Towards Graph Embedding-Based Early and Reliable Network Intrusion Detection

The stability and security of a network depends on the prompt and precise identification of intruders. Conventional machine learning and deep learning technologies are the backbone of current network intrusion detection algorithms, which categorize intrusions according to statistical characteristics of network flows. Since feature extraction is dependent on expert knowledge, it cannot be executed until network flows have concluded, postponing intrusion detection. The current approaches of graph-based intrusion detection are laborious and complicated since they rely on worldwide network traffic to build communication graphs. In addition, current intrusion detection systems that rely on graphs or deep learning need very large training sets. This study presents Graph2vec+RF, a graph embedding technology-based approach to network intrusion detection that is both early and accurate. Instead, we use graph2vec, an embedding technique, to learn the flow graph’s vector representation, form a flow graph from the first few interaction packets for every bidirectional network flow, and then use Random Forest (RF) to categorize the graph vectors. With Graph2vec+RF, you may perform early and effective network intrusion detection utilizing a small number of the first interactive packets per bidirectional system flow. It automatically extracts flow graph characteristics using subgraph structures and doesn’t need enormous training sets. Our suggested Graph CNN with SVM achieves better accuracy, recall, precision, as well as F1-score than the state-of-the-art approaches, as shown by our experimental findings on the CIC-IDS2017 as well as UNSW-NB15 datasets.