RF PGNN: Random Forest Proximity Graph Neural Network for Multi Class Intrusion Detection

Contemporary network intrusion detection systems (NIDS) need to be able to classify various types of attacks in the high-dimensional, highly skewed network traffic. In this paper, a hybrid RF-PGNN framework will be presented, which combines a Random Forest (RF) and a Graph Attention Network (GAT) to utilize both feature-level discriminative patterns and sample-level relational structure. Similarities of RF leaf-assignments are utilized to create a proximity graph that indicates non-linear decision boundaries that are learned implicitly by the forest. This graph is then trained on to spread relational signals between neighbouring samples to the GAT. The standalone RF has an accuracy of 98.86 and GAT has an accuracy of 78.34 on a balanced seven-class subset of the CIC-IDS2017 benchmark. The ensemble with weight (RF weight 0.9, GAT weight 0.1) has an accuracy of 98.94 and macro F1-score of 0.9894 and ROC-AUC of 0.9986. This low standalone accuracy of the GAT can be attributed to the limiting nature of graph-scale to the use of edges, over-smoothing effects on the multi-layer passage of messages, as well as to the limitation of proximity-based edges to the encoding of directed flow semantics of fine-grained attack sub-types; however, the complementary relational signal that it provides can provide a consistent ensemble boost. The McNemar test shows that the RF baseline gain is significant (p