[论文解读] XG-NID: Dual-Modality Network Intrusion Detection using a Heterogeneous Graph Neural Network and Large Language Model

Yasir Ali Farrukh, Syed Wali+2 more|arXiv (Cornell University)|Aug 27, 2024

Network Security and Intrusion Detection被引用 5

一句话总结

XG-NID 将流量级和分组级数据融合到异质图中，并使用带有基于大语言模型（LLM）解释的 HGNN 进行实时、可解释的网络入侵检测，在多类分类中实现 97% 的 F1 分数。

ABSTRACT

In the rapidly evolving field of cybersecurity, the integration of flow-level and packet-level information for real-time intrusion detection remains a largely untapped area of research. This paper introduces "XG-NID," a novel framework that, to the best of our knowledge, is the first to fuse flow-level and packet-level data within a heterogeneous graph structure, offering a comprehensive analysis of network traffic. Leveraging a heterogeneous graph neural network (GNN) with graph-level classification, XG-NID uniquely enables real-time inference while effectively capturing the intricate relationships between flow and packet payload data. Unlike traditional GNN-based methodologies that predominantly analyze historical data, XG-NID is designed to accommodate the heterogeneous nature of network traffic, providing a robust and real-time defense mechanism. Our framework extends beyond mere classification; it integrates Large Language Models (LLMs) to generate detailed, human-readable explanations and suggest potential remedial actions, ensuring that the insights produced are both actionable and comprehensible. Additionally, we introduce a new set of flow features based on temporal information, further enhancing the contextual and explainable inferences provided by our model. To facilitate practical application and accessibility, we developed "GNN4ID," an open-source tool that enables the extraction and transformation of raw network traffic into the proposed heterogeneous graph structure, seamlessly integrating flow and packet-level data. Our comprehensive quantitative comparative analysis demonstrates that XG-NID achieves an F1 score of 97\% in multi-class classification, outperforming existing baseline and state-of-the-art methods. This sets a new standard in Network Intrusion Detection Systems by combining innovative data fusion with enhanced interpretability and real-time capabilities.

研究动机与目标

• 通过整合流量级和分组级信息实现实时检测来推动改进的入侵检测系统（NIDS）。
• 开发一个异质图表示以融合网络流量的双模态信息。
• 设计一个异质图神经网络以实现图级分类，从而实现实时推断。
• 通过大型语言模型提供人类可读的解释和补救行动建议。
• 引入 GNN4ID，以促进将流量提取并转换为所提出的图结构。

提出的方法

• 将流量级和分组级数据融合为一种两类节点/边的异质图。
• 开发基于 GAT 的异质图神经网络用于具有节点和边特征的图级分类。
• 引入时间性可解释特征以捕捉跨流的时序模式。
• 整合 Integrated Gradient Explainer 与 Generative Explainer 以生成局部解释和可读的修复提示。
• 创建 GNN4ID，这是一个将原始流量转换为所提出的异质图的开源工具。
• 引入一组新的基于时间的流特征以帮助上下文和可解释推断。

Fig. 1.: Illustration of the proposed framework ”XG-NID”. The framework, depicted here, demonstrates its capability to better identify network attacks either based on flow or packet-level information with detailed contextual information and potential remedial actions. The framework comprises of six

实验结果

研究问题

• RQ1 在异质图中对流量和分组数据进行双模态融合，是否能提升入侵检测性能并实现实时推断？
• RQ2 如何利用时序特征和有效负载内容来提升 NIDS 预测的可解释性？
• RQ3 大型语言模型在为检测到的威胁生成可操作、易懂的解释和修复建议方面能发挥怎样的作用？

主要发现

• XG-NID 在所评估数据集的多类分类中达到 97% 的 F1 分数。
• 该框架通过异质图结构和图级分类实现实时推断。
• 基于时序信息的一组新的流特征增强了上下文相关和可解释的推断。
• GNN4ID 提供了一个将原始流量提取并转换为所提出的异质图的开源管道。
• 集成的可解释性方法将来自 LLM 的上下文信息与基于特征的解释结合起来。
• 系统输出详细、可读的解释和建议的纠正措施。

Fig. 2.: Illustration of graph structure, fusing flow and packet level data modalities. The features of edges utilized in the generation of graph structures are highlighted on each edge. For ’link’ edge we are utilizing only one feature whereas for the contain edge the number of features are four.