Aug 2026· Journal of King Saud University: Computer and Information Sciences· Vol 38· 0 citations· 48 references
TL;DR
GDAE is proposed, a multi-task self-supervised one-class anomaly detection framework for network traffic graphs, with strong stability and efficiency, offering a new pathway for lightweight, robust self-supervised one-class intrusion detection.
Abstract
To address the limitations of intrusion detection under unknown attacks and label scarcity, this paper proposes GDAE, a multi-task self-supervised one-class anomaly detection framework for network traffic graphs. It constructs an edge-level directed graph from NetFlow, employs E-GraphSAGE for structure-aware edge embeddings, and captures multi-scale normal patterns via local structure and global semantic autoencoders with a structure consistency prediction task. To compensate for the lack of negative samples, a dual-path pseudo-anomaly generation mechanism using feature perturbation and structural discarding is designed, with an anomaly discriminator to learn the normal-abnormal boundary. Training employs Kendall uncertainty for adaptive multi-task loss weighting and extreme value theory for threshold estimation, demonstrating strong performance on two large-scale benchmark datasets. Experiments on NF-UNSW-NB15-v2 and NF-CSE-CIC-IDS2018-v2 demonstrate GDAE’s superior performance over unsupervised and graph-based baselines in PR-AUC and Macro-F1, with strong stability and efficiency, offering a new pathway for lightweight, robust self-supervised one-class intrusion detection.
Network Traffic Monitoring and Analysis (NTMA) is increasingly important given the growing volume of network data and the associated cyber threats. Effective NTMA involves analyzing data packets for performance optimization, security, and policy compliance. In recent years, Machine Learning (ML) has shown high performance in this domain; however, traditional ML methods rely heavily on labeled data, which is costly and scarce. This paper proposes AE-SSL (Autoencoding-Based Self-Supervised Learning), a denoising autoencoder framework that enhances the representation of IoT-centric network traffic patterns using unlabeled data. AE-SSL employs two complementary pretext tasks tailored to tabular data (binary mask prediction and corrupted-feature reconstruction), and improves the performance of various classification models, including traditional and deep learning-based models. In our IoT-centric evaluation on two datasets, AE-SSL significantly improves classification metrics compared to supervised learning approaches. For example, on the ACI IoT 2023 dataset (100 pretraining epochs), AE-SSL improves AdaBoost macro-precision from 70.3% to 83.0% and SVC accuracy from 86.0% to 96.4%. On the CICIoT 2023 dataset (100 epochs), AdaBoost accuracy improves from 95.1% to 96.9%, and Logistic Regression accuracy from 73.7% to 76.2%. Additionally, an ablation study on key parameters reveals their impact on model performance, providing insights into optimizing self-supervised learning for network traffic analysis. These findings point to the potential of self-supervised techniques for IoT-centric NTMA; generalization to enterprise, mobile, and cloud traffic remains to be established and is left to future work.
Mahmoud Abbasi, A. Shahraki, Marta Plaza-Hernández et al.· IEEE Open Journal of the Com...· 0 citations
Network intrusion detection based on deep learning is often limited by severe class imbalance and the independent treatment of network flows, which restricts the recognition of minority and coordinated attacks. This paper proposes MSC-TGF, a dual-view intrusion detection framework that integrates multi-scale CNN–Transformer feature learning with graph-augmented gated fusion. The model first employs parallel one-dimensional convolutions to capture local traffic patterns at different receptive fields, and then uses a Transformer encoder to model global dependencies among flow features. A batch-level k-nearest-neighbor graph is further constructed from the learned flow representations, and graph convolution is applied to aggregate inter-flow relational information. The sequence-level and graph-enhanced representations are adaptively combined through a learnable gated fusion module. To mitigate severe class imbalance, a two-stage sampling strategy guarantees minimum coverage for rare attack classes while preserving the relative distribution of the remaining attack traffic. Experiments on the full CSE-CICIDS2018 dataset, containing more than 16 million flow records consolidated into seven traffic categories, show that MSC-TGF achieves 96.67% accuracy and a macro-F1 score of 0.8408. It achieves competitive overall performance and provides notable improvements for minority attacks such as Web Attack and Infiltration. Ablation results further verify the complementary contributions of multi-scale convolution, self-attention, and graph-based relational modeling.
Kuiping Din, Rong Fan, Fanlin Ma et al.· 2026 8th International Confe...· 0 citations
Recent network traffic detection systems tend to perform well when identifying known attacks, yet their effectiveness drops significantly when faced with previously unseen malicious behavior. This issue becomes particularly important in zero-day scenarios, where predefined signatures and attack- specific patterns are either unavailable or unreliable. In this study, we explore a graph-based approach for zero-day malicious traffic detection. Network flows are first converted into traffic graphs, then encoded using self-supervised representation learning, and finally evaluated through post-hoc distance-based scoring methods. Instead of limiting the analysis to a single benchmark, we examine the proposed framework across three widely used datasets—USTC-TFC2016, CTU-13, and CIC-IDS2017—while focusing on key factors such as scorer design, graph construction, sampling strategy, and robustness under different evaluation settings. The proposed framework integrates self-supervised graph representation learning with lightweight zero-day scoring techniques, including centroid distance, Mahalanobis distance, and k-prototype minimum distance. The results indicate that the choice of scoring method has a significant impact on generalization performance. On USTC-TFC2016, the framework performs particularly well, with k-prototype scoring achieving the best overall results, while Mahalanobis distance also remains highly competitive. For CTU- 13, the findings indicate that mixed-traffic graph construction poses notable challenges; however, applying chunk purity filtering yields a clear performance improvement. In the case of CIC-IDS2017, adopting train- aware balanced chunk sampling enhances both overall accuracy and consistency across folds, suggesting that graph construction and sampling strategies play a role as important as the encoder itself in achieving reliable zero-day detection. Across all three datasets, a consistent pattern emerges: graph-based zero-day detection is both feasible and effective, but its success strongly depends on how traffic is segmented, represented, and evaluated. Additional ablation studies—covering training epochs, chunk size, number of sampled graphs, and random seed variations—further confirm the robustness of the proposed approach. Notably, increasing training depth proves beneficial, whereas simply increasing the number of sampled graphs per capture does not necessarily yield better results. Overall, this work presents a practical graph- based pipeline for zero-day traffic detection and provides a detailed empirical analysis of the conditions under which such methods can generalize effectively across diverse and heterogeneous malicious traffic datasets.
Dynamic networks are being applied in many domains, from social media to logistics systems, each with their own set of special characteristics. A model employed on this type of data must capture the duality between temporal/structural and feature-based information. Yet state-of-the-art deep learning models often struggle to learn especially short-term behavioral interaction signals, such as sender intensity or interaction inertia, directly from raw event streams. To address this gap, we propose a statistical feature augmentation method that explicitly encodes behavioral interaction statistics into the input feature space. We evaluate our proposed method on an anomaly detection task across three real-world datasets (Reddit, Wikipedia, MOOC) and seven models spanning both continuous-time and discrete-time architectures. As a baseline, we apply the same models trained on the original embeddings. Our results show, that augmentation consistently improves detection performance. Beyond performance, the enriched input enables fine-grained post-hoc analysis of behavioral importance, since each statistic occupies a dedicated input dimension. In particular, this work showcases a promising approach for merging classical network analysis with deep learning.
Philipp Schlinge, Jean-Luc Schnipper, Martin Atzmueller· 0 citations
A novel framework, Generate and Filter graph learning for Graph Anomaly Detection (GFGAD), which generates a diverse set of synthetic anomalies with enriched feature and structural information to balance the data distribution and significantly outperforms state-of-the-art baselines.
Mengyu Li, Yonghao Liu, Ximing Li et al.· IEEE Transactions on Pattern...· 0 citations
Zero-day attacks are among the most serious problems in today’s network security because these attacks exploit unknown vulnerabilities and are able to evade classical signature-based intrusion detection systems. Recently, great success has been achieved in the application of deep learning, especially unsupervised deep autoencoders, in detecting anomalous patterns in the traffic data without relying on labeled attack data. The autoencoders are able to learn the representation of normal traffic and detect anomalies based on reconstruction errors.
This review presents a thorough examination of the existing unsupervised deep autoencoder-based methods and their combination models proposed for zero-day anomaly detection in network traffic. The relevant work is critically analyzed from the perspective of model design, datasets, validation practices, and the ability to handle unknown anomalies. The recent advancements in the field with the evolution of convolutional, variational, temporal, and attention-driven autoencoders are also presented. Although these models demonstrated excellent results, the problem of high false positives, unstandardized zero-day validation, lack of interpretability, and practical deployability limitations exists. Finally, the discussion ends with addressing future directions toward an adaptive and interpretable autoencoder-based intrusion detection system.
Isamaliya Kajal Kanubhai· Global Journal of Computer S...· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
