network traffic. Leveraging a heterogeneous graph neural network (GNN) with graph-level classification, XG-NID uniquely enables real-time inference while effectively capturing the intricate relationships between flow and packet payload data. Unlike traditional GNN-based methodologies that predominantly analyze historical data, XG-NID is designed to accommodate the heterogeneous nature of network traffic, providing a robust and real-time defense mechanism. Our framework extends beyond mere classification; it integrates Large Language Models (LLMs) to generate detailed, human-readable explanations and suggest potential remedial actions, ensuring that the insights produced are both actionable and comprehensible. Additionally, we introduce a new set of flow features based on temporal information, further enhancing the contextual and explainable inferences provided by our model. To facilitate practical application and accessibility, we developed "GNN4ID," an open-source tool that enables the extraction and transformation of raw network traffic into the proposed heterogeneous graph structure, seamlessly integrating flow and packet-level data. Our comprehensive quantitative comparative analysis demonstrates that XG-NID achieves an F1 score of 97\% in multi-class classification, outperforming existing baseline and state-of-the-art methods. This sets a new standard in Network Intrusion Detection Systems by combining innovative data fusion with enhanced interpretability and real-time capabilities.

Detecting Unknown Threat Based on Continuous-Time Dynamic Heterogeneous Graph Network

Practical Cyber Attack Detection With Continuous Temporal Graph in Dynamic Network System

ASA: Adversary Situation Awareness Via Heterogeneous Graph Convolutional Networks.

Ignnvd: A Novel Software Vulnerability Detection Model Based on Integrated Graph Neural Networks

Cyber threat prediction using dynamic heterogeneous graph learning

Advanced Persistent Threat Detection in Smart Grid Clouds Using Spatiotemporal Context-Aware Graph Embedding

Detect Advanced Persistent Threat In Graph-Level Using Competitive AutoEncoder.

Detection of Cyber-Attacks in a Discrete Event System Based on Deep Learning

A Heterogeneous Graph Learning Model for Cyber-Attack Detection

A High Accuracy and Adaptive Anomaly Detection Model With Dual-Domain Graph Convolutional Network for Insider Threat Detection

A Hierarchical Approach for Advanced Persistent Threat Detection with Attention-Based Graph Neural Networks

Accurate Anomaly Detection Leveraging Knowledge-enhanced GAT

Heterogeneous Graph Matching Networks for Unknown Malware Detection

HRGCN: Heterogeneous Graph-level Anomaly Detection with Hierarchical Relation-augmented Graph Neural Networks

Application of a Dynamic Line Graph Neural Network for Intrusion Detection With Semisupervised Learning

N-STGAT: Spatio-Temporal Graph Neural Network Based Network Intrusion Detection for Near-Earth Remote Sensing

Multi-attributed heterogeneous graph convolutional network for bot detection

N-STGAT：Spatio-Temporal Graph Neural Network Based Network Intrusion Detection for Near-earth Remote Sensing

A Graph Embedded In Graph Framework With Dual-sequence Input For Efficient Anomaly Detection of Complex Equipment Under Insufficient Samples

Graph-based Solutions with Residuals for Intrusion Detection: the Modified E-GraphSAGE and E-ResGAT Algorithms

XG-NID: Dual-Modality Network Intrusion Detection using a Heterogeneous Graph Neural Network and Large Language Model