§ 0 Minor Project · Baseline Study & Proposed Extensions

Self-supervised graph representations for network intrusion detection: a reproduction and extension study.

A systematic study of GraphIDS (Guerra et al., NeurIPS 2025), accompanied by four methodological extensions addressing temporal reasoning, masking strategy, packet-level feature integration, and evaluation on real-world botnet traffic.

Baseline

Guerra, Chapuis, Duc,
Mozharovskyi, Nguyen
NeurIPS 2025

Scope

Multi-host NIDS
Self-supervised learning
End-to-end GNN + MAE

Institution

MIT Manipal
April 2026

Made by

A S Aravinthakshan
Janak Shah
Aryan Kudva
Akshat Agarwal

§ 1 Motivation

Contemporary NIDS face three structural limitations.

Supervision is expensive and perishable.
Supervised approaches require large volumes of labelled attack traces. Labels age as adversary tooling evolves, necessitating frequent retraining.
Signature-based models generalise poorly.
Models fit to known attack patterns exhibit degraded performance on zero-day variants and behavioural drift.
Classical unsupervised baselines ignore relational structure.
PCA, Isolation Forest, and CBLOF treat flows as independent observations, discarding host-level topology and inter-flow co-occurrence.

Modern enterprise networks generate on the order of 10⁹ flows per day. Effective detection demands a label-efficient, structure-aware, and drift-tolerant formulation.

§ 2 Problem Setting

Operating assumptions of GraphIDS.

Availability of benign-only training data. Clean traffic is assumed collectable at deployment; no attack labels are required during training.
Quasi-stationary network topology. The set of hosts and their communication patterns evolve slowly relative to the inference window.
Multi-host observability. The detector has access to flow records across the monitored network via NetFlow / IPFIX / sFlow exporters.
Anomalies manifest as distributional deviation. Malicious flows perturb either the local neighbourhood structure or the global co-occurrence distribution of benign traffic.

Under these assumptions, intrusion detection reduces to a one-class distribution modelling problem over flow representations enriched with graph context.

§ 3.1 Graph Representation

Flow records are cast as a directed graph.

Hosts (IP addresses) are nodes; network flows are directed edges carrying NetFlow statistics as edge features.

43 features (v2 schema) or 53 features (v3, including temporal fields)
Directed edges preserve asymmetry of attack flows
Discriminative information resides on edges, not nodes

Figure 2 — Guerra et al., NeurIPS 2025

§ 3.2 Model Architecture

A jointly-trained GNN–Transformer masked autoencoder.

GraphIDS pipeline: E-GraphSAGE followed by Transformer encoder-decoder

Figure 3 — Guerra et al., NeurIPS 2025

i. Local context

E-GraphSAGE — inductive message passing over a 1-hop neighbourhood with edge-feature aggregation.

ii. Global context

Transformer MAE — encoder–decoder over batched embeddings with 15% random attention masking as structured regularisation.

iii. Joint optimisation

End-to-end MSE loss — gradients propagate through both components, aligning representations with the reconstruction objective.

§ 3.3 Detection Objective

Reconstruction error as an anomaly score.

The model is trained exclusively on benign traffic. At inference, the squared ℓ₂ distance between each original and reconstructed flow embedding constitutes a per-flow anomaly score.

s_i = ‖ h_i − ĥ_i ‖² ∈ ℝ_≥0

Flows whose embeddings deviate from the learned manifold of benign traffic yield elevated reconstruction error and are flagged via a threshold determined on a held-out validation set.

GraphIDS anomaly detection via reconstruction error

Figure 1 — Guerra et al., NeurIPS 2025

§ 4 Empirical Results

Reported state-of-the-art across NetFlow benchmarks.

99.98%

PR-AUC · NF-UNSW-NB15-v3

GraphIDS outperforms Anomal-E, SAFE, CBLOF, and the T-MAE ablation by 5 to 25 percentage points on PR-AUC and Macro F1. Forward-pass inference latency is reported at 3.83 µs per flow.

GraphIDS empirical performance across NetFlow datasets

Table 3 — Guerra et al., NeurIPS 2025

§ 5 Identified Limitations

Four limitations of the baseline formulation.

Degraded detection on Infiltration attacks.
Reported Detection Rate of 18–25% on NF-CSE-CIC-IDS2018; the reconstruction objective fails when attacks closely mimic benign distributions.
Absence of temporal modelling.
Flows are shuffled prior to batching; no positional encoding is employed. The model captures co-occurrence but not sequence, missing beaconing and slow reconnaissance.
Fixed, uniform masking strategy.
A single attention-masking ratio (0.15) applied uniformly across datasets. No feature-level, curriculum, or context-aware masking is investigated.
Evaluation restricted to flow-level synthetic benchmarks.
Packet-derived features (TLS fingerprints, payload entropy, inter-arrival statistics) are not integrated. Real-world malware captures (e.g., CTU-13) are not considered.

§ 6 Data Representations

Packet-level vs flow-level granularity.

Low level · high fidelity

Packet representation

Individual link-layer frames captured at the sensor. Rich semantics, high ingest cost.

Timestamp, 5-tuple, frame length
TCP/UDP headers and flags
Payload bytes (where observable)
TLS handshake fingerprints (JA3 / JA4)
Inter-arrival distributions, payload entropy

libpcapZeekSuricata ~1–10 Gbps

Aggregated · scalable

Flow representation

Bidirectional conversations aggregated over a temporal window via 5-tuple keying.

Start, end, and duration timestamps
Packet and byte counts (per direction)
TCP state and flag aggregates
Protocol / application identifiers
Two to three orders of magnitude smaller than packet traces

NetFlow v9IPFIXsFlow the GraphIDS input modality

GraphIDS operates exclusively on flow-level records. Packet-derived signals — encrypted-traffic fingerprints, payload-entropy statistics, and inter-arrival distributions — remain unexploited.

§ 7 Research Gaps

Four gaps addressed in this study.

G1 — Temporal information is discarded.
Flow ordering is shuffled and no positional encoding is applied, precluding detection of attacks characterised by temporal regularity.
G2 — Masking strategy is monolithic.
A single masking ratio and masking mechanism (random token-pair attention) is used across all datasets and training stages.
G3 — Packet-derived features are unused.
Protocol-level signals recoverable via lightweight packet analysis (Zeek) are not integrated into edge representations.
G4 — Evaluation excludes real-world captures.
No assessment on datasets containing traffic from in-the-wild malware — notably CTU-13, the standard real-capture botnet corpus.

§ 8 Proposed Methodological Extensions

Four targeted contributions.

C1 / addresses G1

Relative-time attention bias

Sort flows within each batch by start time; inject a learned bias f(Δt_ij) into attention logits. Preserves sequence-aware modelling without auto-regression.

C2 / addresses G2

Feature-channel & curriculum masking

Two masking variants: (a) stochastic masking of entire feature dimensions at input projection, and (b) a curriculum schedule ramping the masking ratio from 0.05 to 0.30 over training.

C3 / addresses G3

Zeek-derived edge enrichment

Augment edge features with TLS JA3/JA4 fingerprints, payload-entropy statistics, and inter-arrival histograms extracted via Zeek. Input dimension 43 → ~70; architecture unchanged.

C4 / addresses G4

NF-CTU13 corpus & streaming eval

Conversion of CTU-13 PCAPs into the NF-* schema via nProbe; evaluation on real captured botnet traffic; streaming deployment over an Apache Kafka bus.

§ 9 Dataset Expansion

Extending evaluation to real-capture traffic.

The baseline study is restricted to testbed-generated NetFlow corpora. We introduce CTU-13 — a publicly released set of 13 real-network captures containing live botnet traffic (Neris, Rbot, Virut, Menti, Murlo, NSIS.ay, Zeus variants) — approximately 100 GB of raw PCAP and ~20 million flows.

Conversion pipeline · schema-compatible with NF-* datasets

01 · raw

CTU-13 PCAP

13 scenarios, ~100 GB, real botnet traffic

→

02 · extract

nProbe

Emit 43- / 53-feature NetFlow records matching paper's template

→

03 · enrich

Zeek (parallel)

Protocol-level logs: TLS, DNS, X.509, HTTP

→

04 · label

Label injection

Join .binetflow ground truth on 5-tuple + ±1 s timestamp

→

05 · output

NF-CTU13

Parquet; drop-in for the baseline data loader

The final dataset matrix comprises NF-UNSW-NB15 (v2/v3), NF-CSE-CIC-IDS2018 (v2/v3), NF-ToN-IoT (v2/v3), NF-BoT-IoT (v2/v3), and the newly-constructed NF-CTU13 — spanning synthetic testbeds, IoT environments, and in-the-wild botnet captures.

§ 10 Packet-Level Feature Enrichment

Protocol-aware analysis via Zeek.

Zeek is an open-source network security monitor performing deep packet inspection and protocol parsing. From each PCAP it emits structured logs — conn.log, ssl.log, dns.log, x509.log, files.log — which we merge with nProbe output on the 5-tuple key.

Extracted features

Edge feature additions

TLS JA3 / JA4 fingerprints — client-side handshake hashes, one-hot over top-K values
Payload entropy — Shannon entropy of first N observed payload bytes
Inter-arrival histograms — eight log-spaced bins over packet gaps
DNS query characteristics — query-name length, n-gram entropy, response TTL
X.509 certificate signals — self-signed flag, issuer / subject hash

edge dim: 43 → ~70 · no architectural change

Integration

Fusion strategy

Both extractors run in parallel on the same PCAP input.

nProbe produces paper-compatible 43/53 features
Zeek produces protocol-level enrichment
Join on (src_ip, src_port, dst_ip, dst_port, proto, t₀±ε)
Persist as Parquet with schema versioning
The E-GraphSAGE input projection absorbs the expanded dimensionality

ablation: {Zeek, ∅} × {v2, v3}

§ 11 Streaming System Architecture

Kafka-based inference pipeline.

Apache Kafka serves as a distributed, durable message bus decoupling data ingestion from model inference. Flow records are published to a partitioned topic keyed by hash(src_ip) mod N, preserving per-host locality across consumers without coordination overhead.

Runtime data flow

source

Parquet replayer

Paces NF-CTU13 records to simulate live sensor output

→

bus

Kafka · topic flows

Partitioned by src_ip; durable; replayable

→

inference

GraphIDS consumer

Sliding DGL graph · E-GraphSAGE · Transformer MAE

→

scoring

Threshold

s_i = ‖h_i − ĥ_i‖² > τ

→

sink

Kafka · topic alerts

Downstream dashboards / SIEM

locality

Partitioning by source IP ensures all flows of a given host land on a single consumer, eliminating distributed graph state.

windowing

Each consumer maintains a sliding temporal graph (window W minutes) via edge insertion and age-based eviction.

scalability

Stateless per partition — horizontal scaling obtained by increasing partition and consumer count symmetrically.

§ 12 Training & Evaluation Protocol

Experimental methodology.

Optimisation

AdamW; max 100 epochs; early stopping on validation PR-AUC with patience 20.

Hyperparameters

Coarse grid search followed by Bayesian optimisation (per-dataset) over learning rate, weight decay, embedding dimension, masking ratio, and dropout.

Primary metrics

PR-AUC (threshold-independent, imbalance-robust), Macro F1, and per-attack Detection Rate.

Secondary metrics

FPR at operating threshold, inference latency (µs / flow), peak GPU memory.

Statistical rigour

5 random seeds per configuration; bootstrap 95% CI on PR-AUC; Wilcoxon signed-rank test for pairwise model comparison.

Ablation grid

{baseline, channel, curriculum, channel+curriculum masking} × {±temporal bias} × {±Zeek features} × 5 datasets.

Generalisation

Cross-dataset transfer (train on UNSW, evaluate on CIC and CTU-13) and held-out attack family evaluation.

§ 13 Demonstration

Live end-to-end inference demonstration.

A real-time demonstration will accompany the defence, exercising the full pipeline on a pre-recorded CTU-13 scenario replayed through the Kafka bus.

Replay.
A producer reads pre-extracted NF-CTU13 records (Scenario 10 — Rbot DDoS) and emits them to the flows topic at configurable rate (1× real-time baseline; 10× for compressed demonstration).
Inference.
The trained GraphIDS consumer ingests the stream, maintains a rolling-window graph, and computes per-flow anomaly scores. Scores crossing the validated threshold are published to the alerts topic.
Visualisation.
A lightweight dashboard subscribes to both topics and renders (i) the ingestion rate, (ii) the live anomaly-score distribution, (iii) a per-host alert heatmap, and (iv) the reconstruction-error trajectory aligned with ground-truth attack onset.
Controlled injection.
A synthetic port-scan pattern is injected mid-stream to illustrate detection latency, false-positive behaviour, and threshold sensitivity under novel attack conditions.