Self-Supervised Learning of Graph Representations for Network Intrusion Detection
Authors: Lorenzo Guerra
Thomas Chapuis
Guillaume Duc
Pavlo Mozharovskyi
Van-Tam Nguyen
Venue: NeurIPS 2025 poster ()
Keywords: Self-supervised learning
Graph neural networks
Masked autoencoder
Anomaly detection
Intrusion detection
Network security
Representation learning
Primary area: applications
TL;DR: We propose a self-supervised framework that combines GNNs and a Transformer-based masked autoencoder to detect network intrusions by reconstructing flow representations and flagging high-error patterns as anomalies.

Abstract: Detecting intrusions in network traffic is a challenging task, particularly under limited supervision and constantly evolving attack patterns. While recent works have leveraged graph neural networks for network intrusion detection, they often decouple representation learning from anomaly detection, limiting the utility of the embeddings for identifying attacks. We propose GraphIDS, a self-supervised intrusion detection model that unifies these two stages by learning local graph representations of normal communication patterns through a masked autoencoder. An inductive graph neural network embeds each flow with its local topological context to capture typical network behavior, while a Transformer‑based encoder-decoder reconstructs these embeddings, implicitly learning global co-occurrence patterns via self-attention without requiring explicit positional information. During inference, flows with unusually high reconstruction errors are flagged as potential intrusions. This end-to-end framework ensures that embeddings are directly optimized for the downstream task, facilitating the recognition of malicious traffic. On diverse NetFlow benchmarks, GraphIDS achieves up to 99.98% PR‑AUC and 99.61% macro F1-score, outperforming baselines by 5–25 percentage points.

Self Self-Supervised Learning of Graph Representations for Network Intrusion Detection
Lorenzo Guerra Thomas Chapuis² Guillaume Duc
Pavlo Mozharovskyi' Van-Tam Nguyen'
LTCI, Télécom Paris, Institut Polytechnique de Paris, Palaiseau, France {name surraameeetteeeacc-aarai...
Ampere Software Technology, Guyancourt, France (name. surname @ampere. cars
Abstract
Detecting intrusions in network traffic is a challenging task, particularly under limited supervision and constantly evolving attack patterns. While recent works have leveraged graph neural networks for network intrusion detection, they often decouple representation lcarning from anomaly detection, limiting the utility of the embeddings for identifying attacks. We propose GraphIDS, self-supervised intrusion detection model that unifies these two stages by learning local graph representations of normal communication patterns through a masked autoencoder. An inductive graph neural network embeds each flow with its local topological context to capture typical network behavior, while a Transformer-basee decoder reconstructs these embeddings, implicitly learning global co-occurrence patterns via self-attention without requiring explicit positional information. During inference, flows with unusually high reconstruction errors are flagged as potential intrusions. This end-to-end framework ensures that embeddings are directly op- timized for the downstream task, facilitating the recognition of malicious traffic. On diverse NetFlow benchmarks, GraphIDS achieves up to 99.98% PR-AUC and 99.6 61. macro F1 Fl-score, outperforming baselines by 5-25 percentage points!
encoder-
Introduction
As more devices are connected to the internet, the frequency and sophistication of cyberattacks continue to rise, exposing vulnerabilities across diverse network environments, from enterprise infrastructures to embedded devices. These threats are difficult to anticipate, they evolve rapidly and exploit previously unknown weaknesses, making timely and accurate detection essential for protecting critical services. Although numerous network intrusion detection methods have been proposed, most rely on supervised learning and depend on large volumes of labeled data, which expensive and labor-intensive obtain. Additionally, supervised models are typically trained on known patterns, limiting their ability to detect novel threats and requiring frequent retraining to remain effective. Unsupervised methods have also been explored, but they often struggle to capture the complexity of network traffic, reducing their effectiveness against subtle or sophisticated attack patterns [
Self-supervised learning has emerged as a promising alternative by enabling the extraction of rich representations from data without the need for explicit labels. In the context of network intrusion detection, recent studies have leveraged network topology through graph-based methods 22. achieving substantial improvements over traditional techniques. As computer networks can be naturally
'Code and pre-trained models: http:://tttb..ccmmmmm/mmmmeettep
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

+
h
fq
Decoder
Encoder
hp
Pgg
hg
fq
Overview of GraphIDS: the model detects network intrusions by evaluating the reconstruc- tion error of graph-based flow embeddings. Flows representing attacks (highlighted in red) typically yield higher reconstruction errors, as they deviate from normal communication patterns.
Figure I:
represented graphs, where nodes represent hosts and edges represent communication flows, can employ Graph Neural Networks (GNNs) to learn meaningful representations that facilitate modeling the normal network behavior. However, unlike typical GNN applications, where the relevant information is encoded node features and their connections, network intrusion detection primarily encodes critical information within the edges, which reflect either normal host interactions or malicious activities.
Nevertheless, most existing approaches decouple graph representation learning from the anomaly detection task, which limits their ability to learn meaningful embeddings that are directly useful for detecting intrusions. Moreover, the self-supervised pretext tasks frequently rely the availability of negative samples or prior knowledge to construct them assmm-pttttions that often do not hold in practical intrusion detection scenarios, where labeled anomalies well-defined negative examples are scarce or entirely unavailable.
To address these limitations, we propose GraphIDS, self-supervised model jointly trained to reconstruct local graph representations of benign network traffic, using reconstruction error to identify potential intrusions (Figure I.. In network intrusion detection, anomalous behavior often manifests through irregular communication patterns and deviations from typical structural or statistical relationships. The GNN encoder captures local topological context by modeling the immediate neighborhood of each flow, integrating both structural and edge-level features that characterize underlying structure of benign traffic.
The autoencoding objective, applied batches of flow embeddings, enables the Transformer to learn broader contextual dependencies and co-occurrence patterns across the network. During training, we apply attention masking as structured regularizer, randomly disabling subset of attention links while keeping all input embeddings visible. This encourages the model to infer from partial context and learn stable distribution normal behavior. At inference time, flows that significantly deviate from this learned distribution exhibit high reconstruction errors and are flagged as potential intrusions. This end-to-end framework enables the model to generalize effectively to unseen attack types and dynamic network environments without relying on supervision negative samples.
We evaluate our model on multiple siiFlow-based datasets for Network Intrusion Detection Systems (NIDS). including NF-UNSW-NE 15 and (v2), which includes 43 NetFlow features, and their third version (v3), which extends these with 10 additional temporal features, resulting in total of 53 features
8. We use both their second version
This work makes the following key contributions:
We present GraphIDS, a novel self-supervised framework that jointly trains a GNN encoder and a Transformer-basee masked autoencoder to reconstruct local representations of benign network traffic. By leveraging both topological and contextual information in an end-to-end manner. GraphIDS directly optimizes flow embeddings for anomaly detection, without

---

relying on labeled data or prior knowledge of attack patterns. To the best of our knowledge, this the first application of a jointly trained TranTransformer architecture for network intrusion detection (Section 3).
2. We conduct extensive experiments on NIDS datasets, covering diverse network environ- ments and a wide range of attack types. GraphIDS achieves state-of-the-arr performance. outperforming existing methods by 5% to over 25% in both macro F1 and PR-AUC. These results demonstrate its strong generalization to previously unseen attacks, highlighting its practical effectiveness for real-world intrusion detection (Section
2 Related Work
Self-supervieed Masked Modeling: Masked modeling has emerged as a fundamental technique for self-supervised learning across various data modalities. In natural language processing, BERT is trained to reconstruct randomly masked tokens through a bidirectional Transformer, thereby learning to generate word embeddings that are transferable wide range of downstream tasks [5]. Similarly, in computer vision, masked autoencoders are trained to reconstruct randomly masked patches of an image by employing an asymmetric encoerrdeeooder architecture, compelling the model extract rich contextual representations from the input data [6] GraphMAE 7 extended this concept to the graph domain by training graph masked autoencoder to reconstruct masked node features order to learn meaningful graph representations.
All of these models share a common objective: learning the normal structure or contextual dependen- cies of the data through a reconstruction-basee task. This paradigm is particularly well-suited for anomaly and intrusion detection, as anomalies, such as attacks, typically lead to poor reconstruction. and can thus be effectively identified by quantifying the reconstruction error relative to the original data. For example, Georgescu [ applied MAE to medical imaging, training the model exclusively on healthy samples to identify abnormal scans based on reconstruction discrepancies. Similarly, BERT-like models have also been adapted to textual anomaly detection, enabling the identification of system malfunctions or malicious activity in log data by capturing deviations from learned normal patterns
Graph Neural Networks for Supervised Intrusion Detection: GNNs provide principled frame- work for integrating graph topology with node/edge attributes into learned embeddings. Foundational models such as Graph Convolutional Networks (GCN) formulate spectral convolutions graphs and learn node embeddings by aggregating information from local neighborhoods [10. GraphSAGE [1]] introduces inductive approach that learns to aggregate and transform features from a node's neighbors to embed unseen nodes or graphs. These architectures propagate node features through edges encode local topology and features simultaneously. More advanced variants, including Graph Attention and Graph Transformers, enhance expressivity, but the fundamental principle remains the same: summarizing each node's local structure into its embedding.
While standard GNNs primarily focus on node embeddings, edge-level representations can also be learned by various techniques, such employing the line graph, or combining end- end-point embeddings. For example, E-GraphSAGE [22 explicitly incorporates edge features into GraphSAGE by per- forming message passing that aggregates edge attributes and node attributes together. With network flow data represented as a graph of endpoints connected by edges (flows), E-GraphSAGE becomes crucial for capturing edge features (e.g., flow statistics) along with network topology. Alternatively, Friji et al. [13] propose a novel graph construction in which each network flow is represented as a node within directed "flow graph". This formulation allows complex behaviors such as multi-step attacks and spoofing to emerge as recognizable graph patterns. In another example, Zhou et al. [14] introduces NIDS that exclusively leverages topology information to detect botnet activity, such as the hierarchical organization of centralized botnets or the fast-mixing structure of decentralized ones. Collectively, these studies highlight the inherent capability of GNNs to model rich structural properties in network data. However, they rely on labeled traffic, which constrains their deployment in practical, large-scale environments where annotated data scarce or unavailable.
Graph Neural Networks for Self-Supervised Intrusion Detection: To address the limitations
imposed by the need for labeled data, Caville et al. 2 recently introduced Anomal-F, a self-supervised framework designed to detect attack patterns without relying flow labels. The approach begins
3

---

37.1.4.3
135.5.3.5
Source IP
Destination IP
Label
1721111
E1
172.1.11
C2
172.1.1.1
37.1.4.3
63
37.1.5.5
172.1.1.1
63
e4
37.14.3
135.5.3.5
On
37.1.5.5
Figure 2: Illustration of the graph construction process. Network flows are transformed into directed graph, where nodes represent hosts (IP addresses) and edges correspond to communication flows between them. Edge features capture flow statistics such packet count, byte count, and protocol information.
with the pretraining of a GNN-based encoder using a contrastive pretext task, which is then used to generate representative flow embeddings. Afterwards, separate unsupervised algorithm is applied to identify the anomalous embeddings.
In contrast Anomal-E, method adopts end-to-end training paradigm that jointly optimizes a GNN with the Transformer encoder-decoder within a masked reconstruction framework. This design enables the GNN learn representations that intrinsically aligned with the intrusion detection objective. Moreover, our approach eliminates its reliance on contrastive learning and negative samples. thereby removing the necessity for prior knowledge attack patterns. Instead, the model is trained exclusively on benign traffic, which is generally more accessible and easier to obtain in woll-wrldd environments. This design choice allows the system robustly capture the normal behavior of network traffic, making it particularly suitable for practical deployment in dynamic and evolving threat landscapes, where the nature of attacks can change significantly over time.
3 Method
3.1 Graph Construction and Framework Introduction
We define network flow as a unidirectional sequence packets that share least five attributes [5] ingress interface, source IP address, destination IP address, IP protocol number, and IP Type of Service. When UDP or TCP protocols are used, source and destination ports are also included, providing additional granularity uniquely identify individual flows.
Using the collected network flows, we construct graph representation of the computer network, where nodes correspond to hosts (identified by IP addresses) and edges represent communication flows. Each flow defines a directed edge from source node (source IP address) node (destination IP address), with edge features derived from flow statistics that provide high-level summary of the communication. The overall graph construction process is illustrated in Figure ?
destination
Assuming the ability to monitor communications among network hosts to be protected from malicious activity, begin by collecting and aggregating network flows obtain comprehensive view of network activity over time. These flows are then used to construct the graph, on which we apply GNN compute flow-level embeddings that include neighborhood context, integrating information about recent local communications. To learn the normal behavior of the network, we train the model to reconstruct these local graph representations, enabling to detect anomalies based on reconstruction errors.
3.2 Graph Representation Learning
To incorporate local graph context into flow embeddings, we employ E-GraphSAGE [12, an extension of the original GraphSAGE [1] which includes edge features during the embedding process. As edges are the most informative elements in our graphs, this approach allows GraphIDS to integrate local topological patterns into each flow representation, improving its ability to distinguish between benign and malicious activity.

---

Unlike early GNN models such as the original GCN [0], which are mainly transductive (i.e., they can only make predictions on nodes seen during training), E- B-GarphSAGE designed for inductive learning. It can generalize to unseen edges and graphs at inference time by learning aggregation functions over neighborhoods rather than depending on a fixed adjacency matrix.
To ensure scalability, we use neighborhood sampling, which makes the method efficient in both memory and computation and enables training on large graphs using mini-batches. In addition, by not relying on a fixed graph structure, E-GraphSAGI AGE is well-suited for network intrusion detection, where the underlying graph is dynamic and affected by noise.
Although in principle deeper GNN architectures could be employed, we restrict our GNN to a 1 -hop neighborhood to efficiently capture informative local context, design choice validated by our ablation study in Appendix C.5 In network intrusion detection, the immediate neighborhood of flow often reveals meaningful patterns that indicative of malicious behavior, such as unusual connections or bursty communications. Global co-occurrence patterns, which may span multiple flows hosts, are instead captured by the Transformer operating over batches of flow embeddings. This separation of roles allows GraphIDS to jointly model both local and global dependencies without incurring the computational overhead of deeper GNN layers.
To further reduce memory usage when processing graphs with a very large number of edges relative to the number of nodes, we impose configurable limit on each node's 's fanout during sampling. This fanout treated as a tunable hyperparameter.
3.3 Masked Autoencoder
To learn global co-occurrence patterns, our model employs Transformer-based masked autoencoder designed reconstruct benign graph representations. This component operates on batches of flow embeddings, H fhi..... h, produced by the GNN layer, where each h; E Re We construct each batch by concatenating 64 flow windows of 512 flows each, resulting in a sequence of 32, 768 embeddings. Before being passed to the Transformer, these embeddings are projected to lower-dimensional space Rdmddd through a linear layer, encouraging the model to learn more compact representations and reducing computational cost.
The Transformer consists of encoder and decoder, each built from stack of identical blocks. Each block contains multi-head self-attention module followed by a position-wise feed-forward network. Both sub-layers are wrapped with residual connections and layer normalization. During training, we apply a symmetric binary attention mask that disables attention between a randomly sampled subset of positions. Unlike conventional masked autoencoders that remove input tokens. our approach applies mask directly to the attention mechanism. functioning as form of structured dropout on the attention weights to improve generalization. This process encourages the model to build more robust and distributed representations by preventing over-reliance on specific contextual links. Random masking is disabled inference.
The encoder processes the projected embeddings to produce contextual representations. The decoder then takes the same projected sequence as reconstruction queries and attends to the encoder outputs via cross- cross-attention to compute per-position reconstructions. Finally, an output projection layer maps these reconstructed embeddings, H', back to the original GNN embedding space to produce the final output, H = (fi....,hu h.. The anomaly score for each flow is its squared reconstruction error, computed in the original GNN embedding space:
s; = ||; 12
During inference, higher anomaly scores identify potential attacks.
Let Realid be the number of non- non-padded embeddings in a batch. The model is trained end-to-end by minimizing the Mean Squared Error (MSE) over these embeddings:
Ruslid
LMSE
11 11, 12
(2)
Royalid
Peyalid
The gradient of the MSE loss is backpropagated through both the Transformer and the GNN, jointly updating their parameters. This aligns the training objectives of the two components, allowing the model to capture both local structural context and global co-occurrence patterns without requiring labeled attack data.
5

---

E-GraphSAGE
Transformer Encoder
Transformer Decoder
e4 e1
h4
h4
hg]
Figure 3: Overview of the full training pipeline. During inference, attention masking is omitted. The reconstruction errors $1, ,2....,88 8p serve as anomaly scores for each network flow.
3.4 Summary of the Pipeline
The full training pipeline is illustrated in Figure Network flows are first collected and processed into graph, where edges represent communications between hosts. Using neighborhood sampling, E-GraphSAGE integrates local context into edge embeddings h1, h2, hn. These embeddings then batched, projected, and passed to the masked autoencoder. The model's parameters optimized end-to-end by backpropagating the gradient of the MSE loss. This gradient flows from the output of the decoder back through both the Transformer and the GNN, allowing for the joint update all model parameters. This ensures that the GNN learns to produce representations that only structurally informative but also optimized for the reconstruction task performed by the Transformer.
At inference time, the model processes batches of flow embeddings without masking. Attacks are detected by applying a threshold to the reconstruction error, calculated as the squared L2 norm be- tween the original GNN embeddings and their final reconstructions, Flows with higher reconstruction errors are flagged as potential intrusions, as they deviate from the learned patterns of normal network traffic.
4
Experimental Evaluation
4.1
Datasets
For experiments, selected two widely used datasets for evaluating NIDS: UNSW-NB15 (16), captured in a smaller-scale network environment, and CSE-CIC-IDS2018 (17), which captures traffic from a significantly larger infrastructure. Specifically, we used their NetFlow-based versions, which correct flow extraction errors introduced by CICFlowMeter [18] and provide standard feature set including IP addresses, allowing us construct the graphs and fairly evaluate the models across datasets. We conduct our experiments both on their second version 4.. which includes 43 NetFlow features, and their recently released third version 3 which adds 10 additional temporal feature
Table D summarizes the main characteristics the datasets. By selecting two datasets collected from different network environments and with different attack scenarios, able to generalize across different settings. The datasets feature extensive encrypted traffic (e.g.. HTTPS, SSH) and diverse communication patterns, representing realistic, modern network environments. We note that the differences in statistics between the second and third versions of each dataset are due variations in the NetFlow aggregation process during feature extraction, although the details are not documented by the original authors.
verify if our approach
4.2 Data Preprocessing
Before training, replace missing invalid values with zeros and split the dataset into 80% for the training set, 10% for the validation set, and 10% for the test set, preserving the class distribution of attack types. We normalize all NetFlow features to the interval [0, using Min-Max scaling. The
scaler is fitted on the training set, which contains only benign flows, and then applied to transform
"The datasets are available under the "Permitted reuse with commercial use restriction" license (https: //guides. library. uq. edu. www.apositttaaeeeeeeeeeeeeeeeett yourrssttttooooooe http:/ttt--yoooddaaaaaaaeeeeee reuse- noncommercial

---

Table 1: Statistics of the NetFlow-based datasets, varying in scale and anomaly prevalence.
Dataset
Number of Flows
Number of Hosts
Anomaly Ratio
15--
2,390,275 2,365,424
44
3.98%
NF-UNSW-NBIS-43
44
5,40%
NE-CSE-CIC-IDS201 8-
18,893,708
255,042
11.95%
DF-CSE-CIC-IDS20188.
20,115,529
205,801
12.93%
both the validation and test sets. avoid extreme input values, any scaled value falling outside the original training range is clipped to the [-10, 10] range. For v3 datasets, timestamps are discarded, as our experiments showed that these features introduced unnecessary noise, with no performance improvement (Appendix (
The graph is then constructed, specified in Section 3.1 by using IP addresses to identify hosts, while the remaining flow features are assigned to each edge. Since attack behaviors are directional, we use directed graph preserve this information, allowing us to easily correlate the classification results with the network flows. We also note that one of the baseline models considered, Anomal-E -E, based on its original implementation and specification, unable to efficiently process the full graph of NF-CSE-CIC-IDS201 8 on our hardware. Therefore, in this case, we downsample the dataset to 20% of its original size, maintaining the proportions of the attack types.
4.3 Training and Anomaly Detection Procedure
Mini-Batch Strategies. After preprocessing, training proceeds with different mini-batch strategies for each component of our architecture. For E-GraphS AGE, we employ neighborhood sampling to manage the computational demands of graph processing. First, we divide the full set of edges into mini-bated banihbatches (with batch sizes ranging from 16,384 to 32,768 depending on the dataset). For each edge mini-batch, we sample edges from its 1-hop neighborhood up to a dataset-specific fan-out limit.
For the Transformer encoder-decoder, we process the graph embeddings in fixed-size batches of 64, where each batch contains 512 graph-based flow representations. The separate batching mechanisms reflect the fundamentally different ways the GNN and Transformer components process information: neighborhood- based for the former and context-based for the latter.
Since approach computes embeddings using batched processing and randomly sampled neigh- boring edges, does not require a fixed adjacency matrix. This makes its application practical for evolving network environments, where connections new hosts constantly established. In realistic deployments, memory usage can be controlled by applying a graph-level time window that discards outdated edges when new ones added.
Implementation and Optimization Details. We train GraphIDS for maximum of 100 epochs using the Adam optimizer on a machine with an NVIDIA A100 GPU, 32 GB of RAM, and CPU cores of an AMD EPYC 7302 processor. We implemented 2.3.0. Random seeds were fixed to ensure reproducibility. Table reportt the training time for each dataset, which varies depending on early stopping. Across all experiments, including hyperparameter optimization and baselines, the total compute time was roughly 976 GPU hours.
model using PyTorch 2.3.1 and DGL
As this architecture requires careful tuning, we thoroughly optimize several hyperparameters for each dataset, including learning rate, weight decay coefficients, edge embedding dimension, autoencoder latent dimension, number of transformer layers, dropout rate and the parameters related to the batching strategies. We initially explored coarse configurations through grid search, followed by Bayesian optimization to tune the hyperparameters based on validation Precision- Recall Area Under Curve (PR-AUC).
Our experiments showed that the model reaches optimal performance when stronger regularization applied to the GNN encoder compared to the masked autoencoder. The GNN encoder typically benefits from higher weight decay coefficients (up to 0.6) and dropout rates (up to 0.7), while the masked autoencoder performs better with more moderate regularization (weight decay from 0.01 to 0.05 and dropout rate from 0 to 0.2). We also observe that an attention mask ratio of 0.15 provides
7

---

Table 2: Total number of parameters, training time and inference time of GraphIDS across all datasets. Inference is performed in batches; the reported time refers the forward pass and excludes any preprocessing.
Dataset
# Params
Training Time (h)
Inference Time (us/sample)
15UNS
0.867M
0.39 0.27
2.27 = 0.92
NF-UNSW-NB 15-33
0.874M
0,63 0.32
3.04 + 1.25
DF-CSE-CIC-IDS201E
0.570M
1.00 + 0.55
4.89 + 0.50
-I-CSS-CIC-DDS2018-33
0.572M
1.46 + 0.59
5.09 + 1.09
good balance between regularization and reconstruction quality across datasets (see Appendix C.4 All code and configurations used for the experiments have been publicly released to ensure full reproducibility.
use early stopping based on the PR-AUC achieved on the validation set with patience of 20 epochs. We selected PR-AUC because it provides a fair, evaluation of the model performance. The model checkpoint achieving the highest validation PR- AUC is saved for final evaluation and deployment. Although this procedure assumes access to a small amount labeled data for validation and threshold tuning, avoids the scalability and generalization issues of fully supervised models. In practice, small amount of labeled data can reasonably be collected during deployment to support this step and it may even provide a more reliable and robust thresholding solution for practical applications. Nevertheless, exploring fully unsupervised thresholding strategies remains an interesting direction for future research.
Early Stopping.
4.4 Baselines
To isolate the contribution of each component in GraphIDS, we evaluate the following targeted ablations:
1. T-MAE: A Transformer- masked autoencoder with attention masking trained directly on raw NetFlow features, without any graph-based representation learning. This ablation isolates the contribution the GNN by evaluating performance without local topological context.
2. SimpleAE: A lightweight fully connected autoencoder that replaces the Transformer with two-layer MLP encoder and two-layer MLP decoder (ReLU activations). It is trained end-to-end together with E-GraphSAGE on the same reconstruction objective and with the same batching scheme GraphIDS, isolating the role of self-attention and sequence modeling.
We also compare GraphIDS against anomaly detection baselines:
Anomal-E 2 state-of-the-art method using a pre-trained E-GraphS encoder to generate edge embeddings, followed by anomaly detection those embeddings. Unlike GraphIDS, lacks joint training and self-attention, isolating the impact of the Transformer reconstruction.
CBLOF [19] A clustering- -ased local outlier factor algorithm, representative of traditional unsupervised detection techniques.
SAFE 20): A recent self-supervised method that transforms tabular network traffic data into image-like representations for masked autoencoder reconstruction, followed by lightweight novelty detector.
4.5 Evaluation Metrics
To fairly evaluate and compare models on NIDS datasets, we use two complementary metrics that are resistant to high class imbalance: threshold-depeeddent macro-averaged F1-score and threshold-indepentl PR-AUC. The maero F1-score gives equal weight to both classes, preventing the dominant benign class from overshadowing the minority attack class, and provides balanced

---

Table 3: Model performance on NetFlow datasets. Multiple values are bolded when differences are not statistically significant.
v3 Datasets (w/ temporal features)
v2 Datasets (w/o temporal features)
Model
Metric
UNSW-NB15
CSE-CIC-IDS2018
UNSW-NB15
CSE-CIC-IDS2018
External baselines
PR-AUC
0.3658 = 0.0634
0.2638 = 0.0263
0.2102 0.0157
0.7822 0.0198
CBLOF
Macro Fl
0.7319 = 0.0225
0.6599 + 0.0130
0.7046 + 0.0140
0.8889 0,0068
PR-AUC
0.8946 0.0279
0.6294 0.0923
0,2044 0.0266
0.5222 0.1896
SAFE
Macro Fl
0,9236 = 0.0086
0.4662 0.0016
0.5815 + 0.0164
0.4684 0.0001
PR-AUC
0.9032 0.0041
0.2555 0.0383
0.7489 0.0074
0,9287 0.0265
Anomal-E
Macro Fl
0.9459 0.0009
0.6709 0.0394
0.9156
0.9410 # 0.0161
Ablations
PR-AUC
0,9914 0.0022 0.0022 0.9933 = 0.0017
0.7398 0.0777
0.5995 0.0155
0.7375 0.0035
T-MAE
Macro Fl
0.4707 0.0049
0.8039 0.0447
0.8453 0.0317
PR-AUC
0.9996 = 0.0007 0.9838 0.0321
0.8458 = 0.0498
0.7864 = 0.0608
0.9310 0.0126
SimpleAE
Macro Fl
0.9223 0.0201
0,8680 0.1579
0.9450 0.0092
Ours
PR-AUC
0.9998 0.0007
0.8819 0.0347
0.8116 0.0367
0,9201 0.0238
GraphIDS
Macro F1
0.9961 = 0.0084
0.9447 = 0.0213
0.9264 0.0217
0.9431 0.0131
view of false positíves and false negatives. Unlike ROC-AUC, PR-AUC is well-suited for imbalanced datasets as it focuses on the positive class without being influenced by the large number of true negatives (21) PR-AUC is computed using seikit-leam'' implementation with linear interpolation.
To select the optimal threshold for the final classification, maximize the macro Fl Fl-score labeled validation set and then apply the same threshold to the test set. This approach ensures a fair comparison across all models while avoiding threshold optimization bias the test data.
4.6
Results
Table presents averaged metrics across multiple random seeds, along with standard deviations. Since Anomal-E combines several anomaly detectors, we report only its best best-performing variant (based on PR-AUC) for each dataset. A complete breakdown of Anomal-E's performance across all detectors is available in Appendix B.2
On the third version of the NetFlow-based datasets, GraphIDS demonstrates a strong performance, effectively leveraging both local topological context and global co-occurrence patterns to improve detection by identifying complex attack behaviors. In the smaller network environment of NF- UNSW-NBi5-v3, our ablated T-MAE model, which relies solely on contextual information, performs comparably GraphIDS. However, the larger and more diverse UF-CSE-CIC-IDSAA 1--v3 dataset, T-MAE shows a substantial drop in performance, highlighting the importance of structural information in large-scale settings.
the second version of the datasets, GraphIDS achieves comparable results to Anomal-E, while clearly outperforming it on NF-UNSW-NBIS 1-NS-- in terms of PR-AUC. Although direct comparisons between dataset versions are not possible due to differing flow aggregation and feature sets, we notice that the v3 configuration made intrusion detection more challenging for but improved for NF-UNSW-NBIS, These results suggest that both aggregation parameters and NetFlow feature selection should be carefully tuned before deployment, as they can significantly impact detection performance.
Finally, the SimpleAE ablation confirms that the autoencoding objective itself is strong driver of performance: it performs competitively across datasets and, in some cases, matches PR-AUC achieved with the Transformer. Nevertheless, GraphIDS typically attains higher macro F1 and more stable results, especially on the larger self-attention for modeling global co-occurrence patterns among flows.
8-v3, which supports the benefit of

---

Conclusion
We introduced GraphIDS, novel self-supervised framework that jointly trains graph neural network and Transformer-basee masked autoencoder to learn normal network behavior and detect complex intrusion patterns. To the best of our knowledge, this the first end-to-end architecture that combines GNNs and masked autoencoding for network intrusion detection. Experimental results demonstrate that GraphIDS achieves state-of-the-an performance across both small-scale and large-scale scenarios, outperforming existing baselines by 5-25 percentage points. With an average inference time of 3.83 uus per sample, the model also well-suited for real-time deployment, where rapid response essential.
Like other unsupervised models, GraphIDS assumes relatively stable network topology, and its performance may degrade under abrupt behavioral shifts, potentially leading to increased false positives or missed detections. Online learning techniques offer a promising avenue mitigate this limitation by enabling continuous adaptation without requiring full retraining. Furthermore, similarly other GNN-based approaches, GraphIDS is less effective single host monitoring scenarios, where limited topological context constrains its representational capacity. Future work could address this by incorporating multimodal data, such as combining network flows with logs or system calls, to improve the detection of intrusions that leave minimal footprints in network traffic alone. Finally, accurately assessing real-world detection latency requires a holistic evaluation the entire processing pipeline, including data collection, aggregation, preprocessing. and inference.
Overall, our findings underscore the effectiveness of jointly modeling local topological context and global co-occurrence patterns for network intrusion detection. By unifying GNNs and Transformers under a shared reconstruction objective, GraphIDS captures normal network behavior without relying on labeled data or prior knowledge of attack signatures, offering a practical and scalable solution for real-world deployment.
10

---

References
[1] Ziadoon Kamil Maseer, Robiah Yusof, Nazrulazhar Bahaman, Salama A. Mostafa, and Cik Feresa Mohd Foozy. Benchmarking of machine learning for anomaly based intrusion detection systems in the CICIDS2017 dataset. IEEE Access, 9:22351-22370, 2021. doi: 10.1
ACCESS.2021.30562
[2] Evan Caville, Wai Weng Lo, Siamak Layeghy, and Marius Portmann. Anomal-E: A self- supervised network intrusion detection system based on graph neural networks. Knowledge- Based Systems, 25:: 10030, December 2022. ISSN 0950-7051. doi: 10.1016/j..mmg k0166..knosys.2022. 110030. URL http://dx.... doi www.://ooo..ooo..oooo/o/// 1016/ knosys 2022. 110030
[3] Majed Luay, Siamak Layeghy; Seyedehfazzeh Hosseininoorbin, Mohanad Sarhan, Nour Moustafa, and Marius Portmann. Temporal analysis of NetFlow datasets for network intrusion detection systems, 2025. httpss:t: h/tppii////axvv./// wwgg/bab...........e...e.ee www.a///....... 04404
[4] Mohanad Sarhan, Siamak Layeghy, and Marius Portmann. Towards standard feature set for network intrusion detection system datasets. Mobile Networks and Applications, 27(1): 357-370, November 2021. ISSN 1572-8153. doi: 10.
URL
http::/ddx.do..orr
1000000001111 000-00366---0000 021-01843-0
[5] Jacob Devlin, Ming- Ming-Wei Chang, Kenton Lee, and Kristina Toutanova. BERT: Pre-training of deep bidirectional transformers for language understanding. In Jill Burstein, Christy Doran, and Thamar Solorio, editors, Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, Volume I (Long and Short Papers), pages 4171 4171-4186, Minneapolis, Minnesota, June 2019, Association for Computational Linguistics. doi: 10. 10.18653/v1/N19- 1423. URL
org N19 1423/
[6] Kaiming He, Xinlei Chen, Saining Xie, Yanghao Li, Piotr Dollár, and Ross Girshick. Masked autoencoders are scalable vision learners. In 2022 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 15979-15988, 2022. doi: 10.1109/CVPRS268822222 01553.
[7] Zhenyu Hou, Xiao Liu, Yukuo Cen, Yuxiao Dong, Hongxia Yang. Chunjie Wang, and Jie Tang. GraphMAE: Self-supervised masked graph autoencoders. In Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, KDD '22, page 594-604 604, New York, NY. USA, 2022. Association for Computing Machinery. ISBN 978 9781450393850. doi: org 11:00..1455 11w..0041111338...... .5333/33333888333321111
10.1145/5334778.553999 URL https:://oi..orgg
[8] Mariana-Tuliann Georgescu. Masked autoenccoderss for unsupervised anomaly detection in medical images, 2023.
[9] Haixuan Guo, Shuhan Yuan, and Xintao Wu. LogBERT: Log anomaly detection via BERT.
In 2021 International Joint Conference on Neural Networks (IJCNN), pages 1-8, 2021. doi: 10.1109/UCNN52387. 22022.95311111
[10] Thomas N. Kipf and Max Welling, Semi-supervised classification with graph convolutional networks, 2017.
[11] Will Hamilton, Zhitao Ying, and Jure Leskovec. Inductive representation learning large graphs. In I. Guyon, U. Von Luxburg, S. Bengio, H. Wallach, R. Fergus, S. Vishwanathan, and R. Garnett, editors, Advances in Neural Information Processing Systems, volume 30. Curran Associates, Inc., 2017. URL htt.hhtttt///rceeiiiiniee neurips.....rr ctt cc/paper_filleee ftteerffflleespprr///rr .pdf
[12] Wai Weng Lo. Siamak Layeghy. Mohanad Sarhan, Mareus Gallagher, and Marius Portmann. E-Gr A graph neural network based intrusion detection system for loT. In NOMS
2022-2022 IFFF/IFIP Network Operations and Munagement Symposium, page 1-9, IEEE, April 2022. doi: 10. (199////m5400..2222299777777 27w.222022..7887.... H.Rl:ttp::
h //xx doi org/0.0........... 1109/ 1109/
NOMS54207 2022, 9789878

---

[13] Hamdi Friji, Alexis Olivereau, and Mireille Sarkiss. Efficient Network Representation for
GNN- MaN--aaedd Intrusion Detection, page 532-554. Springer Nature Switzerland, 2023. ISBN 9783031334887. doi: 10. 101100797----01-33348888 2007/978-3-031-334400
URL http::/dx..dot doi. 0ttp:///x..do.or//1100.
[14] Jiawei Zhou, Zhiying Xu, Alexander M. Rush, and Minlan Yu. Automating botnet detection with graph neural networks, 2020. Utt.httss:/arxxii wwwpa/iww.rrggb////....3..
[15] Inter Projekt. InterProjektWikki NetFlow, 2017. URL
archivvee......ieee...e org/ web/
[16] Nour Moustafa and Jill Slay. UNSW-NB15: comprehensive data set for network intrusion detection systems (UNSW-NB15 network data set). In 2015 Military Communications and In- formation Systems Conference (MilCIS), pages 1-6, 2015. doi: 10.
[17] Iman Sharafaldin, Arash Habibi Lashkari, and Ali A. Ghorbani. Toward generating new intrusion detection dataset and intrusion traffic characterization. In International Conference on Information Systems Security and Privacy, 2018. URL httttt://p/pp http:////...ssssnisscccce.ee semanticscholar
org/CorpusID: : 4707749
[18] Lisa Liu, Gints Engelen, Timothy Lynar, Daryl Essam, and Wouter Joosen. Error prevalence in NIDS datasets: case study on CIC-IDS-2017 and CSE-CIC-IDS-2011 In 2022 IEEE Conference on Communications and Network Security (CNS), pages 254-262, 2022. doi:
10.1109/ 14.2022.9942
[19] Zengyou He, Xiaofei Xu, and Shengchun Deng. Discovering cluster-based local outliers. Pattern Recognition Letters, 1469):1641- 1650, 2003. ISSN 0167-8655. doi: https://doi.or//00..0
50167-8855((3300000555 p:1/5016786553000033
URL https: http://ccccceeee....o.oooo//aaaa
[20] Elvin Li, Zhengli Shang, Onat Gungor, and Tajana Rosing. SAFE: Self-superviieeedd anomaly detection framework for intrusion detection, 2025. URL
07119
[21] Takaya Saito and Mare Rehmsmeier. The precision-recall plot is more informative than the ROC plot when evaluating binary classifiers on imbalanced datasets. PLOS ONE, 10(3):1-21, 03 2015, doi: 10.137 10jur7//jou 18432. /ttptt/ss///:ttorrgg 10. 100.01177ojounnn
pone. 0118432
[22] Petar Velickovic, William Fedus, William L. Hamilton, Pietro Liò, Yoshua Bengio, and R. Devon Hjelm. Deep Graph Infomax. In 7th International Conference on Learning Representations, ICLR 2019, New Orleans, LA, USA, May 6-9, 2019. OpenReview.net, 2019. URL https Sopeereeview.net/frorune itte://fforummdddllllll...... 1=rkk29iAckK
[23] Mei-Ling Shyu, Shu-Ching Chen, Kanoksri Sarinnapakorn, and LiWu Chang. A novel anomaly detection scheme based on principal component classifier. In Proceedings of the IEEE Founda- tions and New Directions of Data Mining Workshop, Melbourne, Florida, USA, 2003. IEEE.
[24] Fei Tony Liu, Kai Ming Ting, and Zhi-Hua Zhou. Isolation forest. In 2008 Eighth IEEE International Conference on Data Mining, pages 413-422, 2008. doi: 10. 10.110//CDMM2000 17.
[25] Markus Goldstein and Andreas Dengel. Histogram-basee based outlier score (HBOS): A fast unsuper- vised anomaly detection algorithm. In K1-2012: poster and demo track, 09 2012.
[26] Markus M. Breunig, Hans- Kriegel, Raymond T. Ng, and Jörg Sander. LOF: identifying density-based local outliers. Proceedings of the 2000 ACM SIGMOD International Con-
ference Management of Data, SIGMOD '00, page 93-104, New York, NY, USA, 2000. Association for Computing Machinery. ISBN 1581132174. doi: 10. 111145334220.3353388 URL https://doi. org/ 10. 1145/342009 335388
[27] Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, L ukasz Kaiser, and Illia Polosukhin. Attention is all you need. In I. Guyon,
12

---

U. Von Luxburg, S. Bengio, H. Wallach, R. Fergus, S. Vishwanathan, and R. Garnett, ed- itors, Advances in Neural Information Processing Systems, volume 30. Curran Associates. Inc., 2017. URL wttp:/ctpc//pppooeeiis....eeeeee cc/ wwtpcc/ppppp.p..m fi filles/paper/2201//E11a Sffe22255577eeesff03333ccaaaaaar pdf
13

---

NeurIPS Paper Checklist
1. Claims
Question:
Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: Both the abstract and the introduction have been written to clearly describe the contributions and our claims, supported by extensive experiments on the datasets mentioned.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
It is fine to include aspirational goals as motivation as long as is clear that these goals attained by the paper.
2. Limitations
Question:
Does the paper discuss the limitations the work performed by the authors?
Answer: [Yes]
Justification: The assumptions are clearly described along the paper, including the assump- tions of being able to collect and aggregate traffic from network be monitored and the relative stability of its activity. The limitations are shown in Section
Guidelines:
The answer NA means that the paper has limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create separate "I "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.
The authors should reflect the scope of the claims made, e.g., if the approach was only tested on a few datasets or with few runs. In general, empirical results often depend implicit assumptions, which should be articulated.
The authors should reflect the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution low or images are taken in low lighting. Or speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.
While the authors might fear that complete honesty about limitations might used by reviewers as grounds for rejection, worse outcome might be that reviewers discover limitations that aren't 't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory assumptions and prool's
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
14

---

Answer: [NA]
Justification:
The paper does not define theoretical results.
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced in the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but they appear in the supplemental material, the authors are encouraged to provide short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental result reproducibility
Does the paper fully disclose all the information needed to reproduce the main ex- perimental results the paper to the extent that affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided not)?
Question:
Answer: [Yes]
The paper describes as well as possible all information needed to reproduce the experimental results. The configuration of the experiments, the code and pre-trained models will be publicly released upon acceptance to allow the full reproducibility of the results.
Justification:
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution is specific model and empirical evaluation, it may be necessary to either make it possible for others to replicate the model with the same dataset, or provide access the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how replicate the results, access a hosted model (e.g.. in the case of large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
While NeurIPS does not require releasing code, the conference does require submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) the contribution is primarily a new algorithm, the paper should make clear how reproduce that algorithm. (b) If the contribution is primarily
model architecture, the paper should describe the architecture clearly and fully.
(c) the contribution is a new model (e.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should possible for other researchers to have some path to reproducing verifying the results.
15

---

5. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instruc- tions faithfully reproduce the main experimental results, described in supplemental material?
Answer: [Yes]
Justification: We release all code and configuration files used during our experiments. The instructions to train and evaluate the models written in the README inside the zipped file. The code contains a folder called "baselines" in which we store all the code used produce the results of the baseline models, along with the corrections made to the original implementations.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurlPS code and data submission guidelines (https://nips.cm cc/
for more details.
While we encourage the release of code and data, we understand that this might be possible, so "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurlPS code and data submission guidelines (https
mtapps.cc/pullic/uu..eee
for more details.
The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. only subset of experiments are reproducible, they should state which ones omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if' applicable).
Providing much information possible in supplemental material (appended to the paper) recommended, but including URLs to data and code permitted.
6. Experimental setting/details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification: In Section 4.2 we specify how performed the data splits, while specify hyperparameter ranges and how we performed hyperparameter tuning in Section 4.3 All training and test details fully available in the released code.
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper to level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, as supplemental material.
7. Experiment statistical significance
Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Question:
Answer: [Yes]
Justification: We report the standard deviation across several runs with different random seeds for all main metrics in all tables, as stated in Section 4.6 This reflects the statistical reliability of the results by accounting for stochastic factors like random initialization, data shuffling and train-test splitting.
16

---

Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, or statistical significance tests, least for the experiments that support the main claims of the paper.
The factors of variability that the enror bars capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall
run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g.. Normally distributed errors).
It should be clear whether the error bar is the standard deviation the standard error of the mean.
is OK to report I-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables figures symmetric error bars that would yield results that are out of range (c.g. negative error rates).
If error bars reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.
8. Experiments compute resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification: Section 4.3 reports the compute resources used in experiments, including GPU and CPU type, memory, and the typical runtime range per run. also includes the total compute cost, covering all experiments conducted, including hyperparameter tuning and internal model selection.
Guidelines:
The answer NA means that the paper does include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported the paper (e.g., preliminary or failed experiments that didn't 't make it into the paper).
9. Code of ethics
Question: Does the research conducted the paper conform, in every respect, with the NeurlPS Code of Ethics
Answer: [Yes]
Justification: The research conducted this paper is in compliance with the NeurIPS Code of Ethics.
Guidelines:
The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.
If the authors answer No. they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g., there a special consid- eration due to laws regulations in their jurisdiction).
10. Broader impacts
17

---

Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
The paper discusses the potential positive societal impacts of our work, partic- ularly enhancing network security and safeguarding critical services and infrastructures from attacks. At the same time, it highlights the model's sensitivity to abrupt changes in normal network behavior, which could result in undetected attacks if the network's s behavior deviates significantly.
Justification:
Guidelines:
The answer NA means that there no societal impact of the work performed.
If the authors answer NA or No, they should explain why their work has no societal impact why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g.. deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition attacks, mechanisms for monitoring misuse, mechanisms to monitor how system learns from feedback over time, improving the efficiency and accessibility of ML).
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
Justification: We do not believe our model has a high risk of misuse, as its deployment to monitor a network environment requires significant resources, effort and careful analysis from security experts.
Guidelines:
The answer NA means that the paper poses such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
18

---

Answer: [Yes]
The code for GraphIDS and T-MAE was produced by the authors. All other assets (code, data, and models) are either original or properly cited, mentioning their respective licenses. Notably, the implementation of SAFE has no formal license, but we have reached out to the authors, who have granted us permission to use the code for research purposes. We do not publicly redistribute the code, but we explain the changes we made to the original implementation to allow reproducibility.
Justification:
Guidelines:
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package or dataset.
The authors should state which version of the asset is used and, if possible, include URL.
The name of the license ge CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should provided.
If assets are released, the license, copyright information, and terms of use in the pataastts.ppesswttt. package should be provided. For popular datasets, paperswi thcode. www.coo//aaaaaaa com/datasets has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re- re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
this information is not available online, the authors are encouraged to reach out to the asset's 's creators.
13. New assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [Yes]
Justification: The code will be submitted the reviewers as part of the supplementary material and will be publicly released upon paper acceptance. It follows the structured NeurlPS template and includes documentation to facilitate reproducibility.
Guidelines:
The answer NA means that the paper does release new assets.
Researchers should communicate the details the dataset/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset used.
At submission time, remember to anonymize your assets (if applicable). You can either create anonymized URL or include anonymized zip file.
14. Crowdsourcing and research with human subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
Answer: [NA]
Justification:
This paper does not involve crowdsourcing research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included in the main paper.
19

---

According to the NeurlPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional review board (IRB) approvals or equivalent for research with human subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or equivalent approval/teview based on the requirements of your country institution) were obtained?
Answer: [NA]
Justification: The current paper does require IRB approval as it does not contain research with human or animal subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsoureing nor research with
human subjects.
Depending the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such the institution conducting the review.
16. Declaration of LLM usage
Question: Does the paper describe the usage of LLMs if it is an important, original, or non-standard component of the methods in this research? Note that if the LLM is used only for writing, editing, or formatting purposes and does not impact the core methodology. scientific rigorousness, or originality the research, declaration is not required.
Answer: [NA]
Justification: LLMs have not been used for any important, original, or non non-standard compo- nent of the core methods this research. Their use was limited editing or formatting and their output was thoroughly reviewed.
Guidelines:
The answer NA means that the core method development in this research does not involve LLMs as any important, original, non-standard components.
Please refer to our LLM policy huttee//heerrissccc/ooffrereeee for what should or should not be described.
20

---

A Additional Details on GraphIDS and Baseline Models
CBLOF [1). CBLOF is an unsupervised anomaly detection method which identifies outliers based on clustering algorithm. In this case we use K-means for clustering and we compute the anomaly scores based on the distance to the closest large cluster. As we do for other models, once the anomaly scores are computed, we search for the best threshold on the validation set and we apply to the test set for the final classification.
Anomal-E 22. Anomal-E is the first model to apply self-supervised GNNs to network intrusion detection, demonstrating significant performance gains when applying amomaly detection methods to local graph representations compared to raw NetFlow features. The model uses E- E-GraphSAGE encoder trained via a modified version of Deep Graph Infomax [22), and generates embeddings that subsequently processed by traditional unsupervised anomaly detection algorithms,, including "CA-based anomaly detection 233. Isolation Forest (24), CBLOF [1)] and histogram-based outlier retained the original GNN encoder configuration, which was already tuned for these datasets, as our attempts at further tuning did not yield performance gains. We did, however, explore and adjust the hyperparameters of the downstream anomaly detection components using the same ranges as in the original work, selecting the best-performing one for each dataset be included in the main table.
score [25]. For our evaluation,
During the preprocessing phase, the original authors report using target encoding for categorical features. Although the specific target used for encoding is not clarified in the paper, their public implementatiorf
that attack labels are directly used as the target variable- introble-introducing label leakage. This ground-truth information encoded in the input features allows downstream models to learn to identify attacks based on those statistics, undermining the validity of the unsupervised learning setting. To ensure fair comparison and preserve the integrity of the evaluation, we removed the target encoding step in our implementation.
SAFE [20]. SAFE is an anomaly detection framework that processes tabular network traffic data by first applying feature selection discard irrelevant columns. The remaining features are then mapped into a 2D grid to create image-like embeddings, which lightweight LaNebased masked autoencoder trained to reconstruct, learning meaningful representations in the process. For novelty detection, the latent embeddings produced by the encoder are passed to local outlier factor detector 26 to identify anomalies. our evaluation, we tuned the hyperparameters of the LOF anomaly detection component. However, a brief exploration of alternative hyperparameters for the MAE module yielded no performance improvements. Given the high computational cost of tuning and the MAE's limited discrimination ability, as observed in the original codebase, we concluded that further tuning would offer marginal gains and not meaningfully affect the conclusions.
In our experiments, we adopt different evaluation metrics, as the original implementation computes the Fl-score for the normal class, effectively measuring the model's 's ability recognize benign traffic rather than attack{] While this choice may be acceptable for balanced classes, it masks the model's s real performance on the highly imbalanced datasets we consider.
T-MAE. T-MAE refers to our Transformer- based masked autoencoder component, similar to the one used in GraphIDS but applied directly to raw NetFlow features. We use the same batching strategy (batch size of 64 with 512 flow embeddings per batch) and tune its learning rate, weight decay, and dropout. We found that higher learning rate proved to be especially beneficial for the performance on the NF-UNSW-NBIIS 155v33. However, despite this adjustment, T-MAE exhibits slower convergence, resulting in significantly longer training times. On average, it requires 2.21 hours per run, compared to just 0.87 hours for GraphIDS.
The SimpleAE ablation replaces the Transformer with a fully connected autoencoder consisting of a two-layer MLP encoder and two-layer MLP decoder with ReLU activations. is trained end-to-end jointly with E- E-GraphSAGE on the same reconstruction objective, isolating the
SimpleAE.
httppp//ggttaab..oom///eerrrss/s https://githi: wtt.ab/oooomiiiiit////eee No formal license available. Used with permission from the authors for research purposes only.
E/ Apache License 2.0.
21

---

architectural benefit on top of our end-to-end reconstruction framework. To ensure fair comparison, we explored different bottleneck dimensions and hyperparameters.
B Extended Results and Comparative Analysis
B.1 Qualitative Analysis of Detection Behavior
Figure 4 summarizes model performance across datasets through precision-recall curves. These plots illustrate that GraphIDS consistently matches outperforms the baselines across variety of settings.
To better understand GraphIDS's behavior on specific attack types. plot the distribution of anomaly scores (by density) for each dataset, as shown in Figures
and g To maintain clarity, we present representative examples without error bars. Each plot includes the classification threshold, allowing us to visualize which attack types were correctly detected and which ones were missed. In particular, GraphIDS'ss lower performance on FR-UNSW-NBI positives, as also demonstrated by the t-SNE visualizations of the GNN and reconstructed embeddings in Figure 10 For NT-CSE-CIC-IDS200 datasets (both v2 and v3), the performance drop is primarily caused by misclassifications of Infiltration attacks. These involve delivering malicious payload via email, which then attempts to exploit internal vulnerabilities by scanning the network. Because this behavior closely resembles normal traffic, GraphIDS struggles to reliably classify it as anomalous without prior knowledge its specific signature, as illustrated Figures [[] and 12 In contrast, the strong performance on NF-UNSW-NBI 15-v3 is reflected in the clear separation between benign and attack clusters in Figure
due higher rate of false
NF-UNSW-NB155V8
NF-UNSW- 15-15--2
1.0
0.8
Precision
0.6
0.4
GraphiDS
0.0
T-MAE
NF-CSE CIC- B-2208833
NF-CSE- CIC- FF-CSE-CIC-DDS2018-> IDS2018-2
Anomal-E
SAFE
CBLOF
0.8
Precision
0.6
0.2
0.0
0.0
0.2
0.4
0.6
1.0
0.2
0.6
1.0
Recall
Recall
Figure 4: Precision-recall curves for models on each dataset.
22

---

Benign (TNR:
Analysis (DR: 1.00)
Backdoor (DR: 1.00)
200
Exploits (DR: 1.00)
Fuzzers (DR: 1.00)
(DR:
Density
307
Reconmaissance (DR; 1.00)
Shellcoee (DR: 1.00)
(DR:
Threshald: 1.82e-03
20F
10
184
16-4
Anomaly
Figure 5: Anomaly score by attack type in NF-UNSW-NB15.v3.
307
Benign (TNR: 0.39)
Analysis (DR: 1.00)
1.00)
De5 (DR: 0.99)
Exploits (DR: 1.00)
Genaric (DR: 1.00)
Density
Reconnaissance (DR: 1.00)
Shelicade (DR:
Worms (DR: 1.00)
Threshold:: 5.94e-03
10F
10*4
Anomaly Score
Figure 6: Anomaly score by attack type in NF-UNSW-NB15-v2
Benion (TNR: 0.98)
Brute. Force Force_WWb -Wbb (DR: 1.00)
DOOS, DO0S_ sttackkHHIC (DR: 1.00)
10'
(DR: 1.00)
DDeS s___ttdd--LOC-HHTTPPP (DR:
DoS, b Stttacks-oolleenEeee (DR: 1.00)
Density
30a
attacks-Hukk (DR: (D0:11000 1.00)
DoS LoS__ttacks-Sloree Sta.okk-SSlwwtTPPeeeset.. (DR: 1.00)
DoS, Stawhlors 1.00)
FTP-BruteForce (DR: 1.00)
Infiltration
SSH Bruteforce (DR: 1.00)
Threshols: 1.22e-05
Anomaly Score
Figure Anomaly score by attack type in NF-CSE-CIC-IDS2011
23

---

(TNR:
Bet (DR: 0.72)
Brute, Force .Web (DR: 1.00)
101
Brute Brute_Force, X35
DD06 DDO6_attack a_t_aatacaHHCCCCC (DR: 1.00)
10
DO05, ptttack-LOO--UDP (DR: 1.00)
DDo5
Density
DoS, stteattc---CodeeEeeeeeeee (DR:
Do5, jos_attadks-Huk (DR: 1.00)
aoS_attacks Sto.tttaaasssssteteeeeeeeee 1.00)
Stowark (DR:
FTP-BruteForce (DR: 1.00)
Infiltration (DR: 0.18)
SSH-Bruteforce (DR:
Threshold: 7.37e-05
2019
10-4
10-4
10-1
Anomaly
Figure Anomaly score by attack type in NE-CSE-CIC-IDS201 8-v2.
GNN Embeddings by Attack Type
Reconstructed Embeddings by Attack Type
t-SNE dimonssin 2
56-
dimennsio 2
LSNE dimension
t-SNE dimension
Allack Types
Benign
Doš Exploits
Fuzzers
Reconraissance
Analysis
Backdoor
Figure 9: t-SNE visualization embeddings by attack type NF-UNSW-NBI5--3. with density contours illustrating the concentration of benign samples.
24

---

GNN Embeddings by Attack Type
Reconstructed Embeddings by Attack Type
106
1-5NE dimansion
t-SNE dimenaion
-21
-46-
-5
250
200
100
t:NE dimersion
t:SNE dimension
Attack Types
Benign Analysis
Backdoor
Exploits
Generic
De5
Fuzzers
Reconraissance
Figure t-SNE visualization of embeddings by attack type NF-UNSW-NBI
GNN Embeddings by Attack Type
Reconstructed Embeddings by Attack Type
E-SNE aimensionn 2
20
E-SNE
110
t-SNE dimensian
t.SNE dimension
Attack Types
Benign
DDOS. attack-LOIC-UDP
DoS attacks-Hulk
FTP-BruteForce
attacks.LoiCHTTT
Infiltration
Brute, Force -Web
DoS attacks-Goldente
Do' attacks Slowloris
SSH-aruteforce
DDOS attack-Har
Figure 11: t-SNE visualization of embeddings by attack type in NF-CSE-CIC-IDS20115
25

---

GNN Embeddings by Attack Type
Reconstructed Embeddings by Attack Type
391
1-SNE dinersion
I-SNE dimensiio
-20
-15
-56
-20
L-SNE dimension 1
t-SNE dimension
Attack Types
Benign
DDOS,
Bet
DDoS, attadks-LOicHHTP
DoS SlowHTTPes
Infiltration
Bruto_Foree Force XSS
Do5, GoldeEee
DoS. Sttwoks-Slooworis
SSH Brutefortee
Figure 12: t-SNE visualization of embeddings by attack type in NE-CSE-CIC-IDS2218--1
26

---

B.2 Extended Baseline Comparison: Anomal-E and Traditional Methods
In Table we compare the training time and peak GPU memory usage of the evaluated models across datasets. Traditional methods such as CBLOF are excluded from this comparison, as they do not leverage GPU resources.
The results highlight the trade-offs between memory usage, training time, and performance across models. SAFE requires very little GPU memory thanks its shallow architecture, low input dimen- sionality, and feature selection, but this comes at the cost longer training times and substantially lower performance, as shown in Figure and in Table 3 In contrast, Anomal-E's original design, which relies on batch gradient descent and aggregates over the full neighborhood, leads to a consider- able memory footprint of up to 30 GB, making it impractical for large graphs. GraphIDS offers balanced compromise between efficiency and accuracy, using about 1.37 GB of GPU memory and training 0.87 hours on average. SimpleAE further reduces compute, training about 0.76 hours with a peak of roughly 428 MB of GPU memory, while remaining competitive in accuracy in the main tables. Finally, GraphIDS's mini-batch strategy allows it learn normal network behavior from the full graphs of the JF-CSE-CIC-IDS22 8 datasets without downsampling, which in our experiments led to improved performance and stability.
Tables and 6 summarize the performance of Anomal-E against the set of anomaly detection algorithms introduced in the original paper. These results show that none of these methods, unlike GraphIDS, is able to maintain consistent performance across all datasets.
In addition, Tables 7 and 8 report results for traditional anomaly detection algorithms applied directly to raw NetFlow features. All these models show substantially lower performance compared to GraphIDS. Among them, CBLOF achieves the most competitive results average and is used in the main paper as a representative baseline for traditional methods.
Table 4: Comparison of training time and peak GPU memory usage across models.
Model
Training Time (h)
Peak Memory (MB)
SAFE
3.59 1.34
Anomal-E
2.51 1.39
29,775
T-MAE
2.21 2.87
9,063
SimpleAE
0.76 + 0.65
428
GraphIDS
0.87 0.40
1,366
Table 5: Performance comparison of different anomaly detection algorithms applied to Anomal-E embeddings the v3 datasets. Results for GraphIDS are included as reference. Bold values indicate statistically significant improvements.
Model
Metric
NF-UNSW-NB15.-3
NF-CSE-CIC-DDS2018-3
PR-AUC
0.7827 = 0.0840
0.2555 + 0.0383 0.6709 + 0.0394
Anomal-F-CBLOF
Macro
0.8891 # 0.1127
PR-AUC
0.8735 + 0.0126
0.1663 + 0.0241 0.5329 + 0.0487
Anomal-E-HHa
Macro Fl
0.9458 + 0.0007
PR-AUC
0.7613 0.0530
0.1812 + 0.0218 0.5514 + 0.0195
Anomal-E-IF
Macro Fl
0.9166 + 0.0345
PR-AUC
0.9032 + 0.0041
0.1098 + 0.0165
Anomal-E-PCC
Macro
0.9459 + 0.0009
0.4898 0.0347
PR-AUC
0.9998 + 0.0007
0.8819 + 0.0347
GraphIDS (Ours)
Macro Fl
0.9961 = 0.0084
0.9447 # 0.0213
27

---

Table 6: Performance comparison of different anomaly detection algorithms applied to Anomal-E embeddings on the v2 datasets.
Model
Metric
NE-UNSW-NBI5--2
NF-CSR-CIC--DS2001-22
PR-AUC
0.7175 = 0.0041
0.9287 0.0266 0.9410 0.0161
Anomal-F-CBL.On
Macro F1
0.9262 + 0.0008
PR-AUC
0.7489 = 0.0074
0.9154 + 0.0181
Anomal-E-HBOS
Macro F1
0.9156 + 0.0217
0.9415 + 0.0131
PR-AUC
0.7438 + 0.0162
0.8847 = 0.0789
Anomal-E-IF
Macro
0.9153 + 0.0216
0.9332 + 0.0302
PR-AUC
0.7133 = 0.0034
0.9178 + 0,0078
Anomal-E-PCA
Macro Fl
0,9262 = 0.0008
0.9436 + 0.0076
PR-AUC
0.8116 = 0.0367
0.9201 + 0.0238
GraphIDS (Ours)
Macro FI
0.9264 + 0.0217
0.9431 + 0.0131
Table 7: Evaluation of traditional anomaly detection algorithms on the v3 datasets.
Model
Metric
NF-UNSW-NBI5-4
NE-CSE-CIC-DDS201B--
PR-AUC
0.3658 = 0.0634
0.2638 # 0.0263
CBLOF
Macro Fl
0.7319 = 0.0225
0.6599 0.0130
PR-AUC
0.2604 = 0.0021
0,1822 # 0.0011
HBOS
Macro Fl
0.7171 = 0.0007
0.5365 0.0070
PR-AUC
0.2537 = 0.0205
0.1630 = 0.0139
IF
Macro Fl
0.6822 = 0.0152
0.5330 = 0.0160
PR-AUC
0.4380 # 0.0038
0.1200 0.0003
PCA
Macro Fl
0.7554 # 0.0018
0.5306 = 0.0004
PR-AUC
0.9998 + 0.0007
0.8819 # 0.0347
GraphIDS (Ours)
Macro Fl
0.9961 + 0.0084
0.9447 + 0.0213
Table Eyaluation of traditional anomaly detection algorithms on the v2 datasets.
Model
Metric
NF-UNSW-NB15-v2
NE-CSE-CIC-IDS2018--2
PR-AUC
0.2102
0.7822 = 0.0198
CBLOF
Maero F1
0.7046 0.0140
0.8889 0.0068
PR-AUC
0.3197 0.0036
0.6662 0.0205
HBOS
Macro Fl
0.7032 = 0.0012
0.8578 = 0.0034
PR-AUC
0.1914 # 0.0075
0.6124 0.0269
IF
Macro Fl
0.6844 = 0.0071
0.8321 + 0.0099
PR-AUC
0.2840 + 0.0039
0.5911 + 0.0014
PCA
Maero Fl
0.6975 + 0.0023
0.6128 0.0076
PR-AUC
0.8116 + 0.0367
0.9201 0.0238
GraphIDS (Ours)
Macro Fl
0.9264 # 0.0217
0.9431 0.0131
28

---

C
Ablation Studies
In this section, we aim to isolate the individual contributions of specific design choices in GraphIDS. To reduce computational cost of the ablation study, we conducted experiments over fewer random seeds than those used for the main results. Nevertheless, the setup was sufficient to clearly identify the impact of each component.
C.1 Effect of Timestamp Features
In this ablation study, we evaluate the impact of including timestamps and FLOW_EN L_____D___i___ WIDD_MLLISSCOODS among the input features. Our goal is to determine whether they provide useful temporal information or only introduce noise. As shown in Table their inclusion has negligible impact on NF-UNSW-NBISS 155-33 but clearly degrades the performance on NF-CSE-CIC. IDS2018-v3. This suggests that, overall, excluding timestamps leads to more efficient representations.
Table 9: Effect of including timestamp features model performance across v3 datasets.
Model
Metric
NE-UNSW-NBI5--3
NF-CSE-CIC-IDS2008-3
PR-AUC
0.9991 0.0011
0.7909 0.0151 0.9088 = 0.01
W/TS
Macro F1
0.9957 # 0.0091
PR-AUC
0.9989 0.0017
0.8523 = 0.0283 0.9385 + 0.0122
w/o TS
Macro F1
0.9982 0.0029
C.2 Effect of Positional Encoding
To investigate whether our model can benefit from sequence modeling, beyond co-occurrence patterns, temporally ordered the flows in the v3 datasets and added positional encodings to each input window before passing it to the Transformer. We evaluated two variants: sinusoidal and learnable encodings.
For sinusoidal positional encoding, we used the formulation from pos and dimension is given by:
where the encoding at position
pos
pos
PE 21) = sim
PE (pos.2i+1) = COS
1000024y2
10000
For learnable positional encoding, used parameter matrix P E 4xd with L the maximum sequence length and d the embedding dimension. This matrix is optimized along with the rest the model during training.
The results in Table IO indicate that positional encodings have little impact on GraphIDS's perfor- mance, suggesting that the model primarily learns global co-occurrence patterns rather than temporal dependencies. To reflect this, we omit positional encodings in the main experiments and shuffle the flow order.
Table 10: Effect of positional encoding across datasets.
Model
Metric
NE-UNSW-NBI5--3
NE-CSE-CIC-IDS2018--
PR-AUC
1.9939
0.8572 + 0.0284
w/ Learnable Encoding
Macro Fl
0.9480 + 0.0153
PR-AUC
0,9955 0.0110
0,8537 + 0.0421
w/ Sinusoidal Encoding
Macro Fl
0.9904 0.0214
0.9446 0.0171
PR-AUC
0.9955+0.0112
0.8661 + 0.0411 0.9546 + 0.009
w/o Positional Encoding
Macro Fl
0.9821 + 0.0256
29

---

C.3 Effect of GNN Dropout Rate
As shown in Table I1. the dropout rate E-GraphSAGE has a relevant impact on GraphIDS's overall performance. Higher dropout rates achieved better results on the NF-UNSW-NB15 datasets, suggesting that the GNN prone to overfitting in smaller network environments. In these cases. stronger regularization helps the model generalize to unseen data. On the NF-CSE-CIC-IDS201 8 datasets, introducing a non-zero dropout rate also helped stabilize the learning process, although its impact on final performance was less pronounced.
Table 11: Effect of the GNN dropout rate across datasets.
Dataset
Metric
0.0
0.25
0.5
0.6
0.7
PR-AUC
0.9773
0.9619
0.9845
0.9998
0.9790
NF-UNSW-NBI5-v3
Macro Fl
1.0000
0.9999
1.0000
1.0000
1.0000
PR-AUC
0.8758
0.8645
0.8630
0.8461
0.8621
NF-CSE-CIC-IDS2001--2
Macro Fl
0.9466
0,9270
0.9450
0,9160
0,9219
PR-AUC
0.8117
0.8154
0.8129
0.8094
0.8301
NF-UNSW-NBIS--2
Maero Fl
0.9342
0.9303
0.9140
0.9241
0.9285
PR-AUC
0.8952
0.8964
0.9005
0.8886
0.8925
NF-CSE-CIC-IDS2201-22
Macro F1
0.9322
0.9429
0.9411
0.9402
0.9396
C.4 Effect of Masking Ratio
We found that the masking ratio had noticeable impact on the model's performance for NF-CSE- UIC-IDS2018-v3, In this case, a masking ratio of 0.15 made the reconstruction task sufficiently challenging for GraphIIDS to learn more complex relationships within the flow embeddings. We also noticed that ratios of 0.7 or higher led gradient explosions and training instability across all datasets.
Table Effect of attention mask ratio across datasets.
Dataset
Metric
0.0
0.15
0.3
0.5
0.7
PR-AUC
0.9992
1.0000
1.0000
1.0000
1.0000
NF-UNSW-NBIS--3
Macro Fl
0.9998
0.9999
0.9793
0.9998
0.9998
PR-AUC
0.8659
0.8772
0.8691
0.8391
0.8216
NF-CSE-CICCIDS2211--3
Maero F1
0.9445
0.9472
0.9485
0.9051
0.9308
PR-AUC
0.8373
0.8384
0.8384
0.8261
0.8289
NF-UNSW-NBI5-v2
Macro F1
0.9344
0.9342
0.9344
0.9299
0.8756
PR-AUC
0.9115
0.9133
0.9132
0.9132
0.9155
NF-CSE-CIC-IDS201--9
Macro F1
0.9390
0.9419
0.9419
0.9398
0.9414
C.5 Efffet of Neighborhood Size
We explored various neighborhood sizes during the initial development phase, this choice directly impacts both model performance and computational cost. To rigorously validate our design, we conducted an ablation study comparing 1-hop. 2-hop, and 3-hop variants of GraphIDS under identical experimental conditions.
As shown in Table 13 the I-hop configuration delivers the most consistent performance. On both NF-UNSW-NBIS.CE and configurations in both PR-AUC and Macro F1. While increasing the receptive field to hops yields marginal improvements on the v2 versions of these datasets, it does not provide a universal benefit and actually degrades performance the v3 benchmarks.
the 1-hop baseline outperforms deeper
Crucially, expanding the neighborhood substantially increases training and inference runtime by up to 3x and, average, consumes 29% more memory. Although the multi-hop configurations
30

---

demonstrate that our architecture can effectively aggregate distant information without suffering from severe wver-smoothing, the mixed performance gains are insufficient justify the added latency. Consequently, we maintain the 1-hop neighborhood as the most effective and efficient default for real-time intrusion detection.
Table 13: Effect of neighborhood size (number of GNN hops) across datasets. Mean (std) over seeds.
Dataset
Metric
1-hop
2-hop
3-hop
PR-AUC
0.9998 + 0.0007
0.9994 = 0.0011
0,9977 0.0031
NF-UNSW-NB115-3
Macro FI
0.9961 = 0.0084
0.9910 = 0.0164
0.9839
0.0302
PR-AUC
0.8819 = 0.0347
0.8556 # 0.0305
0.8683 0.0686
NF-CCSE-CII--DSS2118-3
Macro Fl
0,9447 = 0.0213
0.9352 = 0.0094
0,9362 0.0286
PR-AUC
0.8116 0.0367
0.8367 = 0.0109
0.7766 0.0814
NF-UNSW-NB15-v2
Macro F]
0.9264 # 0.0217
0.9334 = 0.0185
0.9329 0.0128
PR-AUC
0.9201 = 0.0238
0.9288 0.0269
0.9308 0.0094
NF-CSE-CIC-DDS20118-2
Macro Fl
0.9431 = 0.0131
0.9475 = 0.0211
0.9517 1.617=00000 0.0148
D Hyperparameters
Table reports the complete set of optimized hyperparameters used for the GraphIDS model. While these were selected to maximize PR-AUC performance, memory usage can be reduced by decreasing the Transformer's s window size, while the GNN remains efficient by randomly sampling subsets of neighboring edges.
Table 14: Hyperparameters for the GraphIDS model across datasets. Dataset names are shortened for formatting.
Parameter
UNSW-NB15-43 -
UNSW-NBI5-42
NE-CSE-CIC-ISS20B--2
GNN Perameters
edim_out
72
nhops
1
fanout
32,768
32.768
32,768
32.768
agg type
mean
mcan
mcan
mcan
dropout
0.6
0.5
0.75
0.5
Transformer Parameters
num layers
1
1
1
num heads
4
4
embed dim
32
48
32
bindow_size
512
512
512
512
mask_ratio
0.15
0.15
0.15
0.15
dropout
0.0
0.2
0.0
0.2
Training Parameters
learning_rat
x 10
1 10-4
1.1 x 10-5
7.4 x 10-5
gon weight decay
0.6
0.6
0.6
0.6
ac wwwgwwt decay
0.04
0.04
0.046
0.011
gnn batch size
16.384
16,384
32,768
16,384
ae ae_batch batch_sizee
64
64
64
64
31


Reviews:
[{"review_id": "Z9DaO2MqTr", "reviewer": "Reviewer_MZJM", "summary": "This paper introduces a self-supervised network intrusion detection method. The method relies on masked autoencoding of graph representations of network activity. Network flow embeddings are extracted using E-GraphSAGE. These embeddings are masked and reconstructed by a Transformer. As with typical autoencoder methods, the reconstruction error for the model trained on nominal data is thresholded for intrusion detection. The authors compare their approach to a few baselines on four intrusion detection datasets. Finally, the authors provide detailed qualitative results, embedding analysis, and ablation in the appendix.", "questions": "1. What steps were taken to ensure the baseline comparison is fair? The hyperparameters and their optimization for the proposed method are described, but they are not described for the baseline methods. \n\n2. The Anomal-E baseline is described as using a pre-trained E-GraphSAGE encoder. Is this encoder fine-tuned on this data? If not, was your encoder also not fine-tuned? \n\n3. Since masking has a minor attention has a minor impact on performance and temporal information is not needed, why is a Transformer the right choice? Could the architecture be simpler without it? What contributes to the dramatic increase in performance over approaches like Anomal-E? The T-MAE approach also works very well in some cases, indicating that there is some part of the Transformer or masking that is necessary for strong intrusion detection.", "limitations": "The authors have addressed the limitations but have not discussed negative societal impacts. As this paper focuses on intrusion detection, there are likely no negative societal impacts.", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 4, "clarity": 4, "significance": 3, "originality": 2, "strengths_and_weaknesses": "### Strengths\n\n- Strong quantitative performance across multiple intrusion detection datasets and against baseline methods\n- Detailed experiments including convincing qualitative and embedding analyses\n- Well-written paper with clear and informative figures\n\n### Weaknesses\n\n1. Limited contribution. While the results are strong and are certainly impactful from an intrusion detection perspective, the core method presented seems common for other applications. Masked autoencoders have been used for self-supervised anomaly detection in images. Since the core feature extraction is done through the E-GraphSAGE architecture, the novelty of the approach is limited. However, I do recognize that the proposed approach's performance is strong, so new designs may unnecessarily complicate the task.\n\n2. The results of the ablation seem to contradict parts of the architecture. \n\n    Appendix C.2 shows that positional encoding was not needed and that temporal dependencies are not strong. Why is a Transformer needed then? Would a MLP be enough? Is attention still extremely important? It would be interesting to see another ablation where the autoencoder architecture is changed.\n\n   Along with that, Appendix C.4 shows that the improvement when attention masking is very minor. The task of reconstruction (like with non-masked autoencoder anomaly detection) is more important than reconstructing well with masked attention. Considering these two results, it is unclear what about this architecture is better than E-GraphSAGE with a vanilla MLP autoencoder (similar to Anomal-E). Clarifying this may strengthen the paper.\n\nPlease see the questions section for more weaknesses and specific questions relating to the above comments. \n\n### Quality\n\nOverall, this is a high-quality paper. It has strong experimental results, is well-written, and is detailed.\n\n### Clarity\n\nThe paper is clear and easy to follow. \n\n### Significance\n\nThe paper is likely significant to the field of network intrusion detection and may inspire anomaly detection approaches in other domains, especially those with temporal graphs (like traffic systems).\n\n### Originality\n\nThe architecture is novel for network intrusion detection but the ideas presented and used have limited novelty.", "was_revised": true, "final_justification": "During the rebuttal phase, the authors gave a detailed response answering my questions and addressing my concerns. In particular, the authors resolved my concerns of fairness in the baseline comparisons, clarified the E-GraphSAGE training process, and performed an additional ablation on model architecture. The additional ablation helped resolve some potential design contradictions revealed by other ablations. Overall, all my major concerns have been addressed. \n\nI believe this is a solid conference paper that will be appreciated by the graph machine learning and cybersecurity communities. Therefore, I recommend acceptance.", "rebuttal": "We thank the reviewer for their thorough review, which not only recognizes the strengths of our work but also provides suggestions for additional proofs that further validate our findings. Below, we respond to each point in detail. \n\n---\n\n**1. On the fairness of baseline comparisons**\n\nThe reviewer raises a valid point. Our goal was to make comparisons as fair as possible under practical constraints:\n\n* T-MAE (our ablation): We conducted dedicated hyperparameter tuning to ensure competitive performance.\n* Anomal-E and traditional anomaly detection models: We tuned the E-GraphSAGE encoder but saw no performance gain, so we retained the original configuration, which was already tuned for the same datasets. We explored and adjusted the hyperparameters of the anomaly detection components using the same ranges as in the original work. These details are available in our code.\n* SAFE: We tuned the hyperparameters of the LOF anomaly detection component, but briefly exploring alternative hyperparameters for the MAE module yielded no performance improvements. Furthermore, as can be observed from the original codebase, the MAE component in SAFE shows poor discrimination ability (e.g., flat ROC curves, AUC=0.5), which limits its contribution regardless of parameter tuning. Given these factors and the computational cost (tuning SAFE can take several days), we believe further tuning would yield marginal gains and not meaningfully affect the overall conclusions. We will clarify this point in the revised manuscript.\n\n---\n\n**2. On pre-training and fine-tuning of E-GraphSAGE**\n\nIn Anomal-E, the E-GraphSAGE encoder is trained using Deep Graph Infomax (DGI) on benign training data, essentially a self-supervised pretext task, so we refer to the encoder as \"pre-trained\". This step is performed before anomaly detection and the encoder is not fine-tuned afterward, as the original design and the assumption of label unavailability preclude it. Our implementation follows this setup, consistent with the original Anomal-E paper.\n\nIn contrast, our method jointly trains E-GraphSAGE together with the Transformer encoder-decoder, optimizing the entire architecture end-to-end without relying on a separate pretext task. This allows the encoder to learn representations that are directly useful for the anomaly detection objective, rather than general-purpose graph embeddings. This difference in training strategy is a central reason for our model’s improved performance.\n\n---\n\n**3. On the role of the Transformer and performance improvements**\n\nThis question addresses a key design choice we considered during the development of GraphIDS. We had explored simpler architectures, and for this rebuttal, we have run a rigorous comparison to provide concrete data on this choice. To do so, we tested a baseline where the Transformer is replaced by a fully connected autoencoder, consisting of a two-layer encoder and a two-layer decoder, using ReLU activations, isolating the architectural benefit on top of our end-to-end reconstruction framework. To ensure a fair comparison, we explored different bottleneck dimensions and hyperparameters.\n\n| Model                 | NF-UNSW-NB15-v3         | NF-CSE-CIC-IDS2018-v3   | NF-UNSW-NB15-v2         | NF-CSE-CIC-IDS2018-v2   |\n| ---------------------| ------------------------| ------------------------| ------------------------| ------------------------|\n| **SimpleAutoencoder**| PR-AUC: 0.9996 ± 0.0007  | PR-AUC: 0.8458 ± 0.0498 | PR-AUC: 0.7864 ± 0.0608 | PR-AUC: 0.9310 ± 0.0126 |\n|                      | F1: 0.9838 ± 0.0321      | F1: 0.9223 ± 0.0201     | F1: 0.8680 ± 0.1579     | F1: 0.9450 ± 0.0092     |\n| **GraphIDS**         | PR-AUC: 0.9998 ± 0.0007  | PR-AUC: 0.8819 ± 0.0347 | PR-AUC: 0.8116 ± 0.0367 | PR-AUC: 0.9201 ± 0.0238 |\n|                      | F1: 0.9961 ± 0.0084      | F1: 0.9447 ± 0.0213     | F1: 0.9264 ± 0.0217     | F1: 0.9431 ± 0.0131     |\n\n\nThe results confirm that the autoencoding task itself provides the most significant performance increase, as evidenced by the strong SimpleAutoencoder baseline.\n\nHowever, the Transformer still provides clear improvements in performance and stability. GraphIDS consistently achieves higher Macro F1-scores, which we attribute to self-attention's ability to capture global co-occurrence patterns between flows. Importantly, we gain this advantage while keeping the model lightweight, using only a single-layer Transformer encoder and decoder. While we did not focus on maximizing its efficiency, it is also possible to reduce the window size to balance performance with resource usage.\n\nWe will include these new results in the appendix and expand the architectural discussion in the revised paper. \n\n---\n\nWe thank the reviewer for raising these technical points, and we believe these additions further support the robustness and practical value of our approach."}, {"review_id": "nTuS1NLzXI", "reviewer": "Reviewer_hnjd", "summary": "The paper introduces GraphIDS, an innovative self-supervised Network Intrusion Detection System (NIDS), which combines the strengths of Graph Neural Networks (GNNs) and Transformers into a unified end-to-end framework. GraphIDS leverages masked autoencoding to reconstruct local graph-based embeddings of benign network flows, enabling it to capture both local topology (via GNNs) and global co-occurrence patterns (via Transformers). The joint training of these components under a shared reconstruction objective is notably novel, ensuring flow embeddings are directly optimized for anomaly detection, free from reliance on explicit labeled attack examples or negative samples.", "questions": "Please refer to weaknesses. If provided compelling evidence, I may increase my score.", "limitations": "The authors discussed the limitations in this work. Mentioned in Section 5.", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 2, "significance": 3, "originality": 3, "strengths_and_weaknesses": "## Strengths:\n- Unified End-to-End Framework:\nThe innovative integration of GNN and Transformer architectures via masked reconstruction is methodologically novel, ensuring embeddings optimized explicitly for anomaly detection tasks.\n\n- Evaluations:\nClearly outlines dataset selection criteria, preprocessing steps, hyperparameter tuning strategies (including Bayesian optimization), early stopping criteria, and reproducibility considerations, ensuring transparency and repeatability of experiments.\n\n## Weaknesses:\n\n- I found that the absence of a clear discussion on encrypted network flows (e.g., AES-encrypted traffic) in the paper constitutes a significant omission, especially given the prevalence and increasing ubiquity of encrypted communication in modern networks. \nThe paper’s approach, which heavily depends on NetFlow features and structural relationships within traffic, inherently makes assumptions about feature availability and informativeness:\n   - Implicit Assumption:\n      The paper implicitly assumes sufficient discriminative power from structural (graph-based) features derived from unencrypted or partially observable traffic. It doesn’t clarify how encryption impacts feature effectiveness or robustness.\n   - Potential Overestimation of Performance: \n    The impressive empirical results (99.98% PR-AUC, etc.) might significantly deteriorate in realistic deployments where most traffic is encrypted, potentially making the model much less practical or effective.\n\n- I have also concerns on training convergence in P2P Environments:\n Unlike client-server architectures, P2P lacks inherent hierarchical structure (e.g., explicit \"client-to-server\" patterns), providing fewer distinctive topological cues for distinguishing normal from anomalous flows. And constant peer connections and disconnections produce rapidly evolving graph structures, complicating the learning of stable structural embeddings. Since GraphIDS relies heavily on stable local neighborhoods and global communication patterns for reconstructive learning, highly dynamic or homogeneous networks (such as P2P) might prevent stable embedding convergence, reducing overall detection capability.\n\n- Limited Evaluation Scope:\nEmpirical validation is restricted primarily to two specific NetFlow datasets. Broader validation against more diverse network environments, encrypted datasets.\n\n- From the perspective of readers, I want to clarify that are minor issues on writing quality and discrepancies.\n   - Lack of Clarity in Methodological Details : The joint training process between the GNN and Transformer, while methodologically innovative, from the readers' perspective, we demands precise and explicit descriptions. Ambiguous or vague explanations undermine reproducibility and scientific rigor. \n\n- Limited Discussion on Practical Deployment Challenges :\n  Practical concerns (like real-time inference constraints, robustness under realistic network shifts, or encryption considerations) should be explicitly discussed rather than implicitly assumed manageable.", "was_revised": true, "final_justification": "The paper makes a meaningful, practical contribution with excellent results and a coherent end-to-end design. While some robustness and deployment questions remain for future work, the authors’ clarifications and added analyses sufficiently address my core concerns and the other reviewers as well. I recommend the acceptance for this paper.", "rebuttal": "We thank the reviewer for their feedback. Below, we respond to each point raised.\n\n---\n\n**1. Encrypted traffic**\n\nBoth the UNSW-NB15 and CSE-CIC-IDS2018 datasets include encrypted traffic. Specifically, this includes extensive HTTPS and SSH flows in CSE-CIC-IDS2018, and SSH and BitTorrent in UNSW-NB15. This has been confirmed through inspection of the raw PCAP files, which are openly available, using tools like Wireshark.\n\nHowever, as our method operates on NetFlow/IPFIX features, which summarize metadata at the IP and transport layers (e.g., IP addresses, ports, protocols, flow durations, byte counts), the presence of encryption (at higher layers such as TLS) does not impact the feature availability. NetFlow-based approaches, by design, are agnostic to payload encryption. As such, our model is fully compatible with encrypted traffic scenarios, and its effectiveness is not contingent on visibility into packet payloads.\n\nWe will clarify in the paper that both datasets include encrypted traffic (e.g., HTTPS, SSH), and that our approach remains compatible due to its reliance on NetFlow metadata.\n\n---\n\n**2. Training convergence in P2P environments**\n\nWhile our primary focus is on enterprise-like, common client-server architectures, we note that the UNSW-NB15 dataset used in our experiments includes BitTorrent traffic, which follows a P2P communication model. Therefore, our model has been partially evaluated in the presence of P2P flows. \n\nWhile these scenarios may not fully reflect highly dynamic or homogeneous P2P networks, they do provide some exposure to non-hierarchical, non-client-server topologies. A more comprehensive analysis of model behavior under fully dynamic P2P environments remains an interesting direction for future work.\n\nWe will also add a clarification in the text noting the presence of BitTorrent traffic in the UNSW-NB15 dataset.\n\n---\n\n**3. Clarity of methodological details**\n\nWhile the architecture and joint training process are described in the paper and fully available in the released code, we acknowledge that parts of the narrative may benefit from clearer exposition. Due to space constraints, we avoided extensive math or diagrams, but we agree that additional clarity would enhance reproducibility. \n\nIn a future revision, we will revise this section to more explicitly describe the masking and reconstruction steps to aid understanding.\n\n---\n\n**4. Evaluation scope**\n\nNetFlow-based datasets with labeled attacks are limited in number, and the selected datasets are among the most comprehensive, widely used, and representative of real-world intrusion detection settings. Including encrypted traffic as well, we believe these choices are appropriate for evaluating the effectiveness of our proposed approach, which is intended for practical deployment in conventional network environments. However, we do agree that the research community would greatly benefit from the development and release of more up-to-date, comprehensive, and well-structured datasets reflecting evolving network scenarios and attacks. \n\n---\n\n**5. Deployment considerations**\n\nWe acknowledge this limitation in Section 5, noting that accurately assessing real-world detection latency requires a holistic evaluation of the full pipeline, including data collection, aggregation, preprocessing, and inference. While such a deployment-focused study would offer additional insight, it involves extensive engineering effort and infrastructure setup. As such, we consider it outside the scope of this work, which centers on modeling innovations under the common NetFlow-based IDS paradigm.\n\n---\n\nWe believe these clarifications and planned revisions address the reviewer’s concerns and will help improve the final version of the paper."}, {"review_id": "3PjZ0rpbBC", "reviewer": "Reviewer_dRmA", "summary": "This paper presents GraphIDS, a self-supervised intrusion detection framework that jointly trains a GNN-based encoder and a Transformer-based masked autoencoder to reconstruct benign network flow representations. The method uses NetFlow data to construct a directed graph, where edges correspond to communication flows enriched with statistical features. The model flags anomalous flows by measuring reconstruction error, without requiring labeled attack data. Extensive experiments on four NetFlow-based NIDS datasets demonstrate that GraphIDS outperforms existing baselines by significant margins in both PR-AUC and macro F1, while maintaining fast inference speeds suitable for real-time deployment.", "questions": "- How would GraphIDS handle sudden changes in normal network behavior (e.g., flash crowds or reconfigurations)? Is retraining necessary in such cases? How does GraphIDS adapt to evolving benign traffic patterns or changes in network behavior without retraining?\n - Why was a 1-hop neighborhood chosen for the GNN? Would extending to multi-hop improve detection of coordinated attacks? The Transformer masking ratio is fixed at 15%. Was this empirically justified? How does performance vary with different ratios?\n - Since labeled validation data is used to set thresholds, can the method work in fully unsupervised settings without such labels?\n - How resilient is GraphIDS to evasion attempts, where attackers mimic benign traffic patterns to reduce reconstruction error?", "limitations": "- The model is trained on benign traffic and assumes relatively stable network behavior. In dynamic environments with concept drift or shifting user patterns, detection accuracy may degrade unless retrained or adapted.\n  - The effectiveness of GraphIDS depends on meaningful graph structures. In settings with limited topological context (e.g., single-host or encrypted traffic), the model may struggle to learn informative embeddings.\n  - Although training is unsupervised, anomaly detection thresholds are selected using a labeled validation set. In practice, such labels may be unavailable, requiring alternative strategies for unsupervised thresholding.\n  - Key design decisions, such as the use of 1-hop neighborhoods or fixed attention masking ratio, are not extensively ablated. It remains unclear how these choices affect robustness or generalization.", "rating": 4, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 2, "originality": 3, "strengths_and_weaknesses": "* Paper Strengths\n  - The paper presents an end-to-end architecture that combines GNN and Transformer components in a self-supervised reconstruction task, tailored for network intrusion detection. \n  - Extensive experiments across multiple datasets with varied scale and traffic types validate the method’s generalization and robustness, achieving state-of-the-art performance.\n  \n\n* Paper Weaknesses\n  - The novelty is moderate, as the method largely combines existing components (E-GraphSAGE, MAE) with limited architectural innovation. The significance of the contribution is limited by the fact that the core idea (reconstruction-based anomaly detection with graph modeling) is well explored in prior work, e.g., GraphMAE and Anomal-E.\n  - Though masking strategy is well motivated, more ablation on different masking ratios and their impact on detection performance would be helpful.\n  - Inference relies on thresholding over reconstruction errors, which requires some labeled validation data or additional heuristics for deployment. The method still requires labeled validation data for threshold selection, which partially undermines the \"unsupervised\" claim.", "was_revised": true, "final_justification": "The rebuttal has convincingly addressed my primary concerns by providing additional ablation results that justify the 1-hop neighborhood and masking ratio choices, and by clarifying the role of labeled validation data. Although adaptability to sudden benign traffic changes and robustness to evasion attacks remain only partially explored, the proposed joint GNN and Transformer training paradigm, applied for the first time to network intrusion detection, delivers clear and meaningful performance gains over pipeline approaches. Overall, the paper is technically sound, well supported by experiments, and of practical value, and I therefore maintain my Borderline Accept recommendation with the view that its strengths substantially outweigh its remaining limitations.", "rebuttal": "We thank the reviewer for the valuable feedback and address each point below.\n\n---\n\n**1. Handling sudden changes in normal network behavior**\n\nThis limitation is acknowledged in Section 5, where we note that GraphIDS assumes relatively stable benign behavior and that abrupt changes may lead to increased false positives or missed detections. We also mention online learning as a promising strategy to address this. \n\nTo make this limitation and its implications more prominent, we will emphasize this point more clearly in the revised version and expand the discussion of potential adaptation strategies, such as adaptive thresholding or self-training on high-confidence samples. \n\nWe consider this an important direction for future work. A realistic evaluation of the robustness of these systems would require new datasets or experimental setups explicitly designed to reflect dynamic but benign network changes. While both UNSW-NB15 and CSE-CIC-IDS2018 include diverse traffic types and temporal segments, they do not specifically model sudden shifts in benign behavior. Therefore, while some variation is present, they are not ideally suited for studying online adaptation in the face of benign concept drift, and to the best of our knowledge, no existing network intrusion datasets have been designed with this specific goal in mind.\n\n---\n\n**2. On GNN neighborhood size and masking ratio**\n\nThank you for raising this important point.\n\nRegarding neighborhood size, we explored various settings during the initial development phase. Preliminary results indicated that increasing the number of hops did not consistently improve performance, while substantially increasing training and inference runtime by up to 3$\\times$, and using on average 24% more memory. This not only made extensive hyperparameter tuning impractical but also negatively impacted real-time latency, which is a critical aspect of intrusion detection. Based on these observations, we selected a 1-hop neighborhood as the default, though our implementation supports arbitrary n-hop configurations.\n\nTo rigorously validate this design choice, we conducted an ablation study comparing 1-hop, 2-hop, and 3-hop variants of GraphIDS under identical experimental conditions. As shown in the table below, the 1-hop configuration consistently delivers strong and stable performance across all datasets. While the 3-hop variant shows slightly higher scores on NF-CSE-CIC-IDS2018-v3, the differences are within the standard deviation and not statistically significant. In contrast, on other datasets, larger neighborhoods often lead to degraded or less stable performance. This suggests that increasing the receptive field may introduce noise from distant, less relevant nodes, diluting local information. Given the added computational overhead of multi-hop aggregation, these results support our choice of 1-hop as an effective and efficient default.\n\n| Model            | NF-UNSW-NB15-v3         | NF-CSE-CIC-IDS2018-v3   | NF-UNSW-NB15-v2         | NF-CSE-CIC-IDS2018-v2   |\n| ---------------- | ----------------------- | ----------------------- | ----------------------- | ----------------------- |\n| GraphIDS (1-hop) | PR-AUC: 0.9998 ± 0.0007 | PR-AUC: 0.8819 ± 0.0347 | PR-AUC: 0.8116 ± 0.0367 | PR-AUC: 0.9201 ± 0.0238 |\n|                  | F1: 0.9961 ± 0.0084     | F1: 0.9447 ± 0.0213     | F1: 0.9264 ± 0.0217     | F1: 0.9431 ± 0.0131     |\n| GraphIDS (2-hop) | PR-AUC: 0.9980 ± 0.0018 | PR-AUC: 0.8385 ± 0.0528 | PR-AUC: 0.7883 ± 0.0321 | PR-AUC: 0.7539 ± 0.3555 |\n|                  | F1: 0.9935 ± 0.0142     | F1: 0.9370 ± 0.0194     | F1: 0.9147 ± 0.0076     | F1: 0.8371 ± 0.2071     |\n| GraphIDS (3-hop) | PR-AUC: 0.9992 ± 0.0008 | PR-AUC: 0.8969 ± 0.0325 | PR-AUC: 0.8238 ± 0.0521 | PR-AUC: 0.7482 ± 0.3526 |\n|                  | F1: 0.9999 ± 0.0001     | F1: 0.9606 ± 0.0083     | F1: 0.8005 ± 0.2486     | F1: 0.8495 ± 0.2133     |\n\nWe will include the full results and discussion in the appendix of the revised manuscript and we thank the reviewer for prompting this investigation.\n\nRegarding the masking ratio, the 15% value was chosen based on ablation experiments detailed in Appendix C.4 (in the supplementary material), where we evaluated ratios of 0%, 15%, 30%, 50%, and 70%. The 15% ratio consistently provided the best balance between performance and stability. To increase the visibility of this study we will clearly reference it in the main text.\n\n---\n\n**3. Thresholding and use of labeled validation data**\n\nWhile GraphIDS is trained in a fully unsupervised manner using only benign data, employing a small labeled validation set to select the detection threshold is a standard evaluation practice in unsupervised anomaly detection literature (e.g., Anomal-E, DeepLog), allowing for consistent and rigorous comparison across methods using metrics like F1-score that depend on threshold choice.\n\nWe acknowledge this in Section 4.3 (Early Stopping) and consider it reasonable to assume access to a limited set of labeled data (e.g., simulated or manually annotated attacks) solely for threshold calibration in practical settings.\n\nThat said, GraphIDS can be deployed in a fully unsupervised setting. Our released code includes a simple thresholding method based on statistical assumptions about reconstruction errors. However, this approach has not been extensively tuned and typically yields lower performance compared to threshold selection using labeled validation data. To assess threshold-independent performance, however, we report PR-AUC as evaluation metric. Developing more robust unsupervised thresholding techniques remains an important direction for future work.\n\n---\n\n**4. Resilience to evasion attempts**\n\nWe agree that resilience to adversarial evasion attacks is an important concern. While comprehensive adversarial evaluation is beyond this paper's scope, GraphIDS has inherent properties that provide some evasion resistance. Attackers would need to simultaneously mimic benign flow patterns at the individual connection level and replicate legitimate network topology relationships. This structural mimicry is significantly more challenging than evading single-feature detectors. That said, we plan to investigate GraphIDS's robustness against such attacks in future work.\n\n---\n**5. On Architectural Novelty and Practical Significance**\n\n\nWhile we build upon established components (GNNs, Transformers), our key contribution lies in the novel joint training paradigm specifically designed for network intrusion detection. Unlike GraphMAE (general node classification) or Anomal-E (which does not finetune E-GraphSAGE for the downstream task), we introduce the first unified architecture where GNN and Transformer components are jointly optimized under a shared reconstruction objective for network flow anomaly detection. Our performance improvements represent substantial practical value in network security, where accuracy gains directly translate to fewer missed attacks and reduced false alarms. This is, to our knowledge, the first demonstration that joint GNN-Transformer training significantly outperforms pipeline approaches in network intrusion detection.\n\n---\n\n**6. On limited topological context and encrypted traffic**\n\nAs acknowledged in Section 5, GraphIDS may be less effective in scenarios with limited topological context, such as single-host deployments. However, the UNSW-NB15 dataset represents a relatively small network with few hosts, yet GraphIDS still demonstrates strong performance, suggesting its robustness even in constrained settings. Regarding encrypted traffic, both datasets contain extensive encrypted flows (e.g., HTTPS, SSH). While payloads are inaccessible, NetFlow metadata (which is derived from packet headers) remains available and is unaffected by encryption. This allows GraphIDS to operate effectively on flow-level features, including in encrypted sessions.\n\n---\n\nWe believe these clarifications, along with the new ablation studies we've conducted, further strengthen our contribution to the field."}]

Author rebuttal:

Meta-review: This paper introduces GraphIDS, a self-supervised framework for network intrusion detection. Unlike prior approaches that decouple embedding and detection, GraphIDS employs a masked autoencoder to learn normal communication patterns by embedding each flow with its local graph context via an inductive GNN, and reconstructing these embeddings through a Transformer encoder–decoder to capture global co-occurrence structures.  The approach demonstrates strong empirical results on multiple NetFlow benchmarks, achieving up to 99.98% PR-AUC and 99.61% macro F1, significantly outperforming baselines. 
All the reviewers gave this paper a positive score. During the rebuttal, the authors adequately address the reviewers' concern.    
Overall, the work is well-motivated, technically sound, and presents a compelling end-to-end design that advances graph-based intrusion detection. I recommend acceptance.
Decision: Accept (poster)