<p>As network scale and complexity increase, traditional Intrusion Detection Systems (IDS) face significant challenges in dealing with diverse attacks and scarce labeled data. To address this, this paper proposes a novel two-phase graph neural network (GNN)-based intrusion detection framework–THC-IDS, integrating self-supervised pre-training with supervised downstream classification, and is designed to leverage high-performance computational resources for the scalable analysis of massive network flows. The framework comprises three core modules: (1) The Hebbian-enhanced Attention (HEA) module leverages Hebbian principles to capture weak co-activation patterns, preventing transient attack features from being over-smoothed during spatial aggregation via GPU-friendly localized matrix operations. (2) The Dynamic Denoising Temporal Contrastive Loss (DDTCL) module introduces an inverse dynamic weighting mechanism to mitigate erroneous supervision signals, concentrating learning on informative temporal mutations. (3) The Cluster-Center Compactness–Separation Loss (CCCSL) module provides label-free prototype regularization, establishing a linearly separable representation for detecting complex, long-tailed attacks. Experiments on four large-scale benchmark datasets show that THC-IDS achieves a 99.68% F1 score in binary classification, and weighted average F1 scores of 98.86% and 97.67% in multi-class tasks, achieving highly competitive performance compared to existing state-of-the-art methods. By decoupling feature representation from label dependency, THC-IDS achieves high accuracy and low false positives, providing insights for building intelligent, high-throughput network security systems.</p>

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

THC-IDS: temporal Hebbian-enhanced contrastive Learning for IDS

  • Fan Tong,
  • Anqin Zhang

摘要

As network scale and complexity increase, traditional Intrusion Detection Systems (IDS) face significant challenges in dealing with diverse attacks and scarce labeled data. To address this, this paper proposes a novel two-phase graph neural network (GNN)-based intrusion detection framework–THC-IDS, integrating self-supervised pre-training with supervised downstream classification, and is designed to leverage high-performance computational resources for the scalable analysis of massive network flows. The framework comprises three core modules: (1) The Hebbian-enhanced Attention (HEA) module leverages Hebbian principles to capture weak co-activation patterns, preventing transient attack features from being over-smoothed during spatial aggregation via GPU-friendly localized matrix operations. (2) The Dynamic Denoising Temporal Contrastive Loss (DDTCL) module introduces an inverse dynamic weighting mechanism to mitigate erroneous supervision signals, concentrating learning on informative temporal mutations. (3) The Cluster-Center Compactness–Separation Loss (CCCSL) module provides label-free prototype regularization, establishing a linearly separable representation for detecting complex, long-tailed attacks. Experiments on four large-scale benchmark datasets show that THC-IDS achieves a 99.68% F1 score in binary classification, and weighted average F1 scores of 98.86% and 97.67% in multi-class tasks, achieving highly competitive performance compared to existing state-of-the-art methods. By decoupling feature representation from label dependency, THC-IDS achieves high accuracy and low false positives, providing insights for building intelligent, high-throughput network security systems.