  Graph Neural Networks (GNNs) have garnered intensive attention for Network
Intrusion Detection System (NIDS) due to their suitability for representing the
network traffic flows. However, most present GNN-based methods for NIDS are
supervised or semi-supervised. Network flows need to be manually annotated as
supervisory labels, a process that is time-consuming or even impossible, making
NIDS difficult to adapt to potentially complex attacks, especially in
large-scale real-world scenarios. The existing GNN-based self-supervised
methods focus on the binary classification of network flow as benign or not,
and thus fail to reveal the types of attack in practice. This paper studies the
application of GNNs to identify the specific types of network flows in an
unsupervised manner. We first design an encoder to obtain graph embedding, that
introduces the graph attention mechanism and considers the edge information as
the only essential factor. Then, a self-supervised method based on graph
contrastive learning is proposed. The method samples center nodes, and for each
center node, generates subgraph by it and its direct neighbor nodes, and
corresponding contrastive subgraph from the interpolated graph, and finally
constructs positive and negative samples from subgraphs. Furthermore, a
structured contrastive loss function based on edge features and graph local
topology is introduced. To the best of our knowledge, it is the first GNN-based
self-supervised method for the multiclass classification of network flows in
NIDS. Detailed experiments conducted on four real-world databases (NF-Bot-IoT,
NF-Bot-IoT-v2, NF-CSE-CIC-IDS2018, and NF-CSE-CIC-IDS2018-v2) systematically
compare our model with the state-of-the-art supervised and self-supervised
models, illustrating the considerable potential of our method. Our code is
accessible through https://github.com/renj-xu/NEGSC.
