  This paper investigates Graph Neural Networks (GNNs) application for
self-supervised network intrusion and anomaly detection. GNNs are a deep
learning approach for graph-based data that incorporate graph structures into
learning to generalise graph representations and output embeddings. As network
flows are naturally graph-based, GNNs are a suitable fit for analysing and
learning network behaviour. The majority of current implementations of
GNN-based Network Intrusion Detection Systems (NIDSs) rely heavily on labelled
network traffic which can not only restrict the amount and structure of input
traffic, but also the NIDSs potential to adapt to unseen attacks. To overcome
these restrictions, we present Anomal-E, a GNN approach to intrusion and
anomaly detection that leverages edge features and graph topological structure
in a self-supervised process. This approach is, to the best our knowledge, the
first successful and practical approach to network intrusion detection that
utilises network flows in a self-supervised, edge leveraging GNN. Experimental
results on two modern benchmark NIDS datasets not only clearly display the
improvement of using Anomal-E embeddings rather than raw features, but also the
potential Anomal-E has for detection on wild network traffic.
