Graph Neural Networks with scattering transform for network anomaly detection

Abstract

As cyber-attacks become increasingly sophisticated and frequent, the demand for advanced and proactive Network Intrusion Detection Systems (NIDS) has become more urgent than ever. To address critical shortcomings in existing NIDS approaches, such as high false-positive rates that trigger unnecessary alerts, inability to capture complex relationships between network nodes, and oversimplified node representation initialization that fails to reflect real-world network behaviors, we introduce a novel solution called Scattering Transform Edge Graph (STEG). STEG harnesses the wavelet scattering transform to extract edge feature information and employs a graph-based representation to effectively capture the topological relationships between network nodes. Additionally, we enhance STEG by incorporating node embedding techniques like DeepWalk for initializing node representations, moving beyond conventional uniform initialization methods. Comprehensive evaluations on benchmark NIDS datasets reveal that STEG outperforms current state-of-the-art methods. Moreover, the integration of Node2Vec-based initialization further boosts performance, marking a significant advancement in the effectiveness of network intrusion detection systems.