# Network intrusion detection using a hybrid graph-based convolutional network and transformer architecture

## TL;DR

This paper introduces a new intrusion detection model that uses a combination of graph-based and transformer techniques to detect network attacks more effectively.

## Contribution

The novel contribution is a hybrid model combining graph convolutional and transformer layers for intrusion detection.

## Key findings

- The model achieved 84.7% accuracy on training data, 96.75% on validation, and 96.94% on testing data.
- Combining graph learning with deep learning improves detection of complex intrusion patterns.
- The model is called GConvTrans and uses computational graphs from network traffic data.

## Abstract

Cloud computing continues to expand rapidly due to its ability to provide internet-hosted services, including servers, databases, and storage. However, this growth increases exposure to sophisticated intrusion attacks that can evade traditional security mechanisms such as firewalls. As a result, network intrusion detection systems (NIDS) enhanced with machine learning and deep learning have become increasingly important. Despite notable advancements, many AI-based intrusion detection models remain limited by their dependence on extensive, high-quality attack datasets and their insufficient capacity to capture complex, dynamic patterns in distributed cloud environments. This study presents a hybrid intrusion detection model that combines a graph convolutional layer and a transformer encoder layer to form deep neural network architecture. Using the CIC-IDS 2018 dataset, tabular network traffic data was transformed into computational graphs, enabling the model called “GConvTrans” to leverage both local structural information and global context through graph convolutional layers and multi-head self-attention mechanisms, respectively. Experimental evaluation shows that the proposed GConvTrans obtained 84.7%, 96.75% and 96.94% accuracy on the training, validation and testing set respectively. These findings demonstrate that combining graph learning techniques with standard deep learning methods can be robust for detecting complex network intrusion. Further research would explore other datasets, continue refining the proposed architecture and its hyperparameters. Another future research direction for this work is to analyze the architecture on other graph learning tasks such as link prediction.