# Always be Pre-Training: Representation Learning for Network Intrusion Detection with GNNs

arXiv: https://arxiv.org/abs/2402.18986 · HTML: https://mlsanity.com/paper/2402.18986/

## Key facts

- Cited by 2 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 29 Feb 2024.

## Built on by (most cited first, 2 of 2)

- [PPT-GNN: A Practical Pre-Trained Spatio-Temporal Graph Neural Network for Network Security](https://mlsanity.com/paper/2406.13365/) (2024)
- [Towards a graph-based foundation model for network traffic analysis](https://mlsanity.com/paper/2409.08111/) (2024)

## Abstract (arXiv)

Graph neural network-based network intrusion detection systems have recently demonstrated state-of-the-art performance on benchmark datasets. Nevertheless, these methods suffer from a reliance on target encoding for data pre-processing, limiting widespread adoption due to the associated need for annotated labels--a cost-prohibitive requirement. In this work, we propose a solution involving in-context pre-training and the utilization of dense representations for categorical features to jointly overcome the label-dependency limitation. Our approach exhibits remarkable data efficiency, achieving over 98% of the performance of the supervised state-of-the-art with less than 4% labeled data on the NF-UQ-NIDS-V2 dataset.