Semantic-guided edge enhancement for graph self-supervised learning in network intrusion detection

This paper proposes a semantic-guided edge enhancement approach for graph self-supervised learning in network intrusion detection. It aims to address several issues that the existing intrusion detection systems face, such as relying on a large amount of labeled data, struggling to capture complex network topology, and overlooking the internal information of edges. Concretely, to improve the discriminability of the network flow graph, we introduce a new node‑edge‑node attention algorithm for graph enhancement representation. It integrates edge-aware attention and intra-edge feature self-attention collaboratively, thereby assists the model to perceive complex attack behaviors at multiple granular levels effectively. Meanwhile, we devise a semantic-aware contrastive learning framework that collaboratively enhances nodes and edges, which enables view augmentation without corrupting the original graph semantics, forcing the model to learn more robust and discriminative features. Consequently, our method overcomes the scarcity of labeled samples remarkably. In the experiments, seven SOTA methods were contrasted with the proposed one on four public datasets. The results show that the proposed method outperforms existing mainstream models in accuracy, precision, recall, and F1-score, demonstrating its efficient detection performance and strong generalization capability.