{"id":"https://openalex.org/W7165042603","doi":"https://doi.org/10.48550/arxiv.2606.17109","title":"Timestamp-Aware Spatio-Temporal Graph Contrastive Learning for Network Intrusion Detection","display_name":"Timestamp-Aware Spatio-Temporal Graph Contrastive Learning for Network Intrusion Detection","publication_year":2026,"publication_date":"2026-06-15","ids":{"openalex":"https://openalex.org/W7165042603","doi":"https://doi.org/10.48550/arxiv.2606.17109"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2606.17109","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.17109","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2606.17109","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5138807386","display_name":"Jianli Dai","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Dai, Jianli","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5103025450","display_name":"Guangwei Wu","orcid":"https://orcid.org/0000-0002-0267-6747"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Wu, Guangwei","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5138788496","display_name":"Jiacheng Li","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Li, Jiacheng","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5138814060","display_name":"Weiping Wang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Wang, Weiping","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5138803877","display_name":"An He","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"He, An","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5138810343","display_name":"Xinjun Xiao","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Xiao, Xinjun","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11273","display_name":"Advanced Graph Neural Networks","score":0.35690000653266907,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11273","display_name":"Advanced Graph Neural Networks","score":0.35690000653266907,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.31850001215934753,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.058400001376867294,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/leverage","display_name":"Leverage (statistics)","score":0.5291000008583069},{"id":"https://openalex.org/keywords/feature-learning","display_name":"Feature learning","score":0.5288000106811523},{"id":"https://openalex.org/keywords/timestamp","display_name":"Timestamp","score":0.49410000443458557},{"id":"https://openalex.org/keywords/graph","display_name":"Graph","score":0.48980000615119934},{"id":"https://openalex.org/keywords/robustness","display_name":"Robustness (evolution)","score":0.45829999446868896},{"id":"https://openalex.org/keywords/inference","display_name":"Inference","score":0.4571000039577484},{"id":"https://openalex.org/keywords/generalization","display_name":"Generalization","score":0.44020000100135803},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.365200012922287},{"id":"https://openalex.org/keywords/supervised-learning","display_name":"Supervised learning","score":0.3483000099658966}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7785000205039978},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.5821999907493591},{"id":"https://openalex.org/C153083717","wikidata":"https://www.wikidata.org/wiki/Q6535263","display_name":"Leverage (statistics)","level":2,"score":0.5291000008583069},{"id":"https://openalex.org/C59404180","wikidata":"https://www.wikidata.org/wiki/Q17013334","display_name":"Feature learning","level":2,"score":0.5288000106811523},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.49549999833106995},{"id":"https://openalex.org/C113954288","wikidata":"https://www.wikidata.org/wiki/Q186885","display_name":"Timestamp","level":2,"score":0.49410000443458557},{"id":"https://openalex.org/C132525143","wikidata":"https://www.wikidata.org/wiki/Q141488","display_name":"Graph","level":2,"score":0.48980000615119934},{"id":"https://openalex.org/C63479239","wikidata":"https://www.wikidata.org/wiki/Q7353546","display_name":"Robustness (evolution)","level":3,"score":0.45829999446868896},{"id":"https://openalex.org/C2776214188","wikidata":"https://www.wikidata.org/wiki/Q408386","display_name":"Inference","level":2,"score":0.4571000039577484},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.444599986076355},{"id":"https://openalex.org/C177148314","wikidata":"https://www.wikidata.org/wiki/Q170084","display_name":"Generalization","level":2,"score":0.44020000100135803},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.365200012922287},{"id":"https://openalex.org/C136389625","wikidata":"https://www.wikidata.org/wiki/Q334384","display_name":"Supervised learning","level":3,"score":0.3483000099658966},{"id":"https://openalex.org/C183115368","wikidata":"https://www.wikidata.org/wiki/Q856577","display_name":"Weighting","level":2,"score":0.34779998660087585},{"id":"https://openalex.org/C2776401178","wikidata":"https://www.wikidata.org/wiki/Q12050496","display_name":"Feature (linguistics)","level":2,"score":0.3260999917984009},{"id":"https://openalex.org/C50644808","wikidata":"https://www.wikidata.org/wiki/Q192776","display_name":"Artificial neural network","level":2,"score":0.32030001282691956},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.3093999922275543},{"id":"https://openalex.org/C192209626","wikidata":"https://www.wikidata.org/wiki/Q190909","display_name":"Focus (optics)","level":2,"score":0.3093999922275543},{"id":"https://openalex.org/C2776502983","wikidata":"https://www.wikidata.org/wiki/Q690182","display_name":"Contrast (vision)","level":2,"score":0.3068999946117401},{"id":"https://openalex.org/C118505674","wikidata":"https://www.wikidata.org/wiki/Q42586063","display_name":"Encoder","level":2,"score":0.30559998750686646},{"id":"https://openalex.org/C2776359362","wikidata":"https://www.wikidata.org/wiki/Q2145286","display_name":"Representation (politics)","level":3,"score":0.3010999858379364},{"id":"https://openalex.org/C77618280","wikidata":"https://www.wikidata.org/wiki/Q1155772","display_name":"Scheme (mathematics)","level":2,"score":0.29120001196861267},{"id":"https://openalex.org/C67186912","wikidata":"https://www.wikidata.org/wiki/Q367664","display_name":"Data modeling","level":2,"score":0.2759999930858612},{"id":"https://openalex.org/C151406439","wikidata":"https://www.wikidata.org/wiki/Q186588","display_name":"Time series","level":2,"score":0.27250000834465027},{"id":"https://openalex.org/C108583219","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep learning","level":2,"score":0.2718999981880188},{"id":"https://openalex.org/C155846161","wikidata":"https://www.wikidata.org/wiki/Q1143367","display_name":"Graphical model","level":2,"score":0.258899986743927},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.25369998812675476}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2606.17109","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.17109","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2606.17109","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.17109","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Given":[0],"their":[1,48,57,125],"effectiveness":[2],"in":[3,20],"modeling":[4],"the":[5,34,82,87,92,179,184,199,227],"relational":[6,35],"structure":[7,36],"among":[8,91],"network":[9,21,120,145],"traffic":[10,38,121],"flows,":[11,39],"graph":[12,154],"neural":[13],"networks":[14],"(GNNs)":[15],"have":[16],"been":[17],"widely":[18],"adopted":[19],"intrusion":[22],"detection":[23],"systems":[24],"(NIDSs).":[25],"However,":[26],"most":[27],"existing":[28,219],"GNN-based":[29,79,95],"NIDS":[30,96,208],"approaches":[31,221],"focus":[32],"on":[33,59,205],"of":[37,84,116,144,183],"and":[40,127,132,141,164,177,181,222],"treat":[41],"them":[42],"as":[43],"temporally":[44],"independent,":[45],"which":[46,103],"limits":[47],"ability":[49],"to":[50,67,98,124,136,170,197,226],"cope":[51],"with":[52,210],"evolving":[53],"attack":[54],"behaviors.":[55],"Moreover,":[56],"reliance":[58],"supervised":[60,228],"or":[61],"semi-supervised":[62],"learning":[63,156],"often":[64],"restricts":[65],"generalization":[66,180],"unseen":[68],"attacks.":[69],"To":[70,81],"address":[71],"these":[72],"limitations,":[73],"we":[74],"propose":[75],"a":[76,114,190],"novel":[77],"self-supervised":[78,94,220],"framework.":[80],"best":[83],"our":[85,215],"knowledge,":[86],"proposed":[88],"model":[89],"is":[90,159,195],"first":[93,112],"models":[97],"explicitly":[99],"leverage":[100],"real":[101,211],"timestamps,":[102,126],"provides":[104],"faithful":[105],"temporal":[106,117,139,172],"dependencies":[107,143],"for":[108],"representation":[109],"learning.":[110],"We":[111],"construct":[113],"series":[115],"graphs":[118],"from":[119],"flows":[122],"according":[123],"then":[128],"employ":[129],"an":[130],"E-GraphSAGE":[131],"LSTM":[133],"based":[134],"encoder":[135],"fully":[137],"extract":[138],"information":[140],"spatial":[142],"traffic,":[146],"without":[147],"introducing":[148],"time-costly":[149],"attention":[150],"mechanisms.":[151],"A":[152],"multi-view":[153],"contrastive":[155,200],"(GCL)":[157],"scheme":[158],"introduced,":[160],"where":[161],"temporal,":[162],"spatial,":[163],"feature":[165],"contrasts":[166],"are":[167],"jointly":[168],"performed":[169],"capture":[171],"continuity,":[173],"preserve":[174],"structural":[175],"consistency,":[176],"improve":[178],"robustness":[182],"learned":[185],"representations,":[186],"respectively.":[187],"In":[188],"addition,":[189],"gradient-norm-based":[191],"adaptive":[192],"weighting":[193],"strategy":[194],"designed":[196],"optimize":[198],"loss":[201],"weights.":[202],"Experimental":[203],"results":[204],"four":[206],"representative":[207],"datasets":[209],"timestamps":[212],"demonstrate":[213],"that":[214],"method":[216],"significantly":[217],"outperforms":[218],"achieves":[223],"performance":[224],"comparable":[225],"state-of-the-art":[229],"GNN":[230],"method,":[231],"while":[232],"maintaining":[233],"high":[234],"computational":[235],"efficiency.":[236]},"counts_by_year":[],"updated_date":"2026-07-01T06:00:48.157686","created_date":"2026-06-18T00:00:00"}