基于图对比学习的自监督网络流量检测模型  

Self-Supervised Network Intrusion Detection Model Based on Graph Contrastive Learning

作　　者：王紫祎 陈世平[1] WANG Ziyi;CHEN Shiping(School of Optical-Electrical and Computer Engineering,University of Shanghai for Science and Technology,Shanghai 200093,China)

机构地区：[1]上海理工大学光电信息与计算机工程学院,上海200093

出　　处：《电子科技》2025年第3期22-31,共10页Electronic Science and Technology

基　　金：国家自然科学基金(61472256,61170277);上海理工大学科技发展基金(16KJFZ035,2017KJFZ033);沪江基金(A14006)。

摘　　要：传统网络异常流量检测方法存在忽略网络拓扑结构、获取标注数据成本高等问题,导致模型的准确率和泛化性较低。为此,文中提出了一种基于图神经网络和自监督学习的检测方法。利用网络流量数据的特点构建自监督图对比学习任务,通过边特征变换和边遮掩进行流量图增强生成对比样本。改进基于GraphSAGE(Graph SAmple and aggreGatE)的图编码器以充分利用相关关系来丰富节点的特征表示。使用适合对比学习的InfoNCE损失函数训练图编码器的参数,实现自主学习特征表示,摆脱对网络流量标签数据的依赖,并提高网络异常流量检测的准确率。实验结果表明,所提模型在没有标签数据的情况下在检测异常网络流量性能方面表现良好,在两个公开数据集上的F1值分别达到了92.64%和90.97%。Traditional methods for detecting network traffic anomalies suffer from issues such as neglecting network topology and high costs associated with acquiring labeled data,leading to lower model accuracy and generalization.This study proposes a detection approach based on graph neural networks and self-supervised learning.Based on the characteristics of network traffic data,the self-supervised graph comparison learning task is constructed,and the traffic graph is enhanced by edge feature transformation and edge masking to generate comparison samples.The graph encoder based on GraphSAGE(Graph SAmple and aggreGatE)is improved to make full use of correlation to enrich the feature representation of nodes,and the parameters of the graph encoder are trained with InfoNCE loss function suitable for comparative learning to achieve self-learning feature representation,get rid of the dependence on network traffic label data,and improve the accuracy of network abnormal traffic detection.The experimental results show that the proposed model performs well in detecting abnormal network traffic without label data,with F1 values reaching 92.64%and 90.97%on two public data sets,respectively.

关 键 词：网络流量检测 图神经网络 对比学习 自监督表征学习 InfoNCE损失函数 图表示学习 深度学习 图数据增强 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]