Network intrusion detection method and system based on dynamic graph attention and contrastive learning

Abstract

This invention discloses a network intrusion detection method and system based on dynamic graph attention and contrastive learning. By constructing network traffic as a dynamic heterogeneous graph (nodes represent IP addresses / ports, edges represent traffic sessions), a time window partitioning method and a GATv2 network are used for dynamic feature fusion. An innovative optimal transmission contrastive learning strategy is introduced, using Wasserstein distance and Gaussian Wasserstein distance to align feature and structural distributions, improving the model's generalization ability against unknown attacks. Finally, node embeddings and alignment matrices are combined, and an MLP classifier is used to predict edge anomaly probabilities. Experiments show that this method improves accuracy and F1-score by 5.2%–10.5% compared to the baseline on multiple datasets, significantly enhancing detection performance under complex attacks and making it suitable for real-time scenarios such as the Internet of Things. The system can be deployed on edge devices and has high practical value.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a network intrusion detection method and system based on dynamic graph attention and contrastive learning. The method and system using it are applicable to abnormal traffic detection in scenarios such as the Internet of Things and industrial control systems. Background Technology

[0002] Graph Attention Network (GAT) is a graph neural network model based on an attention mechanism. It aims to overcome the limitations of fixed-neighbor aggregation in traditional Graph Convolutional Networks (GCNs) by dynamically learning the association weights between nodes. Its core idea is to assign different attention weights to each node in the graph, reflecting the differences in importance of different neighboring nodes to the target node. Unlike GCNs, which rely on predefined graph structures (such as symmetric normalized adjacency matrices), GAT's weights are entirely data-driven, requiring no prior knowledge, thus enabling it to flexibly adapt to complex graph structures (such as heterogeneous or dynamic graphs).

[0003] Graph Attention Network (GAT) introduces an attention mechanism to empower graph neural networks with the ability to dynamically model neighborhood relationships. However, its original architecture suffers from a core flaw: static attention ranking. For any node i, the attention weights of its neighboring nodes j are fixed after parameter initialization, failing to adapt to dynamic changes in input features. This limitation is particularly pronounced in network intrusion detection scenarios. For example, when attack traffic masquerades as normal communication, traditional GAT struggles to dynamically adjust the attention weights for anomalous connections. GATv2 (Graph Attention Network v2) fundamentally improves upon this issue. Its core idea is to reconstruct the attention computation process through nonlinear transformations, achieving true dynamic attention allocation. GATv2's improved mechanism gives it significant advantages in network intrusion detection. First, the dynamic attention mechanism can adaptively adjust the intensity of attention to anomalous connections. For instance, when detecting covert attacks, the model can significantly enhance the weight allocation for malicious traffic nodes, thereby improving the sensitivity of identifying anomalous behavior. Second, by deeply fusing edge features and node interaction information, the model effectively reduces the risk of misjudgment in protocol spoofing attacks. For example, its detection accuracy for encrypted communication traffic is significantly better than traditional methods. Furthermore, the multi-head attention mechanism enhances the model's robustness to topological perturbations through multi-dimensional feature aggregation, maintaining stable detection performance even under noise interference. These characteristics make GATv2 an ideal architecture for building adaptive intrusion detection systems.

[0004] Generative Subgraph Comparison (GSC) is an unsupervised graph representation learning method based on contrastive learning. It aims to learn discriminative node or graph representations by modeling the inherent semantic relationships within the graph structure. Its core idea is to construct pairs of positive and negative samples, forcing the encoder to distinguish key differences between the original graph and the perturbed subgraph, thereby capturing potential attack patterns in network traffic.

[0005] With the widespread adoption of mobile internet, the hardware performance of users' devices varies significantly, leading to time-consuming decryption processes and the inability to delegate decryption keys to third parties. Therefore, a securely outsourceable decryption solution is needed to assist in rapid decryption without exposing the user's keys. To address this, this invention proposes a network intrusion detection method and system based on dynamic graph attention and contrastive learning. Summary of the Invention

[0006] The present invention aims to provide a network intrusion detection method and system based on dynamic graph attention and contrastive learning, so as to provide a decryption scheme that can be securely outsourced, and assist in fast decryption without the user exposing their own key.

[0007] To achieve the above objectives, the present invention provides the following technical solution:

[0008] A network intrusion detection method based on dynamic graph attention and contrastive learning includes the following steps:

[0009] S1. Dynamic Graph Construction: Represent network traffic data as a heterogeneous graph structure, where nodes are composed of tuples consisting of source IP address and port, and destination IP address and port, and edges represent traffic sessions. Edge attributes contain a 43-dimensional feature vector, namely protocol type, TCP flags and traffic statistics features.

[0010] S2, Dynamic Subgraph Sampling: Extracting Batch Edge Sets E by Dividing the Data Through a Time Window batch and associated node set V batch When the number of nodes is below the threshold M, neighbor expansion V is executed. expanded =V batch ∪{N(v)∣v∈V batch Generate a subgraph G with dynamically updated edge weights. sub ;

[0011] S3, GATv2 Node Encoding: The GATv2 dynamic graph attention network is used to extract features from subgraph nodes. Its attention coefficient calculation integrates node features, edge features, and dynamic edge weights, and is expressed by the following formula:

[0012]

[0013] S4. Graph Comparison Learning Based on Optimal Transmission: Paired Subgraph G subApplying perturbation to generate positive samples G pos Negative samples G were sampled from other time windows. neg Feature-structure distribution alignment is achieved by minimizing the Wasserstein distance (WD) and the Gaussian Wasserstein distance (GWD).

[0014]

[0015] And based on the fusion distance D OT =WD+λ·GWD optimizes the InfoNCE loss function;

[0016] S5. Edge Anomaly Classification: Combining Node Embedding Align matrix element P with OT u,v The edge anomaly probability is output through the MLP classifier:

[0017]

[0018] Furthermore, the dynamic graph construction in step S1 specifically includes: merging the source IP:port and destination IP:port into a unique node identifier; constructing weighted directed edges based on communication relationships, with the edge weights dynamically updated by the traffic statistics features within the time window; and scaling the numerical features to zero mean and unit variance using standardization processing.

[0019] Furthermore, in step S3, the GATv2 multi-head attention mechanism employs K independent attention heads for parallel computation, and the final node representations are fused through concatenation:

[0020]

[0021] Furthermore, the perturbation strategy in step S4 includes: with probability p e Randomly delete edges to simulate a communication terminal caused by an attack; with probability p f Masking is applied to some feature dimensions to enhance noise robustness; local subgraph sampling based on random walks preserves key connection patterns.

[0022] Furthermore, in step S4, the Wasserstein distance calculation uses the Sinkhorn algorithm to solve for the optimal transfer matrix P, and the entropy regularization term KL(P) is defined as ∑ i,j P ij logP ij .

[0023] Furthermore, in step S5, after the edge anomaly probability is output by the MLP classifier, the decision boundary is adjusted according to the dynamic classification threshold. The dynamic classification threshold is adaptively adjusted based on the normal traffic statistical distribution to reduce the false alarm rate.

[0024] Furthermore, this method is applied to a computer processor program, and the method is implemented by the execution of the computer processor program.

[0025] Furthermore, the method is applied to computer instructions on a computer-readable storage medium, and the method is implemented by executing the computer instructions on the readable storage medium.

[0026] A network intrusion detection system includes a data preprocessing module, a GATv2-GSC detection engine, and a real-time alarm module. The data preprocessing module is used to convert NetFlow data into a heterogeneous graph structure as described in the above network intrusion detection method. The GATv2-GSC detection engine is used to execute the above network intrusion detection method. The real-time alarm module is used to generate security alarms for traffic with abnormal edge scores exceeding a threshold.

[0027] Furthermore, the system is deployed on edge computing devices, and reduces computing resource consumption through model pruning and quantization techniques to meet the real-time detection needs of the Industrial Internet of Things.

[0028] The principle and beneficial effects of this technical solution: The method of this invention constructs an end-to-end heterogeneous graph representation learning framework by introducing a subgraph comparison strategy based on Wasserstein distance, thereby realizing the dynamic capture of the spatiotemporal evolution characteristics of attack behavior in network traffic. Experimental results show that on datasets such as NF-UNSW-NB15-v2, the proposed method improves the accuracy and key indicators such as F1-score by 5.2% to 10.5% compared with the baseline model, verifying its high detection accuracy and robustness under complex attack modes. Attached Figure Description

[0029] Figure 1 This is a flowchart of the data preprocessing process of the method of the present invention;

[0030] Figure 2 This is a diagram illustrating the traffic flow of IoT devices.

[0031] Figure 3 To be Figure 2 A structural diagram based on NetFlow data converted into graphics;

[0032] Figure 4 This is an overall flowchart of the method of the present invention;

[0033] Figure 5 This is a diagram illustrating the algorithm of the method of this invention;

[0034] Figure 6 The ROC curve for multi-class classification of NF-BoT-IoT-v2 in the multi-class classification experiment of the example is shown.

[0035] Figure 7The multi-class ROC curve of NF-UNSW-NB15-v2 in the multi-class experiment of the example;

[0036] Figure 8 The multi-class ROC curve of NF-ToN-IoT-v2 in the multi-class experiment is shown in the example. Detailed Implementation

[0037] The present invention will now be described in further detail with reference to the accompanying drawings and embodiments:

[0038] 1. Data Preprocessing

[0039] Data preprocessing plays a crucial role in transforming raw NetFlow data into graphical data for training and testing. Key information for each flow is extracted from the vast amount of NetFlow data in the dataset, including IP addresses, port numbers, packet and byte counts, and other useful packet statistics. NetFlow data supports the conversion between traffic records and graphical formats because nodes can be represented by IP addresses and ports, and traffic information can represent edges.

[0040] like Figure 1 The flowchart illustrates the data processing. First, feature engineering transforms the raw network traffic data into a graph of node-edge relationships. Source IP and port, and destination IP and port are merged into unique node identifiers, redundant port fields are removed, and an edge list based on communication relationships is constructed. Next, data cleaning and standardization are performed. After handling infinity and missing values, numerical features are standardized using StandardScaler to scale them to zero mean and unit variance, improving model convergence efficiency. Finally, a stratified sampling strategy is employed in the data segmentation stage, splitting the dataset into a 70% training set and a 30% test set, ensuring that the proportion of samples from each class is equal in both sets.

[0041] 2. Graph Construction

[0042] The method of this invention uses data based on the NetFlow format, constructing a global traffic graph network topology from the source IP addresses and port numbers, as well as the destination IP addresses and port numbers of various traffic data. Graphs have a powerful ability to represent non-Euclidean data and have a sound theoretical foundation. Therefore, network flow data can naturally form a graph structure, where hosts in the network and the network flows between them can be viewed as nodes and edges in the graph, respectively.

[0043] like Figure 2 and Figure 3 As shown, Figure 2This is a traffic graph for IoT devices. Arrows with nodes represent network traffic flow from the source host to the destination host. Normal traffic and attack traffic are represented by black and red arrows, respectively. Figure 2 Convert to Figure 3 The graph structure shown clearly represents the network device topology. Traffic data attributes are used as edge features, and IP addresses and port numbers are used as node features. This design preserves network layer features while incorporating transport layer information. Traffic record features are transformed into graph edges, carrying standardized numerical feature vectors and traffic labels. The directed graph structure accurately reflects the directional characteristics of network traffic, preserving the inherent request-response pattern of the TCP / UDP protocol. The use of a multigraph structure allows for multiple differentiated edges between identical node pairs, effectively recording duplicate connection behavior. This transforms the abnormal traffic detection problem into an edge classification task.

[0044] 3. GATv2-GSC model

[0045] The overall process of the network intrusion detection method based on Dynamic Graph Attention (GATv2) and Graph Comparison Learning (GSC) proposed in this invention is as follows: Figure 4 As shown. First, the input network traffic data is converted into a graph structure through a data preprocessing module. During graph construction, nodes represent entities in the network (such as IP addresses), and edges represent interactions between entities (such as traffic). To capture the local and global structural information of the graph, we construct a subgraph with 2-hop neighbor sampling starting from the central node. We use a dynamic graph attention network (GATv2) to extract features from the subgraph, dynamically assign neighbor weights, capture key interaction patterns in attack behavior, and introduce cross-layer residual connections to alleviate the gradient degradation problem in deep network training. We also employ multi-head attention to learn multi-dimensional features in parallel.

[0046] Then, multiple subgraph samples are generated through subgraph sampling to increase data diversity. Each subgraph is centered around a central node, and its surrounding nodes and edges are sampled. To achieve graph contrastive learning (GSC), we define positive samples as subgraphs with the same central node and negative samples as subgraphs with different central nodes. By comparing positive and negative samples, the model can learn robust representations of graphs. In the contrastive learning framework, we use Wasserstein Distance to measure the similarity between positive samples and Gaussian Wasserstein Distance to measure the difference between negative samples, and optimize the model using a total loss function L = L1 + L2. In this way, the model can effectively distinguish between normal traffic and attack traffic.

[0047] Finally, the extracted features are classified using a multilayer perceptron (MLP) to determine whether the traffic is normal (marked in green) or attack traffic (marked in red). The entire process, through a combination of contrastive learning and dynamic graph attention mechanisms, achieves efficient intrusion detection of network traffic.

[0048] The following section provides a detailed analysis of the technical details and collaborative mechanisms of each stage, and explains the key formulas. The proposed network intrusion detection method, based on Dynamic Graph Attention (GATv2) and Graph Comparison Learning (GSC), can be divided into four core stages: dynamic subgraph sampling, GATv2 node encoding, graph comparison learning based on optimal transmission, and edge anomaly classification.

[0049] 1. Dynamic Subgraph Sampling: Dynamic network traffic exhibits spatiotemporal evolution, and directly processing the entire graph presents both challenges in terms of computational complexity and noise interference. Therefore, the algorithm first extracts local subgraphs by dividing the graph into time windows and then combines this with a neighbor expansion strategy to address the sparsity problem. Specifically, for each time window t, from the original graph G... t A batch of samples from the middle edge E batch And extract the relevant node set V batch If the number of nodes is less than the threshold M, then its neighboring nodes are expanded to cover potential attack paths (such as multi-hop connections in lateral movement attacks). The final generated subgraph G sub Including dynamically updated edge weights, the weight calculation incorporates traffic statistics (such as packet counts and entropy values) within a time window, thus reflecting the real-time state of network interactions. This stage, through local modeling and dynamic updates, significantly reduces the detection latency of complex attack behaviors.

[0050] 2. GATv2 Node Encoding: Traditional Graph Attention Networks (GATs) suffer from difficulties adapting to dynamic attack behaviors due to their static attention mechanisms. This algorithm employs GATv2 to achieve dynamic aggregation of node representations. For each GATv2 layer l, the attention coefficient of node u... It is determined by three parts of information: the characteristics of the current layer node. Characteristics of neighbors Edge feature e uv (Such as protocol type, port number) and dynamic edge weights. The formula for calculating the attention coefficient is:

[0051]

[0052] Among them W attn 'a' and 'a' are learnable parameters, and '||' represents feature concatenation. By introducing edge features into attention calculation, the model can capture attack signals such as abnormal port scanning or unconventional protocol usage. After multi-layer stacking, the node embedding H simultaneously encodes local topological relationships and global spatiotemporal patterns, providing highly discriminative features for subsequent comparative learning.

[0053] 3. Graph Comparison Learning Based on Optimal Transmission: To alleviate the problem of scarce labeled data and enhance the model's generalization ability to unknown attacks, the algorithm introduces optimal transmission (OT) distance as a similarity metric for subgraph comparison. For the original subgraph G... sub Generating positive samples G by applying slight perturbations (edge ​​deletion, feature masking) pos And sample negative samples G from other time windows or attack scenarios. neg The structural variations and characteristic noise of simulated attack behavior are analyzed. G is calculated by minimizing the transmission cost matrix and the entropy regularization term. sub With G pos The degree of alignment of the distribution. Its formula is:

[0054]

[0055] Where P is the transmission plan matrix, KL(P) is the entropy regularization term, and ∈ is the balance parameter. The Wasserstein distance measures the difference in node feature distribution through the globally optimal transmission plan, effectively identifying abrupt changes in feature distribution (such as traffic surges during DDoS attacks).

[0056] GWD measures the similarity of topological structures by comparing the differences in the adjacency matrices between subgraphs. Its formula is:

[0057]

[0058] Among them, A sub and A pos These are the adjacency matrices of the subgraph and the positive sample, respectively. The GW distance, through structural consistency constraints, detects hidden cross-temporal window connection patterns in APT attacks. The feature and structural alignment results are weighted and fused to obtain D. OT And based on the InfoNCE loss optimization model. Its formula is:

[0059]

[0060] Here, τ is a temperature parameter that controls the sharpness of the contrastive learning distribution. The introduction of OT distance upgrades contrastive learning from simple point-to-point matching to multimodal distribution alignment, significantly improving robustness against complex attacks.

[0061] 4. Edge Anomaly Classification: In the edge classification stage, the algorithm integrates node embedding and OT alignment information to achieve accurate anomaly detection. For edge (u,v), in addition to splicing the endpoint features h... u and h v In addition, the corresponding element P in the OT coupling matrix P is introduced. u,vThis element reflects the alignment strength of node pairs in cross-subgraph comparisons; low alignment strength may indicate anomalies (such as unusual communication between zombie nodes and the C2 server). The formula for calculating edge embedding is:

[0062]

[0063] The edge anomaly probability y is output using a multilayer perceptron (MLP) and a sigmoid function. uv Its formula is:

[0064] y uv =σ(W cls z uv )

[0065] Among them W cls σ represents the classification weight, and σ is the Sigmoid function. Dynamic thresholding mechanisms (such as those based on the statistical distribution of normal traffic) further reduce false alarms and ensure the stability of real-time detection.

[0066] like Figure 5 The algorithm described above can explain all the above processes and the training flow of the model.

[0067] The specific implementation process is as follows:

[0068] 1. Dataset

[0069] In our experiments, we used three different NetFlow datasets: NF-BoT-IoT-v2, NF-UNSW-NB15-v2, and NF-ToN-IoT-v2. NF-BoT-IoT-v2 is an extended version of NF-BoT-IoT, designed for Internet of Things (IoT) scenarios. It focuses on botnet attack data, collecting traffic patterns in IoT device communication, including behavioral data such as abnormal communication between devices and malicious command transmissions. It is suitable for verifying the model's detection performance against bot-type attacks in IoT environments. The NF-UNSW-NB15-v2 dataset is a collection of network traffic data generated from the UNSW-NB15 dataset, including normal traffic and nine types of attack traffic. NF-ToN-IoT-v2 is reconstructed from the ToN-IoT dataset, focusing on industrial Internet of Things (IoT) scenarios. It includes attacks such as ransomware, industrial control protocol tampering, and fake data injection, totaling approximately 6 million records. These datasets are specifically designed for network traffic analysis and anomaly detection in IoT environments and were standardized to the NetFlow format by Sarhan et al. Each dataset is tailored to include a variety of network conditions, facilitating the development and evaluation of network intrusion detection systems. Table 1 provides an overview of the four datasets.

[0070] Table 1. Overview of the datasets used in the experiment

[0071]

[0072] 2. Baseline Model

[0073] In this experiment, we will use deep learning (DL) and machine learning (ML) techniques to evaluate our proposed method against five baseline models that are considered state-of-the-art in network intrusion detection.

[0074] XGBoost is a tree-based machine learning algorithm belonging to the gradient boosting framework. It improves prediction accuracy by sequentially adding decision trees, where each new tree attempts to correct the errors (residuals) made by the previous tree. This iterative process allows XGBoost to learn from various data characteristics, such as network traffic patterns or packet durations, thereby making more accurate and informed predictions.

[0075] E-GraphSAGE is a baseline model for graph data analysis that addresses various tasks in graph-structured data, such as node classification, edge prediction, and graph clustering, by efficiently learning representations of nodes and edges in the graph. However, when dealing with large datasets, its computational efficiency can be limited, potentially exceeding memory constraints, as it requires processing all data simultaneously on GPUs. To overcome this issue, we retain the original E-GraphSAGE framework but incorporate a mini-batch training strategy to improve scalability.

[0076] Anomaly-e effectively detects anomalous patterns in graph data, particularly those indicating unusual relationships between nodes and edges, by combining graph neural networks (GNNs) and self-supervised learning methods. The model is trained through a graph-based self-supervised task, enabling the learned node representations to capture more graph structural information without relying on large amounts of labeled data. Graph convolution operations avoid the high cost of complex computations on the entire graph, allowing it to operate efficiently on large-scale graph data.

[0077] E-ResGAT is an improved graph neural network model based on graph attention mechanisms. It aims to address the vanishing gradient problem in traditional graph neural networks with depth stacking and improve the model's scalability on large-scale graph data. Its core idea is to combine residual connections with graph attention mechanisms (GAT), introducing skip connections across layers to enhance the model's expressive power and training stability. This design allows the model to capture dependencies over longer distances while avoiding overfitting.

[0078] GAT is a graph neural network based on an attention mechanism, constructed by... Proposed by GAT et al. in 2017, its core innovation lies in the introduction of a dynamic attention weight mechanism. Traditional graph convolutional networks (GCNs) assume that all neighboring nodes contribute equally to the central node, while GAT assigns different weights to each neighboring node through an attention mechanism, thereby more effectively capturing key structural information in the graph.

[0079] We also introduce a separate GATv2 model that uses only the Dynamic Graph Attention Network module. This allows us to perform ablation analysis to compare with the GAT model and validate the effectiveness of Dynamic Graph Attention. This also allows us to incorporate the contribution of the learning module to the overall performance of the proposed model.

[0080] 3. Experimental Setup

[0081] To comprehensively evaluate the performance of the anomaly detection model proposed in this study, the following four common evaluation metrics were used: accuracy, precision, recall, and F1 score. These metrics have been widely used in numerous studies and can evaluate the classification ability of a model from different perspectives, especially in cases of class imbalance.

[0082] In this experiment, a two-layer GATv2 structure was selected to extract local and inter-local interaction information from the graph. A multi-head attention mechanism was also used to further capture feature distributions under different semantics. ReLU was used as the activation function in each layer to introduce non-linear transformation and improve feature representation. During training, the Adam optimizer was employed, utilizing its adaptive learning rate to achieve stable gradient descent, with an initial learning rate of 0.0001. Furthermore, to ensure the model can fully aggregate features from different nodes during multi-hop neighborhood information sampling, k=3 was chosen for subgraph sampling, considering 3rd-order neighbor information to better capture complex attack behavior features. For the loss function, a cross-entropy loss function was used for the classification task, ensuring large distances between categories for easy differentiation while reducing the risk of misclassification.

[0083] In our experiments, we found that the above parameter configurations achieved superior detection results on different datasets (NF-BoT-IoT-v2, NF-UNSW-NB15-v2, and NF-ToN-IoT-v2). Some parameters, such as the number of layers and the number of neighborhood sampling steps, were confirmed through multiple rounds of debugging, ensuring both the model's deep feature extraction capabilities and avoiding gradient vanishing or overfitting due to excessive depth. Detailed experimental parameter settings are shown in Table 2.

[0084] Table 2 Experimental parameter settings

[0085] Hyperparameter Values No.layers 2 No.k 3 Learningrate 0.0001 Activationfunc. ReLU Lossfunc CrossEntropyLoss Optimizer Adam

[0086] The dataset was divided into two parts: a training set (70%) and a test set (30%). We implemented our proposed model and training process using Python, PyTorch, PyTorch-geometric, and DGL. Due to the large-scale data involved in this experiment, we used an NVIDIA GeForce RTX 4090 24G GPU.

[0087] 4. Experimental Results

[0088] (1) Binary classification results

[0089] In the binary classification experiments, all models performed well on different datasets. However, overall, the GATv2-GSC method, which combines dynamic graph attention and contrastive learning, demonstrated the best and most stable detection results. Table 3 shows the results of the binary classification experiments.

[0090] Table 3. Binary Classification Results

[0091]

[0092] Taking the NF-BoT-IoT-v2 dataset as an example, GATv2-GSC achieved the highest accuracy (98.69%) and F1 score (98.58%), indicating that the model can not only accurately distinguish between normal traffic and attack traffic, but also has a significant advantage in balancing false positives and false negatives. In contrast, traditional machine learning methods such as XGBoost, while achieving a certain detection level (accuracy of approximately 93.46%), are significantly inferior in recall and F1 score, indicating that tree-based models are insufficient in capturing the dynamic changes of complex network behavior. Meanwhile, other graph neural network methods (such as E-GraphSAGE, Anomaly-E, and GATv2 alone), while outperforming XGBoost in performance, still lag slightly behind GATv2-GSC in some key metrics, fully demonstrating the positive role of contrastive learning in improving feature discrimination capabilities.

[0093] In the NF-UNSW-NB15-v2 dataset, GATv2-GSC achieved near-perfect scores across all metrics (99.86% accuracy, 99.85% F1 score), demonstrating not only the model's high sensitivity to subtle traffic features but also the robustness of the contrastive learning strategy against noise interference. In contrast, while XGBoost and E-GraphSAGE also achieved high accuracy and F1 score, they were slightly less effective at capturing fine-grained feature variations in the dataset. Anomaly-E's relatively low performance on this dataset indicates that strategies relying solely on self-supervised learning have limitations in identifying subtle attack patterns.

[0094] In the NF-ToN-IoT-v2 dataset, GATv2-GSC also demonstrated high detection capabilities, achieving an accuracy of 98.52% and an F1 score of 98.27%, indicating strong robustness in handling diverse and complex traffic characteristics in the industrial IoT environment. While XGBoost and E-ResGAT performed similarly to GATv2-GSC on some metrics, overall, traditional machine learning and some graph neural network methods failed to fully leverage the advantages of multimodal information fusion when facing complex and anomalous traffic, resulting in slightly inferior overall detection performance.

[0095] Overall, the GATv2-GSC model, leveraging the dual advantages of dynamic graph attention and contrastive learning, achieves high accuracy and a high F1 score in binary classification tasks, while also demonstrating excellent robustness and generalization ability. These results fully demonstrate the effectiveness of this method in network intrusion detection, providing a solid theoretical foundation and technical support for practical applications.

[0096] (2) Multi-class results

[0097] In the multi-class classification experiments, the performance of each model showed significant differences on different datasets. Table 4 shows the results of the polyphenol experiments.

[0098] Table 4 Multi-classification results

[0099]

[0100]

[0101] Taking the NF-BoT-IoT-v2 dataset as an example, the traditional XGBoost model only achieved a recall of approximately 78.11% and an F1-score of 75.89%, while graph neural network-based methods such as E-GraphSAGE and Anomaly-E improved the recall to 87.45% and 86.32%, respectively, but their F1-scores still did not reach the optimal level. In contrast, E-ResGAT with residual connections and the standard GATv2 model achieved recalls of 91.85% and 91.52%, respectively, and F1-scores of 90.86% and 92.44%, respectively, indicating that the dynamic attention mechanism improved the ability to identify complex attack types to a certain extent. The GATv2-GSC model proposed in this paper, which combines dynamic graph attention and graph contrastive learning, achieved the highest recall (93.1%) and F1-score (93.12%) on this dataset, showing more balanced and superior classification performance.

[0102] In the NF-UNSW-NB15-v2 dataset, although all models performed well overall, GATv2-GSC slightly outperformed them with a recall of 97.54% and an F1 score of 97.65%. This slight advantage indicates that the method has higher robustness in capturing subtle feature changes in traffic and dealing with noise interference. Similarly, on the NF-ToN-IoT-v2 dataset, the GATv2-GSC model achieved a recall of 93.78% and an F1 score of 92.22%, far exceeding XGBoost and other graph neural network models, fully demonstrating its effective detection capability for diverse abnormal traffic in the industrial IoT environment.

[0103] like Figure 6 As shown, the ROC curves for the multi-class classification of NF-BoT-IoT-v2 are displayed. Analysis of the ROC curves reveals that the curves for GATv2-GSC are close to the upper left corner on all datasets, with an AUC value close to 1.0. In NF-BoT-IoT-v2, the model maintains a detection rate (TPR) exceeding 99.5% even when the false positive rate (FPR) is below 0.5%, significantly outperforming E-GraphSAGE and Anomaly-E, indicating its stronger ability to distinguish highly covert attacks (such as reconnaissance).

[0104] like Figure 7 The figure shows the multi-class ROC curve of NF-UNSW-NB15-v2. In NF-UNSW-NB15-v2, the model achieves a TPR of 99.8% when FPR = 1%, indicating that it can accurately identify multi-stage attacks (such as exploits and fuzzers) while ensuring a low false positive rate.

[0105] like Figure 8 As shown, the ROC curves for the multi-class classification of NF-ToN-IoT-v2 are displayed. The smooth upward trend of the ROC curves in NF-ToN-IoT-v2 further verifies the model's stable detection capability against diverse attacks (such as Scanning and XSS) in industrial scenarios.

[0106] The superior performance of GATv2-GSC is attributed to the synergistic effect of its dynamic graph attention mechanism and contrastive learning. The dynamic attention mechanism (GATv2) effectively captures the temporal evolution characteristics of attack behavior (such as the burstiness of port scanning) through nonlinear weight adjustment, while the Wasserstein distance-based subgraph contrastive learning (GSC) enhances the model's robustness to noise and unknown attack patterns through global distribution alignment. Experimental results demonstrate that this method has significant advantages in handling dynamic topologies, multimodal feature fusion, and class imbalance scenarios, providing a reliable technical path for complex threat detection in IoT environments. Future research could explore lightweight deployment of the model on edge devices to address the computational constraints of real-time detection.

[0107] (3) Ablation test

[0108] To verify the effectiveness of each module in the proposed GATv2-GSC model, we designed an ablation experiment, progressively removing key components of the model. For the GATv2 model, the Graph Contrast Learning (GSC) module was removed; for the GAT model, the Dynamic Graph Attention and Graph Contrast Learning modules were removed. We observed the impact on performance. As shown in Table 3, GATv2 achieved an F1-score of 97.11% in the binary classification task of NF-BoT-IoT-v2, significantly outperforming GAT (93.36%), indicating that the dynamic attention mechanism enhances feature aggregation capabilities through nonlinear interaction modeling. However, GATv2-GSC's F1-score (98.58%) further improved by 1.47% compared to GATv2, demonstrating that the general features extracted by the contrast learning module through unsupervised pre-training effectively compensate for the shortcomings of purely supervised training.

[0109] As shown in Table 4, in multi-class classification tasks, GATv2 achieved an F1-score of 92.44% (NF-BoT-IoT-v2), while GATv2-GSC reached 93.12%. Contrastive learning, by constructing cross-view positive and negative sample pairs, enhanced the model's ability to identify low-frequency attack types (such as "Theft," accounting for 0.01%). For example, in the NF-ToN-IoT-v2 dataset, GATv2-GSC achieved a recall rate of 89.5% for "Ransomware," a 7.4% improvement over GATv2 (82.1%), indicating that contrastive learning alleviated the class imbalance problem.

[0110] In summary, GATv2, as a standalone model, has demonstrated advantages over traditional GNN methods, and its combination with GSC further unlocks the model's potential. Ablation experiments and baseline comparisons jointly prove that the synergistic design of dynamic attention mechanisms and contrastive learning is key to the high performance of GATv2-GSC, providing a new technical path for intrusion detection in complex networks.

[0111] The above descriptions are merely embodiments of the present invention, and common technical solutions or characteristics known in the schemes are not described in detail here. For those skilled in the art, various modifications and improvements can be made without departing from the technical solutions of the present invention, and these should also be considered within the scope of protection of the present invention. These modifications and improvements will not affect the effectiveness of the implementation of the present invention or the practicality of the patent. The scope of protection claimed in this application shall be determined by the content of its claims, and the specific embodiments described in the specification can be used to interpret the content of the claims.

Claims

1. A network intrusion detection method based on dynamic graph attention and contrastive learning, characterized in that, The method comprises the following steps: S1, dynamic graph construction: network traffic data is represented as a heterogeneous graph structure, wherein nodes are composed of tuples of source IP address and port, destination IP address and port, edges represent traffic sessions, and edge attributes include a 43-dimensional feature vector, i.e., protocol type, TCP flag bit, and traffic statistical characteristics; S2, dynamic subgraph sampling: extracting batch edge sets through time window division and associated node sets perform neighbor expansion when the number of nodes is below threshold M generate subgraph with dynamically updated edge weights ;​ S3, GATv2 node coding: dynamic graph attention network GATv2 is used to extract features of subgraph nodes, and attention coefficients are calculated by fusing node features, edge features, and dynamic edge weights, which are represented by the following formula: ； wherein, and a is a learnable parameter, and || denotes feature concatenation. S4, optimal transport based graph contrastive learning: on subgraphs Apply perturbation to generate positive samples Sample negative samples from other time windows Align feature and structure distribution by minimizing Wasserstein distance WD and Gaussian Wasserstein distance GWD: where P is the transmission plan matrix, KL(P) is the entropy regularization term, is the balancing parameter, and are the adjacency matrices of the sub-graphs and positive samples, respectively. Based on fusion distance The InfoNCE loss function is optimized, and the formula of the InfoNCE loss function is as follows: In the formula, τ is a temperature parameter that controls the distribution sharpness of contrastive learning; S5, Edge anomaly classification: combining node embeddings , and OT alignment matrix elements , output edge anomaly probability by MLP classifier: wherein is the classification weight, is the Sigmoid function.

2. The network intrusion detection method based on dynamic graph attention and contrastive learning according to claim 1, characterized in that, The dynamic graph construction in the step S1 specifically comprises: Merging the source IP:port and the destination IP:port into a unique node identifier; Constructing a weighted directed edge based on a communication relationship, and dynamically updating the edge weight based on traffic statistical characteristics in a time window; Using standardization processing to scale numerical features to zero mean and unit variance.

3. The network intrusion detection method based on dynamic graph attention and contrastive learning according to claim 1, characterized in that, The multi-head attention mechanism of GATv2 in the step S3 adopts K independent attention heads for parallel calculation, and finally the node representation is fused by splicing: 。 4. The network intrusion detection method based on dynamic graph attention and contrastive learning according to claim 1, characterized in that, The perturbation strategy in the step S4 comprises: with probability communication terminal caused by a random edge deletion attack; in probability masking some feature dimensions to enhance noise robustness; Local subgraph sampling based on random walk to preserve key connection patterns.

5. The network intrusion detection method based on dynamic graph attention and contrastive learning according to claim 1, characterized in that, The Wasserstein distance calculation in the step S4 solves the optimal transport matrix P by using the Sinkhorn algorithm, and the entropy regularization term KL(P) is defined as ​ 6. The network intrusion detection method based on dynamic graph attention and contrastive learning according to claim 1, characterized in that, After the edge anomaly probability is output by the MLP classifier in the step S5, the decision boundary is adjusted according to the dynamic classification threshold, and the dynamic classification threshold is adaptively adjusted according to the normal traffic statistical distribution to reduce the false positive rate.

7. The network intrusion detection method based on dynamic graph attention and contrastive learning according to any one of claims 1-6, characterized in that, The method is applied to a computer processor program, and the method is realized by executing the computer processor program.

8. The network intrusion detection method based on dynamic graph attention and contrastive learning according to any one of claims 1-6, characterized in that, The method is applied to computer instructions on a computer readable storage medium, and the method is realized by executing the computer instructions on the readable storage medium.

9. A network intrusion detection system, characterized by The system comprises a data preprocessing module, a GATv2-GSC detection engine, and a real-time alarm module; The data preprocessing module is used to convert NetFlow data into a heterogeneous graph structure as claimed in any one of claims 1-6; The GATv2-GSC detection engine is used to execute the detection method as claimed in any one of claims 1-6; The real-time alarm module is used to generate a security alarm for traffic with an abnormal edge score exceeding a threshold value.

10. The network intrusion detection system of claim 9, wherein, The system is deployed on an edge computing device, reduces the consumption of computing resources through model pruning and quantization technology, and meets the real-time detection requirements of industrial Internet of Things.

Images