PPT-GNN: A Practical Pretrained Spatio-Temporal Graph Neural Network for Network Security

Recent works have demonstrated the potential of Graph Neural Networks (GNNs) for network intrusion detection. Despite their advantages, a large gap can be observed between theoretical evaluation and practical deployment, mostly due to evaluation settings that do no not reflect a real-world context. Many models are trained and evaluated on overlapping subgraphs, randomly sampled from large, static network traffic graphs. This approach introduces performance overestimation, data leakage and does not consider the valuable temporal component in network traffic. Additionally, most proposals rely on datasets with features unattainable in real-time and face additional challenges due to scarcity of high-quality labeled network traffic data. This limits the models' ability to generalize across different network settings, requiring costly retraining for each new deployment. To address these issues, we introduce PPT-GNN, a practical spatio-temporal GNN for intrusion detection. PPT-GNN captures the spatio-temporal dynamics of network attacks, enhancing detection performance while being trained under realistic conditions with practical, attainable data features. Through self-supervised pretraining, PPT-GNN further improves performance and reduces reliance on labeled data. We evaluate PPT-GNN on three public datasets and show that it significantly outperforms state-of-the-art models, such as E-ResGAT and E-GraphSAGE, with an average multi-class <tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">$\mathbf{F 1}$</tex> score improvement of <tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">$\mathbf{1 0. 3 8}$</tex> percent. Finally, we show that a pretrained PPT-GNN can easily be fine-tuned to unseen networks with minimal labeled examples. This highlights the potential of PPT-GNN as a general, large-scale pretrained model that can effectively operate in diverse network environments.