Abstract:In the rapidly evolving field of cybersecurity, the integration of flow-level and packet-level information for real-time intrusion detection remains a largely untapped area of research. This paper introduces "XG-NID," a novel framework that, to the best of our knowledge, is the first to fuse flow-level and packet-level data within a heterogeneous graph structure, offering a comprehensive analysis of network traffic. Leveraging a heterogeneous graph neural network (GNN) with graph-level classification, XG-NID uniquely enables real-time inference while effectively capturing the intricate relationships between flow and packet payload data. Unlike traditional GNN-based methodologies that predominantly analyze historical data, XG-NID is designed to accommodate the heterogeneous nature of network traffic, providing a robust and real-time defense mechanism. Our framework extends beyond mere classification; it integrates Large Language Models (LLMs) to generate detailed, human-readable explanations and suggest potential remedial actions, ensuring that the insights produced are both actionable and comprehensible. Additionally, we introduce a new set of flow features based on temporal information, further enhancing the contextual and explainable inferences provided by our model. To facilitate practical application and accessibility, we developed "GNN4ID," an open-source tool that enables the extraction and transformation of raw network traffic into the proposed heterogeneous graph structure, seamlessly integrating flow and packet-level data. Our comprehensive quantitative comparative analysis demonstrates that XG-NID achieves an F1 score of 97\% in multi-class classification, outperforming existing baseline and state-of-the-art methods. This sets a new standard in Network Intrusion Detection Systems by combining innovative data fusion with enhanced interpretability and real-time capabilities.

Divide, Conquer, and Coalesce: Meta Parallel Graph Neural Network for IoT Intrusion Detection at Scale

Message Passing Assisted Scalable Distributed Link Management for Ubiquitous Network

XG-NID: Dual-Modality Network Intrusion Detection using a Heterogeneous Graph Neural Network and Large Language Model

Intrusion Detection for Secure Social Internet of Things Based on Collaborative Edge Computing: A Generative Adversarial Network-Based Approach.

A Hypergraph-Based Machine Learning Ensemble Network Intrusion Detection System

Adaptive Partitioning and Efficient Scheduling for Distributed DNN Training in Heterogeneous IoT Environment

Local Augmentation with Functionality-Preservation for Semi-Supervised Graph Intrusion Detection

Large-scale Network Intrusion Detection Based on Distributed Learning Algorithm

Vehicular Network Intrusion Detection Using a Cascaded Deep Learning Approach with Multi-Variant Metaheuristic

A Distributed Neural Network Learning Algorithm For Network Intrusion Detection System

Scalable Graph-Aware Edge Representation Learning for Wireless IoT Intrusion Detection

Unveiling the potential of Graph Neural Networks for robust Intrusion Detection

Multi-stage Attack Detection and Prediction Using Graph Neural Networks: An IoT Feasibility Study

Intrusion detection framework using auto‐metric graph neural network optimized with hybrid woodpecker mating and capuchin search optimization algorithm in IoT network

GNN-Based Network Traffic Analysis for the Detection of Sequential Attacks in IoT

Multi-Stage Optimized Machine Learning Framework for Network Intrusion Detection

Applying self-supervised learning to network intrusion detection for network flows with graph neural network

Aware: Adaptive Distributed Training with Computation, Communication and Position Awareness for Deep Learning Model.

NIDS-FGPA: A federated learning network intrusion detection algorithm based on secure aggregation of gradient similarity models

N-STGAT: Spatio-Temporal Graph Neural Network Based Network Intrusion Detection for Near-Earth Remote Sensing