Abstract: In recent years, cyberattacks have become increasingly frequent and sophisticated, causing economic losses and security risks for both nations and enterprises. Traditional attack detection methods analyze attack behaviors by constructing source graphs, but this approach loses some semantic information when describing attack behaviors as simple graphs, leading to poor detection performance. This study proposes a network intrusion detection model based on temporal information graph autoencoders, abbreviated as TIGAE. TIGAE generates multiple source graphs through a refined graph construction method, comprehensively recording the interaction behaviors of system entities. Subsequently, an improved linear graph algorithm was devised to transform complex graphs into simpler ones, enhancing the graph structure while preserving the original system behaviour information. A graph autoencoder was then employed to learn benign system behaviour. The experimental results on the three datasets show that the Precision increases by an average of 0.65%, the F1-Score increases by an average of 0.68%, the Recall increases by an average of 1.07%, and the FPR decreases by an average of 0.40%. Experiments demonstrate that TIGAE outperforms existing state-of-the-art methods across multiple attack detection metrics.

摘要： 近年来，网络攻击日益频繁且手段日益复杂，给国家和企业造成经济损失与安全风险。传统攻击检测方法通过构建来源图分析攻击行为，但这种方法将攻击行为描述为简单图时会丢失部分语义信息，导致检测性能不佳。本研究提出一种基于时序信息图自编码器的网络入侵检测模型，简称TIGAE。TIGAE通过细化图构建方法生成多重来源图，完整记录系统实体交互行为。随后改进了线型图算法将多重图转换为简单图，在增强图结构的同时保留原始系统行为信息，并运用图自编码器学习良性系统行为。在三个数据集上的实验结果显示，Precision平均提升0.65%，F1-Score平均提升0.68%，Recall平均提升1.07%，FPR则平均降低0.40%。实验证明，TIGAE在多项攻击检测指标上均优于现有最先进方法。