摘要：

网络攻击形式日益多样化, 传统的入侵检测方法在捕捉复杂网络流量中的时空特征方面存在一定局限性。大多数传统方法主要依赖于静态特征分析, 难以适应动态网络环境下的多变入侵行为。同时, 现有的深度学习方法在分析网络流量时, 往往忽视了网络节点间的拓扑结构以及流量的时间动态变化。因此, 提出一种基于动态时空图神经网络(GNN)的入侵检测方法DSTG-IDS。通过时间窗口对网络流量进行分段, 将每个时间段内的数据包建模为图中的节点, 并基于源IP和目标IP的关系建立连接, 构建出时序上的动态图序列。为了更好地捕捉流量的时序特征, 对图数据进行时间位置编码, 以增强不同时间段内节点的时序信息表达能力。在模型设计上, 首先利用图卷积网络(GCN)提取网络流量的空间特征, 并结合图注意力网络(GAT)提升对关键节点信息的关注能力; 其次, 通过双向门控循环单元(Bidirectional GRU)对流量的时间序列进行建模, 有效捕捉数据随时间变化的动态特征; 最后, 利用多头注意力机制融合时空特征并进行分类。在BoT-IoT、ToN-IoT和NF-CSE-CIC-IDS2018这3个广泛使用的数据集上进行实验, 结果表明, 在多分类实验中, DSTG-IDS的准确率分别达到了99.69%、98.61%和93.26%, 相较其他入侵检测方法, DSTG-IDS在准确率、召回率、误报率(FAR)、F1值等指标上均具有明显优势。

关键词: 入侵检测, 时空图神经网络, 双向门控循环单元, 图注意力网络, 动态时空图, 多头注意力机制

Abstract:

Cyberattacks are becoming increasingly diverse, and traditional intrusion detection methods exhibit limitations in capturing the spatio-temporal characteristics of complex network traffic. Most traditional methods rely primarily on static feature analysis, making it difficult to adapt to the ever-changing intrusion behaviors in dynamic network environments. When analyzing network traffic, existing deep learning methods often overlook the topological structure between network nodes and the temporal dynamics of traffic. To address these issues, this paper proposes a novel intrusion detection method based on a dynamic spatio-temporal Graph Neural Network (GNN), named DSTG-IDS. By segmenting network traffic through time windows, data packets within each time period are modeled as nodes in a graph, and connections are established based on the relationship between the source and destination IP, thereby constructing a sequence of dynamic graphs over time. To better capture the temporal characteristics of traffic, graph data are encoded with a temporal position to enhance the temporal information expression ability of the nodes within different time periods. In terms of model design, first, Graph Convolutional Network (GCN) are utilized to extract the spatial features of network traffic, and Graph Attention Network (GAT) are incorporated to enhance the focus on key node information. Second, Bidirectional Gated Recurrent Unit (Bidirectional GRU) are employed to model the temporal sequence of traffic, effectively capturing the dynamic characteristics of data changes over time. Finally, a multi-head attention mechanism is utilized to fuse spatio-temporal features and perform classification. Experiments on three widely used datasets—BoT-IoT, ToN-IoT, and NF-CSE-CIC-IDS2018—demonstrate that DSTG-IDS achieves accuracies of 99.69%, 98.61%, and 93.26%, respectively. Compared with other intrusion detection methods, DSTG-IDS exhibits significant advantages in terms of accuracy, recall, False Alarm Rate (FAR), and F1 value.

Key words: intrusion detection, spatio-temporal Graph Neural Network (GNN), Bidirectional Gated Recurrent Unit (Bidirectional GRU), Graph Attention Network (GAT), dynamic spatio-temporal graph, multi-head attention mechanism