Dual-Modality Network Intrusion Detection using a Heterogeneous Graph Neural Network and Large Language Model

View the PDF file for the paper entitled XG-NID: Discovery of double mesh off

PDF HTML (experimental) view

a summary:In the rapidly advanced cybersecurity security, the integration of information at the level of flow and the level of packages to detect infiltration in the actual time remains a largely underestimated field of research. This paper “XG-NID”, which is a new framework, is presented, as we know, is the first to merge the flow level data and at the package level within a heterogeneous graphic structure, which provides a comprehensive analysis of the network traffic. Take advantage of the heterogeneous nervous network (GNN) with the classification of the graph level, the XG-NID is uniquely enabled in actual time with the effective capacity of complex relationships between the beneficial load data for the flow. Unlike GNN traditional methodologies that often analyze historical data, XG-NID is designed to accommodate the heterogeneous nature of the network traffic, providing a strong defense mechanism and actual time. Our framework extends beyond just a classification; It merges the LLMS models to generate detailed, human readable interpretations and suggests possible therapeutic procedures, ensuring that the productive visions are implemented and understandable. In addition, we offer a new set of flow features based on time information, which increases the enhancement of contextual and interpretative inferences provided by our model. To facilitate the practical application and accessibility, we have developed “GNN4ID”, which is an open source tool that enables the extraction and conversion of the raw network traffic into the proposed heterogeneous graphic structure, and integrate flow data and the package level smoothly. Our comprehensive comparative analysis shows that XG-NID achieves a 97 % F1 degree in a multi-layer classification, outperforming current foundations and modern methods. This sets a new standard in network penetration detection systems by combining innovative data integration with enhanced interpretation and actual time.