Abstract:In the rapidly evolving field of cybersecurity, the integration of flow-level and packet-level information for real-time intrusion detection remains a largely untapped area of research. This paper introduces "XG-NID," a novel framework that, to the best of our knowledge, is the first to fuse flow-level and packet-level data within a heterogeneous graph structure, offering a comprehensive analysis of network traffic. Leveraging a heterogeneous graph neural network (GNN) with graph-level classification, XG-NID uniquely enables real-time inference while effectively capturing the intricate relationships between flow and packet payload data. Unlike traditional GNN-based methodologies that predominantly analyze historical data, XG-NID is designed to accommodate the heterogeneous nature of network traffic, providing a robust and real-time defense mechanism. Our framework extends beyond mere classification; it integrates Large Language Models (LLMs) to generate detailed, human-readable explanations and suggest potential remedial actions, ensuring that the insights produced are both actionable and comprehensible. Additionally, we introduce a new set of flow features based on temporal information, further enhancing the contextual and explainable inferences provided by our model. To facilitate practical application and accessibility, we developed "GNN4ID," an open-source tool that enables the extraction and transformation of raw network traffic into the proposed heterogeneous graph structure, seamlessly integrating flow and packet-level data. Our comprehensive quantitative comparative analysis demonstrates that XG-NID achieves an F1 score of 97\% in multi-class classification, outperforming existing baseline and state-of-the-art methods. This sets a new standard in Network Intrusion Detection Systems by combining innovative data fusion with enhanced interpretability and real-time capabilities.

Application of Fuzzy Decision Support System Based on GNN in Anomaly Detection and Incident Response Service of Intelligent Security

DGA-GNN: Dynamic Grouping Aggregation GNN for Fraud Detection

Ignnvd: A Novel Software Vulnerability Detection Model Based on Integrated Graph Neural Networks

Accurate Anomaly Detection Leveraging Knowledge-enhanced GAT

GNN-based Advanced Feature Integration for ICS Anomaly Detection

Application of a Dynamic Line Graph Neural Network for Intrusion Detection With Semisupervised Learning

Graph neural network based robust anomaly detection at service level in SDN driven microservice system

N-STGAT：Spatio-Temporal Graph Neural Network Based Network Intrusion Detection for Near-earth Remote Sensing

N-STGAT: Spatio-Temporal Graph Neural Network Based Network Intrusion Detection for Near-Earth Remote Sensing

Six-GraphSecurity: Industrial Internet Intrusion Detection Based On Graph Neural Network

Cloudy with a Chance of Anomalies: Dynamic Graph Neural Network for Early Detection of Cloud Services' User Anomalies

Graph neural network approach for anomaly detection

Graph-based Solutions with Residuals for Intrusion Detection: the Modified E-GraphSAGE and E-ResGAT Algorithms

Edge-featured multi-hop attention graph neural network for intrusion detection system

Integrating Graph Neural Networks with Scattering Transform for Anomaly Detection

XG-NID: Dual-Modality Network Intrusion Detection using a Heterogeneous Graph Neural Network and Large Language Model

Genetic Algorithm based feature selection and Naïve Bayes for anomaly detection in fog computing environment

GSOOA-1DDRSN: Network traffic anomaly detection based on deep residual shrinkage networks

SCN_GNN: A GNN-based fraud detection algorithm combining strong node and graph topology information

Unsupervised anomaly detection using graph neural networks integrated with physical-statistical feature fusion and local-global learning

An interpretable graph neural network for real-world satellite power system anomaly detection based on graph filtering