Intrusion Detection Method Based on a Dual-channel Graph Neural Network

Graph neural networks(GNNs) is a network model used for graph structure, which is different from traditional deep learning methods in that GNNs can be applied to some non-Euclidean data, such as molecular structures and social networks, whereas for computer networks, the network communication between those hosts can be expressed very naturally via graph structure data; thus, GNNs can be effectively used in the intrusion detection. At present, there are many GNN-based intrusion detection methods, but most of them focus on message passing and aggregation between nodes, and we hope to be able to focus on the message passing and aggregation between nodes and to fully mine the information of the nodes themselves to obtain more important information to help us identify abnormal traffic. To solve this problem, we propose an intrusion detection method based on a dual-channel graph neural network. First, we use a dual-channel model. In the first channel, we use the graph neural network to learn the topological information of the graph structure to obtain the node embedding. In the second channel, we use the deep learning method to fully mine the node features to obtain the node feature representation. Then, we use the node embedding and node feature representation to obtain the final representation of the node through the attention mechanism. By using the attention mechanism, we can learn the importance of the two channels to obtain more important characteristic information. We also conducted multi-classification experiments on two new data sets, and the results showed that our method has good detection capabilities.