Recent works have demonstrated the potential of Graph Neural Networks (GNN)
for network intrusion detection. Despite their advantages, a significant gap
persists between real-world scenarios, where detection speed is critical, and
existing proposals, which operate on large graphs representing several hours of
traffic. This gap results in unrealistic operational conditions and impractical
detection delays. Moreover, existing models do not generalize well across
different networks, hampering their deployment in production environments. To
address these issues, we introduce PPTGNN, a practical spatio-temporal GNN for
intrusion detection. PPTGNN enables near real-time predictions, while better
capturing the spatio-temporal dynamics of network attacks. PPTGNN employs
self-supervised pre-training for improved performance and reduced dependency on
labeled data. We evaluate PPTGNN on three public datasets and show that it
significantly outperforms state-of-the-art models, such as E-ResGAT and
E-GraphSAGE, with an average accuracy improvement of 10.38%. Finally, we show
that a pre-trained PPTGNN can easily be fine-tuned to unseen networks with
minimal labeled examples. This highlights the potential of PPTGNN as a general,
large-scale pre-trained model that can effectively operate in diverse network
environments.

介绍了一种实用的时空图神经网络（PPTGNN），用于入侵检测，能够实现接近实时的预测，并更好地捕捉到网络攻击的时空动态。通过自我监督预训练，在减少对标记数据依赖的同时提高性能。在三个公共数据集上对 PPTGNN 进行评估，结果显示其明显优于 E-ResGAT 和 E-GraphSAGE 等最先进的模型，平均精度提高了 10.38％。最后，展示了经过预训练的 PPTGNN 可以在最少标记示例的情况下轻松调整到看不见的网络上，突显了 PPTGNN 作为通用大规模预训练模型在多样网络环境中的潜力。