waimorris / anomal-e

A PyTorch implementation of of Anomal-E.

This is a PyTorch implementation of the paper Anomal-E.

Abstract

This paper investigates graph neural networks (GNNs) applied for self-supervised intrusion and anomaly detection in computer networks. GNNs are a deep learning approach for graph-based data that incorporate graph structures into learning to generalise graph representations and output embeddings. As traffic flows in computer networks naturally exhibit a graph structure, GNNs are a suitable fit in this context. The majority of current implementations of GNN-based network intrusion detection systems (NIDSs) rely on labelled network traffic. This limits the volume and structure of input traffic and restricts the NIDSs’ potential to adapt to unseen attacks. These systems also rely on the use of node features, which may reduce the detection accuracy of these systems, as important edge (packet-level) information is not leveraged. To overcome these restrictions, we present Anomal-E, a GNN approach to intrusion and anomaly detection that leverages edge features and a graph topological structure in a self-supervised manner. This approach is, to the best of our knowledge, the first successful and practical approach to network intrusion detection that utilises network flows in a self-supervised, edge-leveraging GNN. Experimental results on two modern benchmark NIDS datasets display a significant improvement when using Anomal-E compared to raw features and other baseline algorithms. This additionally posits the potential Anomal-E has for intrusion detection on real-world network traffic.

Prerequisites

• Pytorch
• DGL
• PyoD

If you think this work is helpful, please cite

@article{caville2022anomal,
  title={Anomal-E: A self-supervised network intrusion detection system based on graph neural networks},
  author={Caville, Evan and Lo, Wai Weng and Layeghy, Siamak and Portmann, Marius},
  journal={Knowledge-Based Systems},
  volume={258},
  pages={110030},
  year={2022},
  publisher={Elsevier}
}

anomal-e's Issues

best_dgi.pkl

where is the best dgi svp

Experimental environment settings

May I ask you the tools and versions of the running environment?

Question about the source of the dataset

Hello, while reproducing your code, I found that you were using a dataset named "NF-CSE-CIC-IDS2018-v2.csv". I downloaded the dataset with that name online and found that it has many sub files, and the column labels in all files do not correspond to the content of your code. If it's convenient for you, could you share the dataset source used in this code? This will play a very important role in the reproduction of the code. Thank you！

Undirected graph to directed graph

Will the change from an undirected graph to a directed graph result in the number of edges not equal to the number of samples affecting the experimental results?

Hello,summary vector is averaging node embedding or edge embedding.

I want to dataset.

I want to dataset.Thank you very much!

codes for dgi and graphSAGE applied to the two data 2018 and 2015

could you plz provide me with the codes for dgi and graphSAGE that you have applied to the two datasets 2018 and 2015 in your excellent paper. thank you

Hello, Can you share your dataset?

dataset

hello could you give us the data