Graph-guided contrastive transformer architecture for robust and explainable network intrusion detection

Abstract

Intrusion detection systems (IDS) are very instrumental in protecting contemporary network infrastructures against the ever-advancing cyberattacks. Conventional signature-based and machine learning-enabled IDS solutions frequently have difficulty when it comes to high false-positive rates, inability to flexibly adapt to novel attacks, and the lack of support for complex traffic dynamics. New deep learning architectures have better detection properties, yet are limited by feature overlap, temporality, and lack of extensiveness to generalization in changing network conditions. To overcome these issues, this paper presents a new graph-guided contrastive transformer-based intrusion detection system (GCT-IDS) which aims at improving detection accuracy and robustness and preserving real-time feasibility. The framework combines feature interaction by graph modeling, contrastive representation learning, and a sparse self-attention transformer to effectively learn global traffic relationships and behavioral variations. The CSE-CIC-IDS2018 data is used to test the proposed method in real network conditions.