A graph data balancing approach for intrusion detection based on two-stage generation

Network intrusion detection systems are critical to safeguarding information security by identifying malicious activities through real-time monitoring and analyzing network traffic. However, with the evolution of attack methods and the proliferation of network data sizes, flat data-based detection methods are difficult to cope with complex threats. Although graph neural networks (GNNs) can model interactions between data streams to improve detection performance, they still face major challenge: graph data imbalance, where existing research focuses on the balance of a single intrusion data stream and ignores the imbalance at the level of the graph structure, leading to difficulties in adapting the generated data to the graph model and failing to preserve information interactions. To address the above problems, this paper proposes a graph data balancing method (GCG-GAN) based on two-stage generation, which contains a node generation module and a graph structure generation module. Through the feature-aligned conditional generation adversarial network to simulate the distribution of node features, combined with the structure generation adversarial network to complement the topology, and the use of node attributes to optimize the structure generation, ultimately generates balanced data in line with the real distribution. Experiments show that GCG-GAN effectively mitigates the graph data imbalance problem on real datasets and significantly improves the performance of the intrusion detection model.