2.1 Deep learning approaches for intrusion detection

Deep learning has revolutionized intrusion detection by automating the feature extraction process and improving the accuracy and efficiency of detection systems. Unlike traditional machine learning methods, which rely heavily on manual feature engineering, deep learning models such as Convolutional Neural Networks (CNNs) and Long Short-Term Memory networks (LSTMs) can learn hierarchical representations from raw network data. CNNs are adept at capturing spatial patterns [8], while LSTMs excel in detecting temporal dependencies [9]. Unsupervised deep learning approaches, including Auto-Encoders and Generative Adversarial Networks (GANs), are also widely used in anomaly detection tasks, particularly when labeled data is scarce [10–12]. Despite their strengths, deep learning models face challenges in real-world applications due to the high cost of obtaining labeled data and the dynamic nature of attack patterns, such as Advanced Persistent Threats (APTs) and zero-day attacks. This limitation has driven research into self-supervised and weakly supervised learning paradigms, which leverage unlabeled data to enhance the adaptability and robustness of models.

2.2 Graph-based approaches for intrusion detection

In recent years, graph-structured data has gained significant attention in network intrusion detection, owing to its ability to provide a sophisticated abstraction that captures complex interactions among entities such as hosts, IP addresses, and ports. On one hand, graph data encodes local structural information between nodes and their neighbors, enabling models to learn meaningful representations even from unlabeled datasets. On the other hand, graph structures retain semantic and contextual dependencies inherent in network traffic, offering richer feature representations for intrusion detection. Beyond point-to-point relationships, graph data effectively models global structures and localized patterns, thereby enhancing the ability to detect complex attack behaviors.

Graph-based deep learning methods have shown remarkable potential in the cybersecurity domain. For instance, Xu et al. [13] proposed a self-supervised graph embedding approach that enables efficient anomaly detection in network traffic, even in scenarios with limited labeled data. Similarly, Lin et al. [14] developed E-GRACL, an IoT-targeted intrusion detection system leveraging Graph Neural Networks (GNNs) and self-supervised learning to identify zero-day attacks. These methods improve model robustness against noise while enhancing generalization to novel attack patterns. Overall, graph-based learning approaches effectively model complex network interactions, reduce reliance on labeled data, and provide innovative solutions to challenges in network intrusion detection.

In addition, contrastive learning based on graph-structured data has achieved notable progress in addressing the scarcity of labeled data for intrusion detection. Contrastive learning constructs positive and negative sample pairs, allowing models to uncover latent attack patterns and improve classification performance. For example, Farrukh et al. [15] introduced a dual-modal framework called XG-NID, which combines Heterogeneous Graph Neural Networks (HGNNs) and Large Language Models (LLMs) to achieve real-time intrusion detection with high interpretability by integrating flow-level and packet-level data. Similarly, Hu et al. [16] developed an early intrusion detection method based on graph embeddings, where flow graphs are constructed from initial network packets and classified using random forests, resulting in significant improvements in accuracy and efficiency. These studies highlight the immense potential of graph-structured and contrastive learning approaches in addressing data scarcity and detecting complex attack patterns, offering innovative solutions for modern network intrusion detection challenges.

2.3 Self-supervised and weakly-supervised learning paradigms

In the field of weakly-supervised learning, researchers are dedicated to developing techniques that leverage small amounts of labeled data or partial annotations to address the challenge of scarce labeled data in network intrusion detection. Weakly-supervised learning combines unsupervised, semi-supervised, and self-supervised learning techniques to uncover latent attack patterns from unlabeled data, thereby significantly reducing reliance on high-quality labeled data. For example, Li et al. [17] proposed a graph meta-learning framework, GMFITD, for few-shot insider threat detection. By integrating graph model auto-encoders with attention mechanisms, GMFITD effectively captures potential relationships among users and achieves efficient anomaly detection in few-shot scenarios. Additionally, generative models such as GANs have been used to synthesize data, enhancing model generalization in weakly-supervised settings. For instance, Zhang et al. [18] developed a GAN-based synthetic anomaly generation method, which generates realistic anomaly data to improve model generalization, enabling efficient intrusion detection even with limited labeled data.

Contrastive learning, as a self-supervised learning technique, plays a pivotal role in weakly-supervised learning. Its core idea is to construct positive and negative sample pairs, enabling models to learn meaningful representations from unlabeled data. In graph data, contrastive learning methods capture local structural information between nodes and their neighbors, effectively uncovering latent attack patterns in network traffic. For example, Duan et al. [19] proposed a multi-view contrastive learning method for graph anomaly detection, which constructs multi-view contrastive objectives based on network structure, node evolution, and topology evolution, significantly improving anomaly detection performance in dynamic networks. This method not only captures local dependencies among nodes but also enhances model performance under low-quality pseudo-labels by introducing global distribution prototypes and virtual negative samples.

Self-supervised contrastive learning methods for anomaly detection, such as Anemone, have achieved notable progress. This method constructs contrastive sample pairs between nodes and their local substructures, learning meaningful representations from unlabeled data and significantly improving anomaly detection performance [20]. Anemone not only reduces reliance on labeled data but also mitigates the impact of noise by learning local connectivity information in attributed networks, while reducing computational complexity by avoiding direct input of the entire network into the model. Furthermore, Liu et al. [21] proposed a real-time intrusion detection method based on spatio-temporal graph neural networks, which captures spatio-temporal dependencies in network traffic, significantly enhancing detection accuracy. These studies demonstrate the immense potential of weakly-supervised learning in network intrusion detection, effectively addressing the challenge of scarce labeled data and significantly improving model detection performance.

3.1 Traffic graph construction

Network traffic data inherently exhibits graph-structured properties, where the utilization of graph structures can naturally capture topological relationships and interaction patterns within the traffic. Moreover, network traffic data typically encompasses rich contextual information, such as traffic direction, protocol type, and packet size. These features provide multidimensional inputs for GNNs, enabling them to effectively capture both local and global traffic patterns, thereby facilitating the identification of potential anomalous behaviors. Based on this rationale, this study models network traffic data as graph structures to leverage the capabilities of GNNs for intrusion detection tasks.

In the intrusion detection task of this study, we first extract five-tuple information (source IP, source port, destination IP, destination port, and protocol) from the network traffic data. The binary tuples (source IP and source port, or destination IP and destination port) are then defined as nodes in the network traffic graph. Through this approach, devices in the network are mapped to nodes in the graph, while the edges between source and destination nodes represent the network traffic transmitted between these devices.

The coarse-grained modeling strategy of defining nodes as binary tuples is a key design choice aimed at addressing the core challenges of scalability and efficiency when applying GNNs to real-world network traffic data. Primarily, when dealing with massive volumes of traffic data, finer-grained approaches—such as modeling individual network flows as nodes—would result in a graph scale that becomes computationally infeasible, severely limiting the model’s value for practical deployment. More importantly, this strategy is highly synergistic with the core of our framework, which is edge-level contrastive learning. By simplifying nodes to represent communication endpoints, the model’s learning focus is guided towards the traffic interactions (i.e., edges) that form the core of the analysis. This approach enhances learning efficiency while maintaining a manageable computational overhead. The effectiveness of this design choice was also empirically validated through our preliminary experiments.

To mitigate potential biases of the model towards specific IP addresses, this study applies a mapping process to both source and destination IP addresses. Specifically, source IP addresses are mapped to the private address range , while destination IP addresses are mapped to the private address range . Additionally, considering that the message-passing mechanism of GNNs may be susceptible to noise interference from node features, this study initializes the feature values of all nodes to 0, indicating the absence of any feature information. This design aims to ensure that the model focuses more effectively on edge detection tasks, thereby improving the accuracy of detection results.

3.2 Traffic interpolation contrastive learning

3.2.1 Traffic interpolation module.

In real-world network scenarios, traffic data often exhibits significant imbalance, which can lead to degraded model performance during training. Existing methods fail to adequately address this imbalance. To tackle this issue, we propose an edge-based data interpolation method for data augmentation, specifically designed to mitigate data imbalance in real-world settings. Traditional graph-based interpolation methods typically generate new samples through linear combinations, which are only suitable for node-level classification tasks and are not applicable to our edge classification scenario. Therefore, our approach introduces an interpolation method constrained by the positive-to-negative sample ratio , where edges are sampled from the original data for interpolation-based augmentation. Specifically, in TICL, we construct a sample pool from the edges labeled as positive (malicious) and negative (benign) in the original traffic. For each interpolation, a positive edge e_i and a negative edge e_j are randomly drawn from this pool. A new edge feature, e_new, is then generated according to the interpolation coefficient using the formula: . If , the new edge is assigned a positive label; otherwise, it is assigned a negative label. Throughout this process, the ratio of sampled negative to positive samples is maintained at . This allows the minority class to be augmented on-the-fly without requiring any additional labeling, thereby mitigating the class imbalance problem.

Here, represents the interpolation coefficient, which controls the weight allocation between the features of the two edges. After implementing TICL, it is necessary to annotate the newly generated edge data. To achieve this, we introduce an indicator function to label the augmented data. Specifically, the labeling is controlled by the interpolation coefficient. When , the indicator function assigns a label of 0 (indicating a benign edge); when , the edge is labeled as 1 (indicating a malicious edge). This labeling strategy effectively captures the categorical tendency of the interpolated edges, thereby providing more accurate supervisory signals for the model. The indicator function is formally defined in Eq 1.

(1)

3.2.2 Contrastive learning module.

To fully leverage the extensive augmented data generated by TICL, we introduces a contrastive learning-based feature learning strategy, aiming to enhance the model’s understanding of data distributions. This approach constructs supervisory signals by utilizing the inherent structural information of the data, thereby uncovering latent relationships among samples to optimize the model training process. Within the framework of this study, we employ the InfoNCE loss function [22] to extract feature representations from the virtual samples generated by TICL. These representations are then combined with positive samples from the original dataset to form new positive sample pairs. Simultaneously, negative samples are randomly selected from the dataset, and the similarity between positive and negative samples is computed to refine the feature space. Throughout this process, the ratio of positive to negative samples is set to . The InfoNCE loss function is defined as follows:

(2)

Where e_i represents a positive sample edge in the edge set , denotes the set of positive samples within (with ), and represents the set of negative samples within (with ).

3.3 Traffic detection model

Conventional applications of GNNs have largely concentrated on tasks related to node classification, with relatively little attention given to edge classification problems. To address this gap, this work introduces a novel edge classification model inspired by the E-GraphSAGE algorithm [7]. The model is designed to incorporate edge information into node embeddings through GNN-based mechanisms, such as message passing and neighborhood aggregation. By doing so, it enables effective modeling and classification of edge-level features. The model achieves this by aggregating information from both the source and target nodes of an edge, as well as their respective neighborhoods, and incorporating edge-specific attributes. This aggregation process, which forms the basis of the edge embedding generation, is mathematically described as:

(3)

where refer to the feature vector of edges between nodes u and v in the (k–1)-th layer, and denotes the set of nodes connected to v. The aggregation process integrates edge features with node embeddings to iteratively update representations. At each layer k, node embeddings incorporate structural and contextual information from their k-hop neighbors, while edge embeddings are derived from these updated node representations. This iterative refinement ensures that the model captures both local and global structural patterns in the graph.

The representation of a node at the K-th layer is finalized as , encapsulating all aggregated information up to that layer. For each edge, the final embedding is derived by concatenating the embeddings of its associated nodes of u and v, as illustrated in Eq 4.

(4)

3.4 Model train

To train the proposed model, the primary objective is to minimize the cross-entropy loss, which serves as the core classification loss function. The cross-entropy loss is computed as follows:

(5)

Here, y_i represents the true class label of the i-th sample, with 0 representing a positive instance and 1 indicating a negative instance. Additionally, p_i refers to the predicted probability of the i-th sample being classified as positive.

The overall training objective integrates the cross-entropy loss with an additional contrastive loss , which enhances the model’s capability to learn meaningful representations. The combined loss function is expressed as:

(6)

Among them, is an learnable parameter.

4.1 Data preparation

To demonstrate the effectiveness of TICL for network intrusion detection, we performed experiments using two publicly available network traffic datasets. A summary of the datasets is provided in Table 1.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Table 1. Summary of dataset properties.

https://doi.org/10.1371/journal.pone.0338546.t001

BoT-IoT [23]: This dataset was created by Koroniotis et al. in 2019 and is a publicly available dataset specifically designed for network attack detection in Internet of Things (IoT) environments. It contains various types of network traffic data, including normal traffic and six different types of attack traffic (e.g., DDoS attacks, scanning attacks, malware propagation, etc.). Koroniotis et al. also extracted 47 traffic features from the raw data using the Argus tool and provided detailed annotations for each traffic sample. The dataset consists of a total of 3,668,045 network traffic records, with malicious traffic accounting for 99.99% and benign traffic only 0.01%.

UNSW-NB15 [24]: This dataset was released by Moustafa and Slay in 2015 and is a comprehensive dataset for network intrusion detection systems. It was created by the UNSW Canberra Cyber Range Lab using the IXIA PerfectStorm tool to generate a hybrid of real modern normal traffic and nine types of synthetic attack traffic (e.g., Fuzzers, Backdoors, Exploits, etc.). The authors used the Argus and Bro-IDS tools to extract a total of 49 features from the raw traffic and applied class labels. The dataset contains a total of 2,540,044 records, a portion of which is partitioned into a training set (175,341 records) and a testing set (82,332 records).

4.2 Comparative methods

To validate the performance of our model, we compare TICL with the following two commonly used intrusion detection methods.

E-GraphSAGE: This method is a graph neural network algorithm based on GraphSAGE, which primarily learns node representations by aggregating neighborhood information of nodes. Additionally, it considers edge features and generates edge embeddings by sampling and aggregating edge information in the graph. This enables E-GraphSAGE to effectively capture local structural information in graph data, thereby achieving network intrusion detection. However, the original E-GraphSAGE algorithm does not incorporate data augmentation or contrastive learning strategies, leading to certain limitations in scenarios with class imbalance, particularly in recognizing minority classes.

E-GraphSAGE-Res [25]: E-GraphSAGE-Res introduces residual connections on top of E-GraphSAGE to enhance the information propagation capability of the network and avoid training difficulties caused by information loss or gradient vanishing. At the same time, residual connections provide more training signals for minority classes, thereby improving the overall detection performance of the model in class-imbalanced tasks. In this way, E-GraphSAGE-Res can significantly enhance the classification accuracy of minority class samples while maintaining the complexity and expressive power of the network structure.

4.3 Experimental setup

4.4 Model evaluation metrics

To comprehensively assess the performance of the model, we used the Macro F1-Score as the primary evaluation metric. The Macro F1-score is the average of the F1-scores for each class, providing a balanced view of the model’s performance, particularly in cases of class imbalance. The F1 score is a widely used metric in binary classification tasks that balances precision and recall, and its calculation is given by:

(7)

(8)

Here, precision indicates the model’s ability to correctly identify positive instances, while recall reflects the model’s capability to capture all actual positive instances. A higher F1-score implies a better balance between precision and recall, thus indicating better overall performance. The Macro F1-score is particularly useful in multi-class classification tasks. It computes the F1-score for each class individually and averages them. This approach ensures that the model’s performance is fairly evaluated across all classes, reducing the influence of dominant classes and offering a more holistic view of its effectiveness.

4.5 Experimental results

We compare the proposed TICL model with commonly used intrusion detection methods, including E-GraphSAGE, E-GraphSAGE-Res, and E-ResGAT, by evaluating their macro-average F1-scores on the BoT-IoT and UNSW-NB15 datasets. The experimental results, presented in Table 2, clearly show that TICL outperforms all other methods on both datasets. Specifically, on the BoT-IoT dataset, TICL achieves a macro-average F1-score of 95.43%, surpassing the second-best method by 0.49%. On the UNSW-NB15 dataset, TICL achieves a macro-average F1-score of 97.77%, which is 0.03% higher than the second-best method.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Table 2. Performance of the intrusion detection task for different training set split ratios, expressed as macro-f1 and standard deviation.

https://doi.org/10.1371/journal.pone.0338546.t002

Additionally, to assess the influence of data augmentation and contrastive learning on model performance, we conducted ablation experiments. The results, shown in Table 2, reveal that both strategies—edge interpolation-based data augmentation and contrastive learning—offer improvements over the baseline methods on both datasets. These findings emphasize the effectiveness of combining these two strategies. The edge representations derived from edge interpolation and contrastive learning are essential for detecting anomalous edges, thereby boosting the model’s overall performance.

To further highlight the superiority of the TICL model, we performed data partitioning experiments, which demonstrate the advantages of integrating contrastive learning and data augmentation for intrusion detection. As illustrated in Fig 2, the performance of various methods was compared across different training set sizes (ranging from 1% to 60% of the total dataset). The results indicate that TICL, along with its TICL-CL and TICL-EI variants, consistently outperforms the baseline models on both datasets. These experiments validate the effectiveness of our proposed approach. Moreover, we observed that on the BoT-IoT dataset, as the training set size increases, the performance of all models exhibits fluctuations. However, TICL maintains a relatively stable performance, with smaller fluctuations compared to the baseline models, and consistently achieves the highest macro-average F1-score.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Fig 2. Performance comparison of different methods under various data partitioning schemes.

https://doi.org/10.1371/journal.pone.0338546.g002

Furthermore, to evaluate the robustness of our proposed TICL method, we conducted migration experiments. Specifically, we trained and tested TICL on the BoT-IoT and UNSW-NB15 datasets. The experimental results are shown in Table 3. As can be seen, the TICL method outperforms the baseline method in both model performance and robustness. This is primarily attributed to the contrastive learning module, which enhances cross-domain consistency of edge representations through self-supervised learning. Specifically, in the migration scenario, the improvement in F1 stems from the contrastive learning’s improved negative sampling and similarity optimization of minority edges, while the reduction in reflects the model’s tolerance to distribution drift. Further ablation analysis shows that removing the contrastive learning component increases by 10% and 15% on the two datasets, respectively, while retaining the self-supervised loss only reduces performance by 5% and 2%, confirming the dominant role of contrastive learning in robustness.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Table 3. Performance of the intrusion detection task in the migration scenario, expressed as macro f1 and standard deviation.

https://doi.org/10.1371/journal.pone.0338546.t003

Collectively, the experimental results consistently demonstrate the outstanding performance and robustness of the TICL framework. This performance enhancement is primarily attributed to the synergy between its two core components: the interpolation-based data augmentation strategy effectively mitigates the class imbalance problem at the data level, while the contrastive learning module strengthens the model’s discriminative capabilities at the feature level. These findings have twofold implications. Theoretically, this work provides an effective paradigm for applying GNNs to imbalanced cybersecurity datasets, underscoring the importance of combining advanced architectures with specialized data and representation learning strategies. Practically, the robust performance of TICL, even with limited training data, highlights its significant potential for deployment in next-generation Network Intrusion Detection Systems to better protect critical HPC infrastructure.

4.6 Model parameter analysis

In the proposed approach, we integrated the interpolation data augmentation strategy to enhance the diversity of the training samples by combining existing data samples, ultimately improving the model’s generalization ability. To optimize this data augmentation strategy, we conducted parameter experiments to determine the ideal number of samples for the interpolation method. The experimental results are illustrated in Fig 3. Specifically, we evaluated the model’s performance using varying numbers of interpolation samples, ranging from 100 to 2000, to identify the optimal number of samples.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Fig 3. Impact of different sampling sizes in the interpolation method on model performance.

https://doi.org/10.1371/journal.pone.0338546.g003

The results for the BoT-IoT dataset, which exhibits severe class imbalance, indicate that a larger number of interpolated samples generally leads to better performance. As shown in the figure, while some fluctuations are present, the overall trend demonstrates that more augmentation helps the model overcome the data scarcity of the minority attack class. To achieve a significant performance gain without incurring excessive computational costs, we selected 1000 samples as the optimal number for the BoT-IoT dataset.

In contrast, the UNSW-NB15 dataset, which is relatively balanced, demonstrated that the model’s performance peaked at 100 samples and gradually declined as the number of samples increased beyond this threshold. We hypothesize that for more balanced datasets, excessive data augmentation is not required and can even negatively impact performance by distorting the natural data distribution. Therefore, we selected 100 samples as the optimal number for the UNSW-NB15 dataset.

Based on these findings, we conclude that the optimal number of interpolation samples is highly dependent on the specific class distribution of the dataset. Consequently, our final model configuration uses 1000 samples for the severely imbalanced BoT-IoT dataset and 100 samples for the more balanced UNSW-NB15 dataset to maximize performance while considering computational efficiency.

4.7 Graph construction analysis

To verify the superiority of the proposed graph construction method based on binary tuples, this paper systematically compares three typical graph construction strategies: (1) traffic as nodes (node classification task); (2) traffic as edges (our method); and (3) traffic packets as nodes (graph classification task). Experiments are conducted on the BoT-IoT and UNSW-NB15 datasets, with all model parameters kept consistent. Evaluation metrics include F1 score and training efficiency. The experimental results are shown in Fig 4. The proposed edge classification method with traffic as edges significantly outperforms the other two strategies in F1 score. This is mainly attributed to the high-dimensional feature representation of binary tuples, which can capture richer traffic interaction information rather than a local view of isolated packets. At the same time, this method uses binary tuplesas nodes, which effectively suppresses the expansion of node scale, thereby achieving better computational efficiency in large-scale network traffic scenarios. These results further confirm the advantages of the TICL framework in robustness and scalability.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Fig 4. Impact of different graph construction method on model performance.

https://doi.org/10.1371/journal.pone.0338546.g004

4.8 Efficiency analysis

To evaluate the impact of the interpolation augmentation and contrastive learning modules on the computational overhead of the proposed TICL framework, this paper systematically assesses its computational efficiency from both theoretical and experimental perspectives.

Theoretically, assuming the training graph contains N nodes, E edges, a feature dimension of d, H minority-class (malicious) samples, and an L-layer GNN, the time complexity for each forward propagation layer is , the full forward-backward propagation complexity is , and the space complexity is . The interpolation augmentation generates additional edges through subsampling (where is the size of a fixed benign subset), linearly expanding the number of edges to . This increases the total training complexity to , with an increment of (where T is the number of epochs). Contrastive learning adds an overhead of per batch (where B is the batch size and K is the fixed negative sampling ratio), resulting in a total training increment of . This demonstrates that the introduction of the interpolation augmentation and contrastive learning modules only linearly scales the complexity of the baseline model, without causing a higher-order complexity explosion.

To validate this theoretical analysis, Fig 3 and Fig 5 respectively show the training efficiency curves under varying sampling quantities and graph scales. The results show that the model’s training time has a positive linear correlation with the sampling quantity and graph scale, further confirming the computational scalability of the method.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Fig 5. Impact of different graph ratio on model performance.

https://doi.org/10.1371/journal.pone.0338546.g005