The last decades have seen a growth in the number of cyber-attacks with
severe economic and privacy damages, which reveals the need for network
intrusion detection approaches to assist in preventing cyber-attacks and
reducing their risks. In this work, we propose a novel network representation
as a graph of flows that aims to provide relevant topological information for
the intrusion detection task, such as malicious behavior patterns, the relation
between phases of multi-step attacks, and the relation between spoofed and
pre-spoofed attackers activities. In addition, we present a Graph Neural
Network (GNN) based framework responsible for exploiting the proposed graph
structure to classify communication flows by assigning them a maliciousness
score. The framework comprises three main steps that aim to embed nodes
features and learn relevant attack patterns from the network representation.
Finally, we highlight a potential data leakage issue with classical evaluation
procedures and suggest a solution to ensure a reliable validation of intrusion
detection systems performance. We implement the proposed framework and prove
that exploiting the flow-based graph structure outperforms the classical
machine learning-based and the previous GNN-based solutions.

我们提出了一种新颖的网络表示形式作为流图，旨在为入侵检测任务提供相关的拓扑信息，以及通过基于图结构的神经网络框架将通信流分类为恶意得分。我们还强调了传统评估程序可能存在的数据泄露问题，并提出了解决方案以确保入侵检测系统性能的可靠验证。通过实施提出的框架，证明利用基于流的图结构优于经典的基于机器学习和先前的基于图神经网络的解决方案。