PPT-GNN: A Practical Pre-Trained Spatio-Temporal Graph Neural Network for Network Security

TL;DR

PPT-GNN is a practical, pre-trained spatio-temporal graph neural network designed for network intrusion detection, enabling near real-time predictions and strong generalization across diverse networks.

Contribution

Introduces PPTGNN, a novel pre-trained GNN model that captures spatio-temporal dynamics for intrusion detection with improved speed and adaptability.

Findings

Outperforms state-of-the-art models with 10.38% higher accuracy

Enables effective fine-tuning on unseen networks with minimal data

Achieves near real-time prediction capabilities

Abstract

Recent works have demonstrated the potential of Graph Neural Networks (GNN) for network intrusion detection. Despite their advantages, a significant gap persists between real-world scenarios, where detection speed is critical, and existing proposals, which operate on large graphs representing several hours of traffic. This gap results in unrealistic operational conditions and impractical detection delays. Moreover, existing models do not generalize well across different networks, hampering their deployment in production environments. To address these issues, we introduce PPTGNN, a practical spatio-temporal GNN for intrusion detection. PPTGNN enables near real-time predictions, while better capturing the spatio-temporal dynamics of network attacks. PPTGNN employs self-supervised pre-training for improved performance and reduced dependency on labeled data. We evaluate PPTGNN on three public datasets and show that it significantly outperforms state-of-the-art models, such as E-ResGAT and E-GraphSAGE, with an average accuracy improvement of 10.38%. Finally, we show that a pre-trained PPTGNN can easily be fine-tuned to unseen networks with minimal labeled examples. This highlights the potential of PPTGNN as a general, large-scale pre-trained model that can effectively operate in diverse network environments.