Paper deep dive
Timestamp-Aware Spatio-Temporal Graph Contrastive Learning for Network Intrusion Detection
Jianli Dai, Guangwei Wu, Jiacheng Li, Weiping Wang, An He, Xinjun Xiao
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 97%
Last extracted: 6/20/2026, 8:01:27 AM
Summary
The paper proposes a novel self-supervised GNN-based framework for Network Intrusion Detection Systems (NIDS) that explicitly leverages real timestamps to model temporal dependencies. The framework, which uses an E-GraphSAGE and LSTM-based encoder, employs a multi-view graph contrastive learning (GCL) scheme consisting of temporal, spatial, and feature contrasts. This approach aims to capture temporal continuity and structural consistency without the high computational cost of attention mechanisms. Experimental results on four NIDS datasets show that the method outperforms existing self-supervised approaches and performs comparably to supervised state-of-the-art GNN methods while maintaining high efficiency.
Entities (8)
Relation Signals (5)
Timestamp-Aware Spatio-Temporal Graph Contrastive Learning โ addresses โ Network Intrusion Detection System (NIDS)
confidence 100% ยท propose a novel self-supervised GNN-based framework for network intrusion detection
Graph Contrastive Learning (GCL) โ includes โ Temporal Contrast
confidence 100% ยท where temporal, spatial, and feature contrasts are jointly performed
Timestamp-Aware Spatio-Temporal Graph Contrastive Learning โ incorporates โ Graph Contrastive Learning (GCL)
confidence 100% ยท A multi-view graph contrastive learning (GCL) scheme is introduced
Timestamp-Aware Spatio-Temporal Graph Contrastive Learning โ uses โ E-GraphSAGE
confidence 100% ยท employ an E-GraphSAGE and LSTM based encoder to fully extract temporal information
Timestamp-Aware Spatio-Temporal Graph Contrastive Learning โ uses โ LSTM
confidence 100% ยท employ an E-GraphSAGE and LSTM based encoder to fully extract temporal information
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Given their effectiveness in modeling the relational structure among network traffic flows, graph neural networks (GNNs) have been widely adopted in network intrusion detection systems (NIDSs). However, most existing GNN-based NIDS approaches focus on the relational structure of traffic flows, and treat them as temporally independent, which limits their ability to cope with evolving attack behaviors. Moreover, their reliance on supervised or semi-supervised learning often restricts generalization to unseen attacks. To address these limitations, we propose a novel self-supervised GNN-based framework. To the best of our knowledge, the proposed model is among the first self-supervised GNN-based NIDS models to explicitly leverage real timestamps, which provides faithful temporal dependencies for representation learning. We first construct a series of temporal graphs from network traffic flows according to their timestamps, and then employ an E-GraphSAGE and LSTM based encoder to fully extract temporal information and spatial dependencies of network traffic, without introducing time-costly attention mechanisms. A multi-view graph contrastive learning (GCL) scheme is introduced, where temporal, spatial, and feature contrasts are jointly performed to capture temporal continuity, preserve structural consistency, and improve the generalization and robustness of the learned representations, respectively. In addition, a gradient-norm-based adaptive weighting strategy is designed to optimize the contrastive loss weights. Experimental results on four representative NIDS datasets with real timestamps demonstrate that our method significantly outperforms existing self-supervised approaches and achieves performance comparable to the supervised state-of-the-art GNN method, while maintaining high computational efficiency.
Tags
Links
- Source: https://arxiv.org/abs/2606.17109v1
- Canonical: https://arxiv.org/abs/2606.17109v1
Trouble viewing inline? Open PDF directly โ
Full Text
82,308 characters extracted from source content.
Expand or collapse full text
Timestamp-Aware Spatio-Temporal Graph Contrastive Learning for Network Intrusion Detection โ JianliDai a,1 ,GuangweiWu a,โ ,JiachengLi a ,WeipingWang b ,AnHe a andXinjunXiao a a Central South University of Forestry and Technology, School of Computer Science and Mathematics, Changsha, 410004, Hunan, P.R. China b Central South University, School of Computer Science and Engineering, Changsha, 410083, Hunan, P.R. China ARTICLE INFO Keywords: Temporal graph Self-supervised learning Graph neural networks Network intrusion detection systems ABSTRACT Given their effectiveness in modeling the relational structure among network traffic flows, graph neural networks (GNNs) have been widely adopted in network intrusion detection systems (NIDSs). However, most existing GNN-basedNIDS approaches focus on the relational structure of traffic flows, and treat them as temporally independent, which limits their ability to cope with evolving attack behaviors. Moreover, their reliance on supervised or semi-supervised learning often restricts gen- eralization to unseen attacks. To address these limitations, we propose a novel self-supervised GNN- based framework. To the best of our knowledge, theproposedmodel is among the first self-supervised GNN-based NIDS models to explicitly leverage real timestamps, which provides faithful temporal dependencies for representation learning. We first construct a series of temporal graphs from network traffic flows according to their timestamps, and then employ an E-GraphSAGE and LSTM based encoder to fully extract temporal information and spatial dependencies of network traffic, without introducing time-costlyattentionmechanisms. A multi-view graph contrastivelearning (GCL)scheme is introduced, where temporal, spatial, and feature contrasts are jointly performed to capture temporal continuity, preserve structural consistency, and improve the generalization and robustness of the learned representations, respectively. In addition, a gradient-norm-based adaptive weighting strategy is designed to optimize the contrastive loss weights. Experimental results on four representative NIDS datasets with real timestamps demonstrate that our method significantly outperforms existing self-supervised approaches and achieves performance comparable to the supervised state-of-the-art GNN method, while maintaining high computational efficiency. These results further validate the effectiveness of explicitly modeling temporal dependencies in NIDSs. The code and resources of our experiments are available athttps://github.com/Rory6235/STG-NIDS. 1. Introduction Theexponentialdevelopmentof the InternetandInternet of Things (IoT) technologies has led to the widespread deployment of networks, which consist of heterogeneous devices (e.g., computers, sensors, and smart devices) and in- terconnected communication components, making them an essentialpartof modernsociety[1].Massivevolumesof net- work traffic flows are continuously generated by host-to-host communications in heterogeneous networks and evolve over time, exhibiting complex temporal and spatial dependencies [2]. Such complex and evolving characteristics expand the attack surface of networks, resulting in ubiquitous cyberat- tacks that threaten confidentiality, integrity, and availability [3]. In particular, sophisticated attacks such as denial-of- service (DoS), distributed denial-of-service (DDoS), and scanning attacks frequently exhibit temporal and spatial correlations among multiple hosts, which pose significant challenges to accurately identifying malicious activities. To address these challenges, numerous security technologies have been developed, among which network intrusion de- tection systems (NIDSs) play a crucial role in monitoring โ This work is supported by the National Key Research and Develop- ment Program of China under Grant 2023YFB3106900, the Key Scientific Research Projects of Hunan Provincial Education Department under Grant 25A0266 and 24A0197. โ Corresponding author guangweiwu@csuft.edu.cn (G. Wu) network traffic flows and identifying malicious activities in a timely and automated manner [4]. The prevailing solutions in NIDS are primarily driven by machine learning (ML) and deep learning (DL) [5]. Al- though traditional ML-based NIDS performs effectively on flat and handcrafted network traffic features, it struggles to capture the structural dependencies and interactions among network traffic flows [6]. In contrast, DL-based models are capable of learning non-linear, high dimensional, and sequential patterns from raw network traffic flows, thereby significantly enhancing the detection capability of complex and evolving attacks [7]. Network traffic flows in NIDS can be naturally modeled as a graph,where hostsare represented as nodes, and the network traffic flows exchanged between hosts are represented as edges. As a subfield of deep learn- ing, graph neural networks (GNNs) have been demonstrated great abilityin exploiting graph-structured data,enabling ef- fective modeling of dependencies and interactions between hosts[4].Nevertheless,representative GNN-based methods, including GraphSAGE andgraphattention networks (GATs) [8], primarily adopt the node-centric learning paradigm and directly rely on node features, thus ignoring edge features that characterize network traffic behavior. This node-centric design is inherentlylimited forNIDS, as mostdiscriminative information,suchasdurations,timestamps, and protocol,are carried by network traffic flows rather than by hosts. To ad- dress this limitation, several studies [9] have extended GNN models to jointly exploit node and edge features, allowing J. Dai et al.:Preprint submitted to Elsevier Page 1 of 16 Figure 1:Deployment overview of the proposed framework. The table on the center-right lists network traffic flows collected by storage database within a specific time interval, and the graph on the center-left depicts the spatial topology constructed from these flows. We mention that the spatial topology of the network is often inconsistent with its underlying physical connectivity. the models to more effectively characterize network traffic behaviors. By integrating node and edge features, these approaches can capture the intricate dependencies among hosts and flows, achieving excellent performance in network intrusion detection tasks. Most existing GNN-based models for NIDS are trained in a supervised or semi-supervised manner [9,10], which heavily depends on large-scale labeled data. Such meth- ods require labor-intensive manual annotation of network traffic flows, making the training process costly and time- consuming. Moreover, the complex and dynamically evolv- ing nature of network traffic flows often leads to pre- viously unseen attack patterns, which further limits the generalizability of supervised models [11]. To alleviate the dependence on expensive labeled data, self-supervised learning has emerged as a promising paradigm, enabling GNN models to learn informative representations from unlabeled graph-structured data [12]. Recent studies have introduced self-supervised learning and graph contrastive learning (GCL) into NIDS, learning discriminative repre- sentations of network traffic flows by contrasting different graph views without relying on labeled annotations [13,14, 15].Caville etal.[14] proposedAnomal-E,aself-supervised GNN-based NIDS that explicitly incorporates edge features and topology. Xu et al. [15] proposed NEGAT+NEGSC that adopts attention-based multi-perspectivecontrastto enhance both binary and multiclass classifications in NIDS. Given that real-world network environments evolve con- tinuously, network intrusion detection inherently involves both spatial and temporal characteristics. Malicious activ- ities often present distinct spatial structures such as bot- net communications, lateral movement patterns, abnormal connectivity while simultaneously exhibiting temporal pat- terns including DoS/DDoS bursts, progressive infiltration. However, most existing self-supervised GNN-based NIDS built on static graphs tend to overlook the inherent temporal dynamics of network traffic flows. Spatio-temporal GNNs provide an effective way to jointly model spatial depen- dencies and temporal representations from graph-structured data [16] and therefore have been increasingly adopted for NIDS [17,18,19]. Langendonck et al. [17] employed self- supervisedpre-training and sliding-window temporalgraphs to enable near real-time intrusion detection. Escriche et al. [18] proposed CCSTGN, a channel-centric spatio-temporal GNN that models communication channels as nodes with continuous temporal representations. Wu et. al [19] further proposed TCG-IDS to exploit temporal information through self-supervised contrastive with generated timestamps. To address the aforementioned limitations, we propose a novel spatio-temporal self-supervised GNN-based frame- work for network intrusion detection that first explicitly incorporates real timestamps to model the temporal evo- lution of network traffic flows. The overview architecture of the proposed framework is illustrated in Fig.1. Unlike existing GNN-based NIDS that rely on labeled data or ar- tificially generated timestamps, our framework adopts self- supervised learning to leverage spatio-temporal graphs to jointly capture spatial structures and temporal dynamics of network traffic flows. The main contributions of this paper are summarized as follows: โขWeproposeanovelself-supervisedGNN-basedframe- work for NIDS. To the best of our knowledge, the proposed framework is among the first to explicitly model the intrinsic temporal dependencies among network traffic flows using the dataset-provided real timestamps. By deeply integrating temporal and spa- tial information via a spatio-temporal encoder and a timestamp-aware contrastive objective, the proposed model fully captures latent spatio-temporal patterns while maintaining efficient inference without relying on attention mechanisms. โขWe design three self-supervised graph contrastive ob- jectives to capture latent spatio-temporal representa- tions and alleviate label dependence under evovling attack patterns. Temporal contrast aligns a nodeโs predicted representation with its corresponding repre- sentation atthenexttime intervaltomaintaintemporal smoothness. Spatial contrast increases the similar- ity between the representations of each node and its neighbors within the same temporal graph to preserve J. Dai et al.:Preprint submitted to ElsevierPage 2 of 16 local structural coherence. Feature contrast constructs augmented and perturbed samples of nodes based on spatio-temporal weights to improve the modelโs generalization and robustness. To coordinate these objectives, we further propose a gradient-norm-based adaptive weighting strategy to dynamically balance multiple contrastive losses. โขWe conduct extensive evaluations onfour widely used datasets with real timestamps from both theoretical and experimental perspectives. Theoretical time com- plexity analysis shows that replacing edge-dependent attention mechanisms with explicit temporal depen- dency modeling yields a more efficient computational scheme. Experimental results show that our model consistently outperforms related representative self- supervised models and state-of-the-art GNN-based supervised method on both binary and multiclassclas- sification tasks, while achieving higher computational efficiency. Moreover, the ablation studies illustrate the importance of temporal information in models for NIDSs. 2. Related Works The section reviews recent studies from three aspects: network intrusion detection system, graph self-supervised learning, and spatio-temporal graph neural networks. The review aims to clarify their strengths and limitations, and to establish the motivation for our proposed approach. 2.1. Network Intrusion Detection System Network intrusion detection system (NIDS) is a security mechanism designed to monitor and analyze network traffic flows in real time for detecting malicious activities. Recently, machine learning (ML) and deep learning (DL) techniques have been widely adopted in NIDS due to their strong capability in pattern recognition and data- driven modeling. ML-based NIDS typically exploys su- pervised learning methods to classify network traffic flows and identify malicious activities. Lee et al. [20] applied an extreme learning machine (ELM) with equation constrained optimization to NIDS and proposed an adaptive incremental learning method to determine the optimal number of hidden neurons. Compared with traditional ML-based approaches, DL-based NIDS exhibit significant advantages in model- ing complex, high-dimensional network traffic flows and enabling automated feature extraction, which is critical for behavior and anomaly analysis. Vinayakumar et al. [21] systematically investigated the application of convolutional neuralnetworks (CNNs),recurrentneural networks(RNNs), long- and short-term memory (LSTM) and gate recurrent units (GRUs) in NIDS. Experiment results demonstrate that CNN-based models and their variants consistently outper- form traditional ML-based methods in network attack detec- tion,amongwhichtheCNN-LSTMarchitectureachievesthe best performance. Furthermore, Haitao et al. [22] proposed a multimodal sequential NIDS by integrating deep autoen- coders with LSTM networks to jointly capture structural in- formation and temporal dependencies shared across similar network connections. Owing to their strong capability in capturing structural dependencies and interaction patterns among network hosts, graph neural networks (GNNs) have attracted increasing attention in NIDS. Consequently, GNN methods have been widely explored by researchers for NIDS applications. Lo et al. [9] proposed E-GraphSAGE, a GNN- based NIDS modelthat incorporatesedge featuresand graph topology to effectively model network traffic flows, enabling efficient detection of complex attacks in IoT networks and achieving superior detection performance compared to ex- isting models. However, most existing models for NIDS are based on supervised or semi-supervised learning paradigms and rely heavily on labeled data, which may limit the generalization in different network environments. 2.2. Graph Self-supervised Learning Self-supervised learning (SSL) has gained significant attention due to its ability to learn robust representations withoutrequiring labeleddata. Existing SSL methodscan be broadly categorized into generative-based and contrastive- based approaches. Generative SSL aims to reconstruct or model the underlying data distribution in a task-agnostic manner, enabling its applicability to various downstream tasks such as classification and generation [23]. In con- trast, contrastive SSL focuses on learning disciminative rep- resentations by maximizing the agreement between posi- tive pairs while distinguishing negative samples, and has demonstrated superior performance in many representation learning tasks. As a prominent contrastive SSL paradigm, graphcontrastivelearning(GCL)reducesthedependenceon labeled data by exploringthe inherentsimilaritiesand differ- ences among graph components, such as nodes, subgraphs and entire graphs. The origins of graph self-supervised learning can be traced back to early studies on unsupervised graph embed- ding methods [24,25], which learn node representations by maximizing the agreement between contextual nodes within truncated random walks [11]. Subsequently, graph autoen- coders (GAEs) [26], were proposed as a widely adopted unsupervised learning framework that reconstructs graph structures and can be viewed as an early form of graph self-supervised learning. Furthermore, deep graph infomax (DGI) [27] introduced a mutual information maximization objective between node-level and graph-level representa- tions as a self-supervised proxy task, marking an important milestoneinthe developmentof graphself-supervised learn- ing. Y. You et al.[28] introduced an effective self-supervised learning framework, GCA, which leverages graph augmen- tations to learn roboust representations. Generative Sub- graph Contrast (GSC) [29] introduced an adaptive subgraph generation strategy within a contrastive learning framework J. Dai et al.:Preprint submitted to ElsevierPage 3 of 16 to learn efficient and robust representations, where the opti- mal transmission distance is employed as a similarity mea- sure between subgraphs. In NIDS, Cavillea et al. [14] proposed Anomal-E, a self- supervised intrusion detection framework that exploits both edge features and graph structural information achieving great results in binary classification tasks. Xu et al. [15] proposed an improved self-supervised method, NEGSC, which contrasts subgraphs generated from a center node and its neighboring nodes, and demonstrates superior per- formance in both binary and multiclass intrusion detection. C. Wu et al. [19] designed TCG-IDS, a self-supervised IDS framework that leverages temporal contrastive graph neural network (GNN) and multiple contrasting strategies with time dependency, achieving strongperformance on NetFlow datasets. However, because the dataset used in TCG-IDS does not provide real timestamps for network flows, its temporal graphs are constructed from a generated timeline constructed from flow duration, rather than from dataset- provided real timestamps. Such a generated timeline may not faithfully reflect the real temporal order and evolution patterns of network traffic. In conclusion, mostexistingself-supervisedNIDSmeth- ods do not explicitly model temporal information and treat timestamps as regular features, making it fail to capture the temporal continuity of host behaviors and the evolution of attacks over time. The only method [19] that incorpo- rates temporal dependencies is designed based on gener- ated timestamps, which is constructed using the duration of network flows rather than the real timestamps. This clearly prevents the method from preserving the true ordering of network traffic flows, thereby limiting its adaptability to dynamic real-world scenarios. 2.3. Spatio-Temporal Graph Neural Networks Spatio-temporal graph neural networks (STGNNs) con- stitute a deep learning framework that integrates GNNs with time-series modeling techniques to capture both spatial dependencies and temporal dynamics in complex data. The core idea of STGNNs is to represent spatio-temporal data as graph-structured information, where nodes correspond to network hosts and edges as network traffic flows between network hosts, which are constructed according to the tem- poral evolution of network traffic flows. By jointly model- ing graph topology and temporal evolution, STGNNs learn expressive spatio-temporal representations through GNNs. In recent years, STGNNs have been extensively stud- ied across a wide range of Application domains, including network intrusion detection, anomaly detection, and traffic forcasting. Rossi et al. [30] introduced TGN, a general and efficient deep learning framework for dynamic graphs repre- sentedassequencesoftimeevents,which integratesmemory modulesand graph-basedoperators whilerequiring substan- tial memory during training. Chen et al. [31] proposed Dy- SubC, a self-supervised dynamic learning framework which contrasts temporal subgraphs by introducing a novel tempo- ral subgraph sampling method, enabling the model to jointly capture the structural and evolutionary features of dynamic graphs. H. Wang et al. [32] proposed an intelligent digi- tal twin framework for IoT attack detection, which selects informative feature subsets based on information gain and employs a simplified CNN model to capture the temporal patterns of attack behaviors. B. Yu et al. [33] formulated time series prediction as a graph problem and introduced a spatio-temporalgraphconvolutionalnetwork(STGCN) with fully convolutional structures, enabling efficient modeling and faster training. Duan et al. [34] developed a network anomaly detection framework based on continuous temporal graph (CTG) neural network, which refines the specific information interactions, thus naturally incorporating new node access behaviors into the feature extraction of CTG neural networks. These studies collectively highlight the importance of jointly modeling spatial dependencies and temporal infor- mation, enabling models to improve detection accuracy and robustness in diverse network environments. However, most existing models are either developed for general dynamic graph learning or tailored for some special time series pre- diction. As a result, theyare hard to applied directly to NIDS in evolving network environments, where the constructed graph in network has unique characteristics. Specifically, most of the information is often carried by edges, and the graphs tend to be dense and multigraph. 3. Methodology In this section, we first describe the data pre-processing and the feature selection engineering, and present the nota- tions of our approach in detail. Then, a spatio-temporal self- supervised GNN-based framework for network intrusion detection that first leverages real timestamps is introduced. which is shown in Fig.2. The overall framework consists of three main components: temporal graph construction, spatio-temporal GNN encoder, and graph contrastive learn- ing. Specifically, 1) Temporal graph construction aims to divide the net- work flows into multiple temporal graphs in the order of real timestamps. 2) Spatio-temporal GNN encoder captures spatial de- pendencies and temporal information and learn diverse high-dimension graph representation, which consists of E- GraphSAGEused for aggregatingedge features, fusion layer to combine the temporal and spatial information, and LSTM to capture the hidden states and cell memories. 3) Graph contrastive learning adopts three strategies to guide the model in learning latent embeddings by taking advantage oftemporal, spatial and feature similarities within each temporal graph. Finally, a detailed time complexity analysis is presented for our model and the compared models. 3.1. Data Pre-processing The preprocessing data is crucial to ensure data con- sistency and improve model performance. The steps in our J. Dai et al.:Preprint submitted to ElsevierPage 4 of 16 Network Attackers Malicious Traffics Traffic Type ยทNorm al traffics ยทDoS ยทDDoS ยทReconnaissance ยทPassword ยทBackdoor ยทRensom ware ยท... Network Traffic Record Time Traffic Data Collection Network Data CSV Temporal Graph Construction Data Preprocessing Data Cleaning Categorical Feature Encoding Data Normalization Graph Contrastive Learning Contrastive Methods Spatio-Temporal GNN Encoder Contrastive Loss Computation TemporalSpatial Feature Trained Weight Matrix W Normal Normal Attack Attack Attack Classification Task Trained Model ... ... SrcIPPortDstIPPortTime...Type 192.168.100.749960192.168.100.7801528089e+09...Normal 192.168.100.88192.168.100.5801.528765e+09...Attack ... 192.168.100.1 5 43001152.168.100.1544331.529381e+09...Attack Temporal Spatial Feature Total Loss ...... t=1 p redic t Positive Negative Anchor Po sitive N ega tive t~Ct'~C Adaptive Parameter Optimization Hyperparameters: a b g t=2t=4 ... t=Tt=1 ... Temporal Graphs Aggregate t=1 v 0 v 1 v 5 v 3 v 4 v 2 Update h 2 h 3 h 4 h 1 h 5 x 0 x h t=1 v 0 v 1 v 5 v 3 v 4 v 2 Output h 2 h 3 h 4 h 1 h 5 h 0 Feature t=1 v 0 v 1 v 5 v 3 v 4 v 2 e 02 e 34 e 14 e 0 5 e 03 e 01 Embedding t=2t=T t=2t=4 ... t=Tt=1 ... Cell memory LSTM x 2 x 3 x 4 x 5 x 1 x 0 Output z t z Representation Figure 2:The overview of the NIDS framework. The upper layer presents the information of network traffic flows. The middle layer illustrates temporal graph construction, and shows how spatio-temporal GNN encodes node and edge features by modeling temporal dependencies. The lower layer introduces how graph contrastive learning guides the model to learn representations and detect malicious network traffic flows. study are as follows: data cleaning, categorical feature cod- ing and data normalization. Initially, raw network traffic data, including features like source/destination IP addresses, ports, packet size and flow information, are structured into a tabular format, where missing or erroneous values, such as NaN or undefined symbols (e.g., โ-โ) are removed. Sub- sequently, categorical features are encoded to numerical values using LabelEncoder, which assigns a unique integer to each category. For a categorical feature with unique val- ues, LabelEncoder would map each category to an integer. Ultimately, the numerical valuesof featuresare standardized by StandardScaler, which transforms the data to have a mean of 0 and a standard deviation of 1. This process can ensure that each feature contributes equally to the model learning process. It is worth noting that in our method, time-relevant features, such as timestamps, are selected as separate columns for subsequent use. 3.2. Feature Selection Engineering To evaluate the discriminative ability of each feature with respect to the target variable, we train a random forest (RF) model and extract the feature-importance scores from the model. The scores measure the contribution of each feature in the process of constructing the decision tree. We then sort these features into non-increasing order by their importance scores and retain only the top-ranked features for our model training. This helps accelerate the training process. The top-15 feature importance scores of ToN-IoT dataset are presented in Fig.3. 3.3. Graph Construction Given a dataset, we first sort all network traffic flows in non-decreasing order of their timestamps, and then divide them intoํdaily intervals. For each intervalํกโ 1,...,ํ, we construct a temporal graph๎ณ ํก = (๎ ํก ,๎ฑ ํก )using the flows occurring within the intervalํก. Here,๎ ํก is the node set, where each nodeํฃ ํ โ๎ ํก corresponds to a unique network host identified by its IP address. Note that two different graphs,๎ ํก and๎ ํก โฒ , may share some nodes.๎ฑ ํก is the edge set, where each edgeํ ํก ํํํ โ๎ฑ ํก representstheํ-th networktraffic flow between the nodesํฃ ํ andํฃ ํ during the time intervalํก. For1โคํกโคํ, we define the feature of each nodeํฃ ํ โ๎ ํก as the vectorํฑ ํก ํ , and the feature of each edgeํ ํก ํํํ โ๎ฑ ํก as the vectorํ ํก ํํํ . Furthermore, given two temporal graphs๎ณ ํก and๎ณ ํก+ํก 1 , we call them adjacent ifํก 1 = 1, i.e.,๎ณ ํก+ํก 1 is in the next time interval. In contrast, we call them distant ifํก 1 is sufficiently large.In our experiments,ํก 1 is set to 4 for distant graphs. 3.4. Spatio-Temporal GNN Encoder After graph construction for the dataset, we obtain a se- quence oftemporal graphs ๎ณ ํก ํ ํก=1 . We nowproposea novel spatio-temporal GNN encoder to learn the representationํณ ํก ํ of each nodeํฃ ํ โ๎ ํก of every graph๎ณ ํก , for1โคํกโคํ. The main idea of the proposed encoder is that: the representation of each node of temporal graph๎ณ ํก is ob- tained using the standard LSTM framework on the node and edge features of๎ณ ํก and the representations of nodes J. Dai et al.:Preprint submitted to ElsevierPage 5 of 16 Figure 3:The Top-15 feature importance of ToN-IoT Dataset. in the previous temporal graph๎ณ ํกโ1 . The design enables the model to capture the temporal dependencies of network flows across consecutive timestamp-ordered graphs. For the temporal graph๎ณ 1 , the hidden stateํก 0 ํ and cell memoryํ 0 ํ for each nodeํฃ ํ are initialized to zero due to the absence of historical information. For a subsequent temporal graph ๎ณ ํก ,2โคํกโคํ, we assume that the node representations for all previous graphs๎ณ ํก โฒ withํก โฒ < ํกhave already been obtained. The node representations for๎ณ ํก are computed in the following steps. For every nodeํฃ ํ โ๎, the encoder first concatenates the initial node featuresํฑ ํก ํ with the previous embeddingํก ํกโ1 ํ , and then maps the concatenated vector to thesame dimension space as the node embeddingํก ํก ํ through a learnable weight matrixํfollowed by a nonlinear acti- vation functionํ. That is: ํก ํก ํ =ํ(ํโ [ํฑ ํก ํ ,ํก ํกโ1 ํ ])(1) , whereํก ํก ํ will be used as the input of E-GraphSAGE. This design enables the model to simultaneously consider the inherent features and historical state information of nodes, providing a richer input representation for subsequent graph encoding operations. Subsequently, in E-GraphSAGE withํ-layer aggrega- tion, the initial node embeddingํก ํก,0 ํ of each nodeํฃ ํ โ๎ is set toํก ํก ํ . Forํ >0, the node embeddingํก ํก,ํ ํ of each node ํฃ ํ in time intervalํกcan be obtained as Equation (2): ํก ํก,ํ ํ =ํ(ํ ํ โ CONCAT(ํก ํก,ํโ1 ํ ,ํก ํก,ํ ํ(ํ) )).(2) Here,ํ ํ is the weight matrix,ํis the activation function, andํก ํก,ํ ํ(ํ) is the aggregated representation of neighbors ofํฃ ํ . It is computed as shown in Equation (3): ํก ํก,ํ ํ(ํ) =AGG ํ (ํก ํก,ํโ1 ํ ,ํ ํก,ํโ1 ํํํ )(3) , where AGG ํ is the aggregation operation of each layerํ, , which is set to mean aggregation in our implementation. Here,ํก ํก,ํโ1 ํ is the node embeddingsํก ํก ํ in layerํโ 1and ํ ํก,ํโ1 ํํํ is the edge featuresํ ํก ํํํ of theํ-th edge between nodes Predict t'=1 pos-sim loss Intersections t=2t=4 ... t=T t=1 ... Temporal Graphs (t'=1, t=2) neg-sim Contrast (t'=1, t=4) Figure 4:The temporal contrastive learning process between nodes across different temporal graphs. ํฃ ํ andํฃ ํ in layerํโ 1within time intervalํก. The final node embeddingํก ํก ํ for each nodeํฃ ํ , i.e., the output of E- GraphSAGE module, can be obtained through a softmax layer. Finally, LSTM regulates information flow via gating mechanism, which helps alleviate the vanishing gradient problem in recurrent sequence modeling and enable the learning of long-range temporal dependencies. With the input of E-GraphSAGE module, the node embeddingsํก ํก ํ and cell memoryํ ํก ํ of LSTM module can be expressed as Equation (4). (ํก ํก ํ ,ํ ํก ํ ) =LSTM(ํก ํก ํ ,(ํก ํกโ1 ํ ,ํ ํกโ1 ํ ))(4) , whereํ ํกโ1 ํ is the cell memory of each nodeํฃ ํ in time intervalํกโ 1. After encoding, we can obtain the final node representationํณ ํก ํ =ํก ํก ํ of each nodeํฃ ํ in time intervalํก through a softmax layer. 3.5. Graph Contrastive Learning The selection of positive and negative samples in graph contrastive learning is paramount for the classification task. Motivated by the importance of temporal information, spa- tial dependencies and features of nodes, three kinds of con- trastive strategies are designed in our method. Through self-supervised contrastive learning strategies, the learning of node representations is constrained from these multiple views, thereby capturing temporal smoothness, spatial con- sistency, and feature robustness. 3.5.1. Temporal Contrastive Learning In networks, host communications often persist across consecutive time intervals, while network workloads and attack behaviors may evolve over longer time intervals [35, 36]. Thus, node states in our constructed temporal graphs tend to evolve smoothly between adjacent graphs but differ substantially across distant graphs. Motivated by this, the temporal contrastive learning loss aims to model the evolu- tion of node representations in the temporal dimension. The whole process is presented in Fig.4. By distinguishing the similarity of the same node within adjacent time intervals fromthatindistanttimeintervals,themodelisencouragedto learn temporal smoothness. Positive samples are defined as (ํฃ ํก ํ ,ํฃ ํก+1 ํ )from two adjacent graphs, while negative samples are(ํฃ ํก ํ ,ํฃ ํก+4 ํ )fromtwodistantgraphs.Toexplicitlymodelthe J. Dai et al.:Preprint submitted to ElsevierPage 6 of 16 node evolution, we introduce a temporal predictor to learn the state transition from time intervalํกtoํก+ 1, and use the predicted representation to match the representation at intervalํก+ 1. Specifically, givenํณ ํก ํ for nodeํฃ ํ in๎ณ ํก , the predictor outputs ฬ ํณ ํก ํ via: ฬ ํณ ํก ํ =ํ(ํ ํ โ ํณ ํก ํ )(5) , whereํis ReLU andํ ํ is a learnable weight matrix. Meanwhile, network topologies evolve over time as nodes may appear or disappear, so the node sets of temporal graphs from different time intervals are not fully aligned. In temporal graph contrastive learning, directly contrasting all node representations may introduce noise and unnecessary overhead, since nodes without semantic correspondence cannotformeffective positive or negative constraints. There- fore, we select the intersections๎ผ=๎ ํก โฉ๎ ํก+1 , and๎ฝ= ๎ ํก โฉ๎ ํก+4 ,andusetherepresentationsofthesecorresponding nodes to calculate the contrastive loss, which maintains semantic consistency and improves efficiency. To model temporal consistency and discriminability of node representations, we design a joint objective consisting of a temporal alignment loss and a temporal interval con- straint. Specifically, we encourage smooth and continuous evolution by minimizing an alignment loss between the predictedrepresentation ฬ ํณ ํก ํ and the representationํณ ํก+1 ํ of the corresponding node at the next time intervalํก+ 1, which is defined as Equation (6): ๎ธ align = 1 |๎ผ| ํโ๎ผ (2 โ 2 ฬ ํณ ํก ํ โ ํณ ํก+1 ํ ).(6) To avoid representation collapse across different tem- poral graphs, we further introduce an interval separation constraint on the same nodes that are temporally distant. By enforcing an upper bound on their similarity, we maintain sufficient discriminability by Equation (7): ๎ธ uniform = 1 |๎ฝ| ํโ๎ฝ max(0, ฬ ํณ ํก ํ โ ํณ ํก+4 ํ โํฆ)(7) , whereํฆis a similarity upper bound. The final temporal loss๎ธ tem is: ๎ธ tem =๎ธ align +ํโ ๎ธ uniform (8) , whereํis a penalty weight that balances the alignment and separation terms. 3.5.2. Spatial Contrastive Learning In networks, hosts that directly and frequently commu- nicate often exist in the same subnet or service chain, and thusexhibit similar interactionpatterns[9,37].Accordingly, thespatialcontrastivelearninglossleveragesgraphtopology by constructing contrastive pairs within the local neighbor- hood: connected node pairs are treated as positive samples, while randomly sampled unconnected node pairs serve as negative samples. By pulling neighbors closer and pushing non-neighbors apart, the model learns node representations thatcapture spatial dependencies and local structural consis- tency. Specifically, we take(ํณ ํก ํ ,ํณ ํก ํ )as a positive sample pair if thereexistsanedgeํ ํก ํํํ โ๎ฑ ํก betweenํฃ ํ andํฃ ํ .Fornegative sampling, we use the adjacency matrix to ensure that each negative node is not directly connected to the anchor nodes ํฃ ํ , avoiding sampling observed neighbors as negatives. For each positive sample pair, we sampleํnegative nodes to increase the difficulty and improve the informativeness of spatial contrastive learning. The spatial contrastive loss is defined as: ๎ธ spa = โ 1 |๎ฑ ํก | (ํฃ ํ ,ํฃ ํ )โ๎ฑ ํก log exp((ํณ ํก ํ ) โค ํณ ํก ํ โํ) ํท ํํ (9) , where ํท ํํ = exp((ํณ ํก ํ ) โค ํณ ํก ํ โํ) + ํ ํ =1 exp((ํณ ํก ํ ) โค ํณ ํก ํ,ํ โํ). Here,ํis the temperature coefficient andํณ ํก ํ,ํ denotes the representation of theํ -th negative node sampled forํฃ ํ . 3.5.3. Feature Contrastive Learning In practice, network flows may be collected incom- pletely, which can introduce noise and missing values into edge features, thereby affecting the stability of the learned representations [38]. A common strategy in contrastive learning is to create semantically consistent yet perturbed views via feature augmentation, so that the encoder learns representations that generalize better. Following this idea, we design an adaptive feature corruption strategy inspired by GCA, which injects stronger perturbations into less informative node representations while preserving semantic information. Specifically, given node representationsํณ ํก ํ , we obtain a node-wise corruption score from global structural statistics. Let ฬ ํค ํ denote log-degree-based score averaged over time, where low-degree nodes yield larger ฬ ํค ํ and thus receive stronger corruption. In negative perturbation, we normalize ฬ ํค ํ by min-max scaling: ฬ ํค ํ = ํค ํ โํค ํํํ ํค ํํํฅ โํค ํํํ .(10) The corruption strength is then determined as: ํฟ ํ =clip(ํฟ 0 ฬ ํค ํ ,ํฟ ํํํ ,ํฟ ํํํฅ )(11) , where clip(ํฟ 0 ฬ ํค ํ ,ํฟ ํํํ ,ํฟ ํํํฅ ) = min(max(ํฟ 0 ฬ ํค ํ ,ํฟ ํํํ ),ํฟ ํํํฅ ) withํฟ 0 = 0.2,ํฟ ํํํ = 0.01andํฟ ํํํฅ = 0.3. We generate the augmented view by interpolating the node representations with Gaussian noise: ฬ ํณ + ํ = (1 โํฟ ํ )ํณ ํก ํ +ํฟ ํ ํ + ํ ,ํ + ํ ๎บ(0,ํ 2 + ํ)(12) , whereํ + = 0.1. This design applies stronger perturbations to nodes with larger corruption scores. In negative perturbation, we impose stronger noise per- turbations on high-degree nodes: ฬ ํณ โ ํ = (1 โํ ํ )ํณ ํก ํ +ํ ํ ํ โ ํ ,ํ โ ํ ๎บ(0,ํ 2 โ ํ)(13) J. Dai et al.:Preprint submitted to ElsevierPage 7 of 16 t=1 t=2 t=T Positive Negative t~C ...... t'~C ...... ...... t=1 C o n t r a s t Co nt ra s t Positive Negative Anchor loss pos-sim neg-sim Figure 5:The feature contrastive learning process between nodes in the positive and negative graphs. , whereํ โ = 0.3andํ ํ =clip(ํ 0 โ ํค ํํํฅ โํค ํ ํค ํํํฅ โํค ํํํ ,ํ ํํํ ,ํ ํํํฅ ), withํ 0 = 0.5andํ ํํํ = 0.05, andํ ํํํฅ = 0.5. The augmented positive and negative samples are uti- lizedto compute thefeature contrastive lossthrough normal- ized cosine similarity and cross-entropy: ๎ธ fea = โ 1 ํ ํ ํ=1 logํด ํ (14) , where ํด ํ = exp((ํณ ํก ํ , ฬ ํณ + ํ )โํ) exp((ํณ ํก ํ , ฬ ํณ + ํ )โํ) + exp(sim(ํณ ํก ํ , ฬ ํณ โ ํ )โํ) . Here,ํis the temperature coefficient. The process of feature contrastive loss can be seen in Fig.5. This enables the learned representation to be robust to feature missing and noise, which can enhance the distinguisability of different node representations. 3.5.4. Adaptive Parameter Optimization In multi-view self-supervised learning framework, dif- ferent loss usually impose distinct semantic constraints and exhibit significantly different optimization scales. Using fixedweightstocombine multiple self-supervisedobjectives often leads to gradient domination, where one loss over- whelms the parameter updates andsuppresses other learning signals. Thus, we adopt a gradient-norm based adaptive loss weighting strategy. Specifically,ฮ ํ denotes the shared parameter set used for learning unified representations, and๎ธ tem ,๎ธ spa and๎ธ fea denote the three different losses, respectively. At each training iteration, the gradient of each loss with respect toฮ ํ is computed and itsํ 2 norm is used to measure the optimization strength of the corresponding self-supervised signal. For a loss๎ธ, the gradient norm is defined as: ํ= โ โ โ โ ฮ ํ ๎ธ โ โ โ 2 = โ ํโฮ ํ โ โ โ โ ํ๎ธ ํํ โ โ โ โ 2 2 .(15) Consequently,ํ tem ,ํ spa , andํ fea denote the gradient norms of๎ธ tem ,๎ธ spa , and๎ธ fea , respectively. Accordingly, the bal- ancing coefficientsํผ,ํฝ,ํพare computed dynamically based Algorithm 1 Input:A graph set๎ณ= ๎ณ 1 ,๎ณ 2 ,...,๎ณ ํ and epochsํธ. For1โคํกโคํ,๎ณ ํก = (๎ ํก ,๎ฑ ํก )is a temporal graph. Output:Trained parametersํฉ. 1:forํก= 1toํdo 2: Obtainํง ํก for each graph๎ณ ํก by Eqs. (2) and (4). 3:end for 4:forํก= 1toํdo 5: Compute predicted node representations by Eq.(5). 6: Select intersection๎ผof๎ณ ํก and๎ณ ํก+1 . 7: Select intersection๎ฝof๎ณ ํก and๎ณ ํก+4 . 8: Compute similarities of(ํฃ ํก ํ ,ํฃ ํก+1 ํ )in๎ผby Eq.(6). 9: Compute similarities of(ํฃ ํก ํ ,ํฃ ํก+4 ํ )in๎ฝby Eq.(7). 10: Compute temporal contrastive loss๎ธ tem by Eq. (8). 11:for allnodesํฃ ํ โ๎ ํก do 12:Select neighbors as positiveํง ํก ํ and non-neighbors as negative ํง ํก ํ,ํ . 13:Compute spatial contrastive loss๎ธ spa by Eq. (9). 14:end for 15:for allnodesํฃ ํ โ๎ ํก do 16:Obtain positiveฬํง + ํ and negativeฬํง โ ํ . 17:Compute feature contrastive loss๎ธ fea by Eq. (14). 18:end for 19: Adaptive parameter optimization to obtainํผ,ํฝ,ํพby Eq. (15). 20:๎ธ=ํผ๎ธ tem +ํฝ๎ธ spa +ํพ๎ธ fea . 21: Update model parametersํฉ. 22:end for onํ tem ,ํ spa , andํ fea : (ํผ,ํฝ,ํพ) = ํ ํกํํ ,ํ ํ ํํ ,ํ ํํํ ํ ํกํํ +ํ ํ ํํ +ํ ํํํ (16) The overall training objective is formulated as: ๎ธ total =ํผ๎ธ tem +ํฝ๎ธ spa +ํพ๎ธ fea .(17) This gradient-norm based weighting mechanism plays a crucial role in self-supervised learning. It explicitly reflects the optimization scale of each contrastive objective on the shared representation space, preventing any single loss from dominating the training process. The whole training process is shown in Algorithm1. 3.6. Classification Task The proposed method aims to differentiate between nor- mal and malicious behaviors and identify the specific attack classes in a self-supervised way, which can be seen as classification tasks. All datasets divided into training and testing data are the inputs of the encoders to obtain final embeddings, respectively, for further classification tasks. Widely used for the binary and multiclass classifications in NIDS, two functions, e.g., binary cross-entropy (BCE) function and the cross-entropy (CE) function, are utilized in our method to implement the classification experiments, respectively. The detailed parameters are demonstrated in Table1. 3.7. The Time Complexity Analysis The running time of our model is determined by its two modules: the spatio-temporal encoder and graph contrastive learning. J. Dai et al.:Preprint submitted to ElsevierPage 8 of 16 Table 1 Hyperparameter HyperparameterValues Number of temporal graphํ10 Learning rate (lr)1e-3 Weight decay3e-5 Activation functionํReLU OptimizerAdam Similarity upper boundํฆ0.1 Penalty weightํ0.05 Number of negative edgeํ5 Temperature coefficientํ0.5 First,weconsiderthetimecomplexityofspatio-temporal encoder. In the aggregation process of E-GraphSAGE, each node needs to consider its adjacent edges along with their nodes,andthuseachedgeiscountedtwice.Sinceํtemporal graphsareconstructedandtheedgesetsofdifferenttemporal graphs are disjoint, the total number of edges across all temporal graphs isํ, e.g., โ ํ ํก=1 |๎ฑ ํก |=ํ. Hence, the aggregation process takesํ(2ํ)time. In the embedding process of LSTM, each node passes through four gates, and each gate involves a matrix multiplication whose running time depends on the input dimensionํof node feature. That is, the embedding process costsํ(4ํํ)time, whereํis the number of node in the graph. Consequently, the time complexity of the spatio-temporal encoder isํ(2ํ) +ํโ ํ(4ํํ) =ํ(2ํ+ 4ํํํ), whereํis the number of the constructed temporal graphs. Then, in graph contrastive learning, we design three contrastive schemes. In the temporal contrastive learning, we first compute the predicted node representations via a linear layer inํ(ํํ). We then find the node intersections amongthe predicted graph,the adjacenttemporalgraph, and the distant temporal graph inํ(3ํ). For each node in the intersections, we finally compute two similarities between positive samples and negative samples using the dot produc- tion inํ(2ํํ). Hence, the total time complexityof temporal contrastive learning isํ(ํํ+ 3ํ+ 2ํํ) =ํ(3ํ+ 3ํํ). In the spatial contrastive learning, for each node in the current temporalgraph,wecomputethe meandot-productsimilarity to its neighbor nodes (positive sample) and to itsํ(ํis a constant) randomly selected non-neighbor nodes (negative sample), respectively. The similarity computation consumes timeํ(ํํ+ํํ).In feature contrastive learning,wegenerate an augmented (positive) and an perturbed (negative) repre- sentation for each node via two clip-based transformations, whose temporal weights are precomputed during temporal graph construction. Therefore, the clip transformation costs ํ(2ํ). We then compute the dot-product similarity between two representationsforeach nodeinํ(ํํ).Overall,thetime complexity of feature contrastive learning isํ(2ํ+ํํ). Since every temporal graph requires computing all these three contrastive losses, the overall cost of graph contrastive learning isํโ (ํ(3ํํ+ 3ํ) +ํ(ํํ+ํํ) +ํ(2ํ+ํํ)) = Table 2 Comparison of our method and other GNN-based methods on time complexity. MethodTime complexity Oursํ(2ํ+ 9ํํํ+ 5ํํ+ํํํ) NEGAT + NEGSCํ(18ํ+ 2ํ) TCG-IDSํ(16ํ+ํํ+ 5ํํํ+ํํ ฬ ํํ) ํ(5ํํํ+ 5ํํ+ํํํ). Therefore, the time complexity of the proposed model isํ(2ํ+ 9ํํํ+ 5ํํ+ํํํ). NEGAT + NEGSC has a time complexity ofํ(4ํพํผํ+ 2ํผํ+ 2ํ), whereํ(4ํพํผํ+ 2ํผํ)is by the computation of attention coefficients and aggregation of NEGAT, andํผ is the numbers of attention heads andํพis the number of layers,andํ(2ํ)isbytheedgeconstructionstepofNEGSC. With headsํผ= 3 and layerํพ= 1, the time complexity is ํ(18ํ+2ํ). TCG-IDS has atime complexity ofํ(2ํพํผํ+ ํํ+ํํํ+ํํ ฬ ํํ+ 4ํํํ), whereํ(4ํพํผํ+ํํ)is by the temporal encoder which utilizes attention mechanism, andํ(ํํํ),ํ(ํํ ฬ ํ),ํ(4ํํํ)are by three contrasting strategies, and ฬ ํis the dimension of predicted embeddings. With headsํผ= 8 and layerํพ= 1,, the time complexity of TCG-IDS isํ(16ํ+ํํ+ 5ํํํ+ํํ ฬ ํํ). In the constructed temporal graphs of NIDS, nodes rep- resent hosts, and edges represent communications between them. In networks, the number of edges is typically much larger than that of the nodes, as hosts may communicate with each other frequently. Thus, the temporal graphs are often dense, leading toํ โซ ํ, i.e.,ํmay grow onํ(ํ 2 ) or even faster. Consequently, the overall time complexity is dominated by terms involvingํ, while the node-wise terms (e.g.,ํ(ํ)orํ(ํํ)) are comparatively minor. In this setting,our methodrunsinํ(2ํ),whichachievesthelowest time complexity among the related representative methods. This advantage arises from explicitly modeling temporal dependencies, which avoids the edge-dependent computa- tional overhead introduced by attention mechanismsin other methods. The details are listed in Table2. 4. Experiments In this section, we first present the experimental setup, datasets and metrics. The performance of the proposed model is then reported for binary and multiclass classifi- cations. Moreover, comparisons with existing methods are conducted to evaluate the effectiveness of our approach. Finally, ablation studies are provided to demonstrate the importance of temporal information. 4.1. Setup Ourmodel isimplemented ona singleNVIDIA GeForce RTX 4090 with 24GB of GPU memory using Python, PyTorch [39] and PyTorch Geometric [40]. We split the datasets using a 7:3 ratio for training and testing. After preprocessing the raw data, 70% of the data for training is processed and fed into the model, which enables the model J. Dai et al.:Preprint submitted to ElsevierPage 9 of 16 Table 3 Datasets Statistics. Dataset Normal Flows Attack Flows Classes Flow Features Time Attribute BoT-IoT477 3,668,045 546stime ToN-IoT788,599 21,190,031 1045ts UNSW-NB152,218,764 321,283 1049stime NF-UNSW-NB15-v3 2,237,731 127,693 1049 FLOW START MILLISECONDS to learn effective information through iteratively optimizing and tuning. The remaining 30% of the data for testing is utilized for evaluating the performance and efficiency of the model. 4.2. Datasets In our study, three public and widely used datasets are chosen to implement the experiments, which are BoT- IoT [41], ToN-IoT [42], and UNSW-NB15 [43]. Recently, netflow datasets that incorporate the temporal features are emerged to address the gap in standardised feature sets, e.g., NF-BoT-IoT-v3, NF-ToN-IoT-v3, NF-UNSW-NB15- v3 [44], etc. For evaluating the efficiency of our method in the netFlow datasets, we select NF-UNSW-NB15-v3 as a distinctive example. The time-relevant features (e.g., times- tamp, durations) in the raw data are crucial for capturing the dynamic nature of network traffic in the real-world sce- narios. BoT-IoT, ToN-IoT, UNSW-NB15 and NF-UNSW- NB15-v3 are all the datasets used for intrusion detection. The details of four datasets are demonstrated on the Table 3, which includes the labels, explicit attack types and its corresponding amounts of each type contained in the raw data. The four datasets are all fit for binary classification, which is to distinguish whether the traffic is anomalous, and multiclass classification, which is to identify the certain type of the attacks. The BoT-IoT dataset is created by designing a realistic network environment in the Cyber Range Lab of UNSW Canberra, which incorporated a combination of normal and botnet traffic. It consists of 46 basic features especially start time and late time of each traffic, and the amount of network traffics are 3,668,522, out of which 447 are normal, and 3,668,045 are attacks which predominantly includes 4 specific attack types, e.g., DDoS, DoS, and Reconnaissance, and another attack theft which is a small percentage at all samples. Attack category and subcategory attributes are introduced in the dataset, which could be used to train and test the model in both binary and multiclass classifications. The ToN-IoT dataset is collected from a realistic and large-scale network designed at the Cyber Range and IoT Labs, which can be utilized for evaluating the fidelity and efficiency of different cybersecurity applications such as intrusion detection systems based on artificial intelligence. It contains 45 basic features including timestamp (ts), and the amount of network traffic are 21,978,630, out of which 788,599 are normal, and 21,190,031 are attacks, the specific types of which are Scanning, DDoS, DoS, Xss, Password, Backdoor, Injection, Ransomware and Mitm. The UNSW-NB15 is a dataset developed at UNSW Can- berra, which is designed based on a synthetic environment for generating attack activities. It is made up of 49 basic features especially timestamp of each traffic,and the amount ofnetwork traffics are 2,540,047, out of which 2,218,764 are normal, and 321,283 are attacks which includes 9 uneven specific attack types, e.g., Generic, Exploits, Fuzzers, DoS, Reconnaissance,Analysis, Backdoor,ShellcodeandWorms. The purpose of the produced dataset is to be utilized for the generation and validation of intrusion detection. The NF-UNSW-NB15-v3 dataset is the third iteration of NetFlow-based datasets converted from the UNSW-NB15 [43], which added time-related features like FLOW START MILLISECONDS, FLOW START MILLISECONDS, and SRC TO DST IAT MIN, etc. The inclusion of timestamp information allows for identifying the exact time of the traffic whne the original traffic was captured [44], which poses a new challenge to devle into temporal analysis of datasets in NIDS. Specifically, it contains 2,365,424 flows in total, out of which 2,365,424 are benign, and 127,693 are malicious flows, which has the same specific attack types as the UNSW-NB15. Deeper insights of dynamic patterns and temporal features of network behavior can be explored in the netflow dataset due to the added temporal features. 4.3. Evaluation Metrics To evaluate the performance of our model in binary and multiclass classifications, five metrics widely used in other recent studies are selected, which areํดํํขํํํํฆ,ํํํํํํ ํํํ, ํน1โํํํํํ,andํ ํํํํ.Thecalculation ofalltheevaluation metrics is based on four factors, namely, TruePositive (ํํ), a case where the model correctly predicts the positive class, False Positive (ํนํ), a case where the model incorrectly predicts the positive class, True Negative (ํํ), a case where the model correctly predicts the negative class, and False Negative (ํนํ), a case where the model incorrectly predicts the negative class. ํดํํขํํํํฆis the rate at which the model correctly pre- dicts in all samples. ํดํํขํํํํฆ= ํํ+ํํ ํํ+ํนํ+ํํ+ํนํ (18) ํํํํํํ ํํํmeasures the proportion of the samples pre- dicted by the model to be attacks are actual attacks. ํํํํํํ ํํํ= ํํ ํํ+ํนํ (19) ํ ํํํํrepresents the ratio of positive samples correctly predicted by the model to all samples that are actual positive samples. ํ ํํํํ= ํํ ํํ+ํนํ (20) ํน1 โํํํํํis the harmonic mean of Precision and Recall, which is used to balance the two metrics. ํน1โํํํํํ= 2 ร ํํํํํํ ํํํรํ ํํํํ ํํํํํํ ํํํ+ํ ํํํํ (21) J. Dai et al.:Preprint submitted to ElsevierPage 10 of 16 Figure 6:The results of binary classifications on four datasets. 4.4. Experiment Results The experiment results on four datasets (e.g., BoT- IoT, ToN-IoN, UNSW-NB15, and NF-UNSW-NB15-v3) for both binary and multiclass classifications are illustrated in four separately subsection. To evaluate the efficiency and performance of our proposed method, we compare the method with existing graph-based methods, which are widely applied in NIDS. Furthermore, the ablation experi- ments are implemented to study the importance of spatial dependencies, temporal information and semantic features, following the corresponding results. 4.4.1. Binary Classification The BoT-IoT, ToN-IoT, UNSW-NB15 and NF-UNSW- NB15-v3 datasets contain numerous flow data, which is more challenging for the proposed method to evaluate the detection abilitybetweennormalandmaliciousflows.Asthe same operation in [9], we use full datasets BoT-IoT, UNSW- NB15 and NF-UNSW-NB15-v3, and randomly sample 10% IoN-IoTdataset duetoitslargesize.Theoverallperformance of binary classifications on four datasets are illustrated in Figure.6. Specifically,ontheBoT-IoTdataset,ourmethodachieves 99.99% accuracy, 0.99 precision, 99.99% recall, and 0.99 F1-score. Similarly, on the ToN-IoT dataset, the model obtains 98.57% accuracy, 0.98 precision, 99.26% recall, and 0.99 F1-score. Such high performance on two IoT-related datasets can be attributed to the ability of the proposed framework to jointly model spatial dependencies among hosts and temporal information of traffic flows, enabling effective detection of attacks. Furthermore, on the UNSW-NB15 dataset, our method achieves 99.05% accuracy, 0.95 precision, 96.31% recall, and 0,97 F1-score. On the NF-UNSW-NB15-v3 dataset, the method further reaches 99.95% accuracy and 0.99 F1-score, confirming that explicitly exploiting temporal information helps capture evolving attack behaviors. Table 4 Multiclass classification statistics and results of specific classes in BoT-IoT. Classes StatisticsMetrics Samples Percentages Recall F1-Score Normal4770.00%80.42% 0.86 DoS1,620,260 44.16% 99.89% 0.99 DDoS1,926,624 52.51% 99.98% 0.99 Reconnaissance91,0822.48%99.90% 0.99 Theft790.00%0.00%0.00 Weighted Average--99.93%0.99 Figure 7:The confusion matrix of BoT-IoT in multiclass classification. The results on four datasets indicate that integrating spatial dependencies and temporal information is crucial for reliable detection across heterogeneous network scenarios. 4.4.2. Multiclass Classification After delving into the performance of our method on binary classifications, the performance of multiclass clas- sifications evaluated on four datasets (e.g.,BoT-IoT, ToN- IoT,UNSW-NB15 and NF-UNSW-NB15-v3) arealso worth discussing. Specifically, on the BoT-IoT dataset, the performance evaluated on four classes are superior which has a F1-Score of 0.86, 0.99, 0.99, and 0.99 on Normal, DoS, DDoS, and Reconnaissance, respectively, and has a weighted average recall of 99.93%. The perfect performance on DoS and DDoS indicates that the model successfully captures burst temporal patterns,whichare key featuresof flooding attacks. The only underperformance was in an attack Theft due to its fewsamplesinthe dataset, only accounting for almost 0.00% in all samples. The statistics and detailed results of specific classes in BoT-IoT are illustrated in Table4and Fig.7. J. Dai et al.:Preprint submitted to ElsevierPage 11 of 16 Table 5 Multiclass classification statistics and results of specific classes in ToN-IoT. Classes StatisticsMetrics Samples Percentages Recall F1-Score Normal78,9063.72%62.82% 0.73 DoS338,037 15.95% 96.81% 0.78 DDoS616,683 29.10% 92.30% 0.95 Backdoor50,8732.40%0.00%0.00 Injection45,1502.13%28.86% 0.44 Password135,7666.17%82.68% 0.74 Ransomware80,0223.64%63.33% 0.67 Scanning714,561 32.51% 85.62% 0.89 Xss210,5669.58%87.63% 0.83 Mitm1,1560.05%0.01%0.02 Weighted Average--84.52%0.83 Figure 8:The confusion matrix of ToN-IoT in multiclass classification. On the ToN-IoT dataset, the result of our method is comparativelygeneraldueto theitscomplexandunweighted classes, especially for DoS, DDoS, Scanning and Mitm attacks. Still, the performance evaluated in most classes are terrific, which has a F1-Score of 0.95, 0.89 and 0.83 in DDoS, Scanning and Xss, and a weighted average recall of 84.52%, which demonstrate the effectiveness in identifying diverse attacks in the complex network scenarios. From the confusionmatrix8, these attackstypically involve host com- municationsand temporalbehavior, whichcanbe effectively captured through the proposed contrastive learning method. The statistics and detailed results of specific classes in ToN- IoT are illustrated in Table5and Fig.8. For UNSW-NB15 and its netflow version 3 NF-UNSW- NB15-v3 datasets with the same and unweighted classes, there is a high percentage of benign flows, accounting for 87.35% and 94.60%, highly susceptible to inaccuarate results. The performance of our model on UNSW-NB15 Table 6 Multiclass classification statistics and results of specific classes in UNSW-NB15. Classes StatisticsMetrics Samples Percentages Samples Percentages Normal2,218,764 87.35%100%1.00 Analysis2,6770.10%0.00%0.00 Backdoor2,3290.09%0.00%0.00 DoS16,3530.64%0.45%0.00 Exploits44,5251.75%90.89%0.69 Fuzzers24,2460.95%76.20%0.76 Generic215,4818.48%97.42%0.98 Reconnaissance13,9870.55%66.99%0.68 Shellcode1,5110.05%0.00%0.00 Worms1740.00%0.00%0.00 Weighted Average--98.31%0.98 Table 7 Multiclass classification statistics and results of specific classes in NF-UNSW-NB15-v3. Classes StatisticsMetrics Samples Percentages Recall F1-Score Benign2,237,731 94.60% 99.99% 0.99 Analysis1,2260.05%0.00%0.00 Backdoor4,6590.19%0.00%0.00 DoS5,9800.25%0.56%0.01 Exploits42,7481.80%65.92% 0.65 Fuzzers33,8161.42%82.62% 0.62 Generic19,6510.83%67.09% 0.72 Reconnaissance17,0740.72%39.57% 0.47 Shellcode2,3810.10%0.00%0.00 Worms1580.00%0.00%0.00 Weighted Average--97.81%0.97 and NF-UNSW-NB15-v3 have a weighted average recall of 98.31% and 97.81%, and F1-Score of 0.98 and 0.97, respectively The performance indicates that the model effec- tively leverages temporal evolution to differentiate benign fluctuations from malicious behaviors, while exploiting spatial dependencies to discriminate among diverse attack types. The statistics and detailed results of specific classes in UNSW-NB15 and NF-UNSW-NB15-v3 are illustrated in Table6and7, respectively. 4.4.3. Compared with Existing Graph-based Methods In order to intuitively understand the effectiveness of our model, we present a more comprehensive compari- son with the existing graph-based methods, which includes supervised and self-supervised GNN-based models. This approach enables us to evaluate the performance of the proposed method utilizing self-supervised learning and spa- tial dependencies and temporal information. The strengths and improvement can be highlighted through comparing our model with existing state-of-the-art graph-based mod- els, providing more efficient solutions to network intrusion detection. Descriptions of the existing graph-based methods are as follows. E-GraphSAGE [9]: As the first application of GNN in NIDS, E-GraphSAGE is widely used for network intrusion detection task while obtaining the superior performance. It innovatively transforms network traffic data into a graph structure and utilizes the GNN model GraphSAGE and edge features in the network to learn a complex relationship J. Dai et al.:Preprint submitted to ElsevierPage 12 of 16 Table 8 Comparison in binary classification results. ModelsDatasets Metrics Accuracy Precision Recall F1-Score E-GraphSAGE [9] BoT-IoT 99.99%1.0099.99%1.00 NEGAT+NEGSC [15]99.99%0.99 99.99% 0.99 TCG-IDS [19]99.45%1.00 99.45% 0.99 Ours99.99%0.9999.99% 0.99 E-GraphSAGE ToN-IoT 97.87%1.0097.87%1.00 NEGAT+NEGSC96.76%0.96 99.81% 0.98 TCG-IDS97.54%0.95 97.54% 0.95 Ours98.57%0.9899.26% 0.99 E-GraphSAGE UNSW-NB15 98.76%0.9199.99% 0.95 NEGAT+NEGSC96.97%0.91 84.17% 0.87 TCG-IDS97.83%0.90 97.83% 0.95 Ours99.05%0.9596.31%0.97 E-GraphSAGE NF-UNSW-NB15-v3 99.98%0.9999.98% 0.99 NEGAT+NEGSC98.61%0.98 75.74% 0.85 TCG-IDS98.87%0.98 98.87% 0.96 Ours99.95%0.9999.54%0.99 between different hosts, which lay a solid foundation for the application of GNN in network intrusion detection. NEGAT+NEGSC [15]: NEGAT+NEGSC is the first method that applied self-supervised learning and GNN in NIDS on both binary and multiclass classifications, getting the great results while reducing the reliance of labeled data. It improves the graph attention mechanism using edge features, named NEGAT, and proposes a self-supervised learning method based on graph contrastive learning, which considers the relationship between local and global topol- ogy of network, evaluating the potential of self-supervised learning in network intrusion detection. TCG-IDS [19]: To further explore the advantages of the raw time in datasets, we compare it with TCG-IDS which utilized self-supervised learning and the generated time to implement the experiments. TCG-IDS proposes three con- trastive learning strategies (e.g., temporal, asymmetric and masking) to capture the temporal dependencies, consider the different interactions within network data, and improve the ability to learn the representation, respectively, achieving superior performance in two different netflow datasets with- out timestamps (e.g., NF-CSE-CIC-IDS2018-v2 and NF- UNSW-NB15-v2). The results of our method on binary classification in- dicates the outstanding performance on BoT-IoT, ToN- IoT, UNSW-NB15 and NF-UNSW-NB15-v3 datasets. On BoT-IoT, the proposed method has a accuracy of 99.99%, precision of 0.99, recall of 99.99% and F1-Score of 0.99, which achieves the superior performance of E-GraphSAGE and NEGAT+NEGSC and is slightly higher than TCG- IDS. On ToN-IoT, our method achieved a accuracy of 98.57%, precision of 0.98, recall of 99.26% and F1-Score of 0.99, outperforming E-GraphSAGE in accuracy and recall, and NEGAT+NEGSC and TCG-IDS in most metrics. The results of our method on UNSW-NB15 are accuracy of 99.05%, precision of 0.95, recall of 96.31% and F1-Score of 0.97, which are higher than two self-supervised learning methods and on a pair with the supervised E-GraphSAGE. Moreover, our method has a competitive performance in the netflow dataset NF-UNSW-NB15-v3, achieving a accuracy of 99.95%, precision of 0.99, recall of 99.54% and F1-Score of 0.99, which outperforms NEGAT+NEGSC and TCG- IDS in all metrics, and is slightly lower than E-GraphSAGE. The detailed results are illustrated as Table.8 Thecomparisonswithself-supervisedGNN-basedmeth- odsofbinaryclassificationson fourdatasetscandemonstrate that the spatial information and temporal dependencies in original data with timestamps play a paramount role in identify whether a network flow is benign. Meanwhile, our method achieves or even outperforms the performance supervised GNN-based model E-GraphSAGE and outper- forms two self-supervised models NEGSC+NEGAT and TCG-IDS on most datasets, which can indicate the model using real timestamps can has a competitive performance without the labeled data. On multiclass classification, our method achieved the superior performance, as shown in Table.9. Results on BoT-IoT achieve a recall of 99.93% and F1-Score of 0.99, which outperform the performance of the NEGAT+NEGSC and TCG-IDS, 68.66% and 94.63% in Recall and 0.68 and 0.97 in F1-Score, respectively, and is slightly lower than E- GraphSAGE, demonstrating the advantage and influence of spatial information and temporal dependencies in identify- ing the specific attack types with the self-supervised learn- ing. Results on ToN-IoT achieve a recall of 84.52% and F1- Scoreof0.83inRecall,whichoutperformsNEGAT+NEGSC, TCG-IDS and E-GraphSAGE in both metrics. The reason why the performance is in the range of over 80% in ToN- IoT dataset we conclude is that it contains diverse attack types and there is an extreme imbalance among different types. Results on UNSW-NB15 have a recall of 98.31%, and F1-Score of 0.98, respectively, which have a superior performance over other three methods. Results on NF- UNSW-NB15-v3 achieve a recall of 97.81%, and F1-Score of 0.97, respectively, which outperform the performance of both self-supervised GNN-based methods in Recall and F1-Score, and are very close to the supervised method E- GraphSAGE. The results compared with self-supervised GNN-based methods of multiclass classifications on four datasets can showthatourproposedmethodcanhaveagreatperformance under an environment of diverse attacks. The results of comparing with NEGAT+NEGSC which is a static self- supervised method can indicate the advantage of spatial dependencies and temporal information in the dynamically evolving network. Also, the real timestamp of network can play an essential role in detecting normal and different mali- cious flows through comparing with TCG-IDS. Meanwhile, our method has a comparable performance with the super- vised method E-GraphSAGE in total, which demonstrates the effectiveness of self-supervised learning for identifying attacks and reducing the reliance of labeled data. 4.5. Ablation Study To concretize the strenghth of three modules of our method,ablationexperimentsareimplementedontwodatasets (e.g., ToN-IoT and NF-UNSW-NB15-v3) through removing each module. The modules contains temporal contrastive J. Dai et al.:Preprint submitted to ElsevierPage 13 of 16 Table 9 Comparison in multiclass classification results. ModelsDatasets Metrics Recall F1-Score E-GraphSAGE [9] BoT-IoT 99.99%1.00 NEGAT+NEGSC [15]68.66% 0.68 TCG-IDS [19]94.63% 0.97 Ours99.93% 0.99 E-GraphSAGE ToN-IoT 82.78% 0.82 NEGAT+NEGSC69.53% 0.62 TCG-IDS79.53% 0.79 Ours84.52%0.83 E-GraphSAGE UNSW-NB15 95.86% 0.96 NEGAT+NEGSC96.04% 0.95 TCG-IDS [19]95.76% 0.89 Ours98.31%0.98 E-GraphSAGE NF-UNSW-NB15-v3 97.36% 0.97 NEGAT+NEGSC95.82% 0.94 TCG-IDS95.77% 0.95 Ours97.81%0.97 Table 10 Ablation results in binary classification of ToN-IoT. MethodDataset Metrics Accuracy Precision Recall F1-Score w/o Temporal ToN-IoT 97.07%0.97 98.50% 0.99 w/o Spatial97.53%0.97 98.73% 0.99 w/o Feature97.67%0.97 98.80% 0.99 Proposed98.66%0.9899.31%0.99 learning, spatial contrastive learning,and feature contrastive learning. The binary results on ToN-IoT and NF-UNSW-NB15 are illustrated in Table10and Table11, respectively. After removing temporal contrastive module, we can clearly see that there is a great drop for all metrics, which has an accuracy, precision, recall and F1-score of 97.07%, 0.97, 98.50% and 0.99, respectively. The method of removed spatial contrastive module shows the performance increases slightly than temporal, with accuracy, precision, recall and F1-score of 97.53%, 0.97, 98.73% and 0.99, respectively. The method of dropped feature contrastive module has an accuracy, precision, recall and F1-score of 97.67%, 0.97, 98.80% and 0.99, respectively. The method with three mod- ules shows a superior performance, with an accuracy, preci- sion, recall and F1-score of 98.66%, 0.98, 99.31% and 0.99, which outperforms other three methods. It has a similar tendency in binary experiments of NF- UNSW-NB15-v3. There is a great drop for all metrics after removing temporal contrastive module, which has an accu- racy, precision, recall and F1-score of 98.61%, 0.99, 85.36% and 0.74, respectively. The experiment of removed spatial contrastive module shows the performance has a slight in- crease than temporal, with accuracy, precision, recall and F1-score of 99.10%, 0.99, 90.97% and 0.83, respectively. After dropping feature contrastive module, the method has an accuracy, precision, recall and F1-score of 99.17%, 0.99, 91.80% and 0.85, respectively. The full method shows a superior performance, with an accuracy, precision, recall and F1-score of 99.95%, 0.99, 99.54% and 0.99, which outperforms other methods with removed module. Table 11 Ablation results in binary classification of NF-UNSW-NB15-v3. MethodDataset Metrics Accuracy Precision Recall F1-Score w/o Temporal NF-UNSW-NB15-v3 98.61%0.99 85.36% 0.74 w/o Spatial99.10%0.99 90.97% 0.83 w/o Feature99.17%0.99 91.80% 0.85 Proposed99.95%0.9999.54%0.99 Table 12 Ablation results in multiclass classification of ToN-IoT. MethodsDataset Metrics Recall F1-Score w/o Temporal ToN-IoT 82.01% 0.80 w/o Spatial82.81% 0.81 w/o Feature82.97% 0.81 Proposed84.52%0.83 Table 13 Ablation results in multiclass classification of NF-UNSW- NB15-v3. MethodsDataset Metrics Recall F1-Score w/o Temporal NF-UNSW-NB15-v3 96.29% 0.95 w/o Spatial96.74% 0.96 w/o Feature97.31% 0.96 Propoesd97.81%0.97 The ablation results of the ToN-IoT dataset on multi- classification tasks are presented in Table12. When the temporal module is removed, the model achieves a Recall of 82.01% and an F1-Score of 0.80. In contrast, removing the spatial module increases Recall to 82.81% and F1-Score to 0.81, slightly outperforming the w/o Temporal results on both metrics. Without the feature module, the model achieved a Recall of 82.97% and an F1-Score of 0.81. Its Recall metric was slightly higher than the previous two pruning settings, while its F1-Score remained consistent with w/o Spatial. For the Proposed method incorporating all modules, themodel achievedRecallandF1-Score of84.52% and 0.83, respectively. Table13reports the ablation results on the NF-UNSW- NB15-v3 dataset under the multiclass classification setting. When the temporal module is removed, the model achieves a Recall of 96.29% and an F1-Score of 0.95. Removing the spatial module results in a higher Recall of 96.74% and an F1-Score of 0.96, exceeding the performance of the w/o Temporal configuration on both metrics. In the absence of the feature module, the Recall further increases to 97.31%, while the F1-Score remains at 0.96, which is comparable to the w/o Spatial setting. With all modules included, the ProposedmethodattainsthehighestRecall(97.81%)andF1- Score (0.97) among all configurations. Across both binary and multiclass classification tasks on the ToN-IoT and NF- UNSW-NB15-v3datasets, consistenttrendscan beobserved fromthe ablationresults.Removing the temporal contrastive module leads to the most pronounced performance degrada- tion in terms of Recall and F1-Score, indicating its dominant J. Dai et al.:Preprint submitted to ElsevierPage 14 of 16 Table 14 Testing Time on Four Datasets. ModelsDatasetsTesting Time (s) NEGAT+NEGSC [15] BoT-IoT 0.060 TCG-IDS [19]0.054 Ours0.032 NEGAT+NEGSC ToN-IoT 0.115 TCG-IDS0.063 Ours0.032 NEGAT+NEGSC UNSW-NB15 0.550 TCG-IDS0.376 Ours0.077 NEGAT+NEGSC NF-UNSW-NB15-v3 0.045 TCG-IDS0.047 Ours0.043 contribution among the three components. The exclusion of the spatial module also results in noticeable performance drops, although its impact is generally less severe than that of the temporal module. By comparison, removing the feature modulecausesrelatively smaller performance degra- dation, suggesting a complementary role in representation enhancement. The results show that the temporal contrast module plays an importance role in improving the modelโs performance. Meanwhile, the best performance is consis- tentlyachieved when all three modules are jointly employed, highlighting the necessity of their collaborative integration. 4.6. Speed Testing Experiments To verify the detection speed of using the simple and effective bidirectional LSTM plus E-GraphSAGE as the spatio-temporalencoder,weconductedtestsonfourdatasets. From the table14, the proposed model demonstrates robust stability in both testing efficiency across four different datasets. On the BoT-IoT and ToN-IoT datasets, the model achieves a consistent testing time of 0.032 seconds, indi- cating sustained high inference efficiency even under large- scale IoT traffic scenarios. On the UNSW-NB15 dataset, the testing time slightly increased to 0.077 s, primarily due to the datasetโs feature dimensionality and complex traffic pat- terns. On the NF-UNSW-NB15-v3 dataset, the testing time decreasedbackto 0.043 s,furtherdemonstrating the modelโs strong adaptability across varying data distributions.79 The model deliversfasttesting speedswhile maintaining robust detection performance. These results are consistent with our theoretical analysis of time complexity, futher validating its feasibility and practical value for real-time intrusion detection in IoT environments. 5. Conclusion Thispaperproposesaself-supervisedGNN-basedframe- work for network intrusion detection systems. To the best of our knowledge, it is the first to take advantage of real times- tamps to effectively identify the types of network flows in a self-supervised manner. By integrating timestamp-aware spatio-temporal graph contrastive learning with an efficient E-GraphSAGE and LSTM based encoder, the proposed methodcapturestemporaldependenciesandspatialrelations in network traffic without introducing computationally ex- pensive attention mechanisms. Moreover, theoretical time complexity analysis shows that explicitlymodeling temporal dependencies, rather than relying on attention mechanisms, leads to a lower computational cost. Extensive experiments on four datasets with dataset- provided timestamps, BoT-IoT, ToN-IoT, UNSW-NB15 and NF-UNSW-NB15-v3, demonstrate the high computational efficiency and good generalization of the proposed method. In particular, attacks with temporally repetitive and struc- turally consistent interaction patterns (e.g., DoS and DDoS) are classified with notably higher accuracy, further high- lighting the effectiveness of leveraging real timestamps by the proposed timestamp-aware spatio-temporal contrastive learning framework. In addition, the experimental results and ablation studies consistently confirm the importance of dataset-provided timestamps for intrusion detection. In the future, we will further refine our modeling of time-dependent behaviors through more fine-grained tem- poral analysis, to achieve improved robustness of intrusion detection systems in dynamic real-world scenarios. Declaration of competing interest The authors declare that they have no known competing financial interests or personal relationships that could have appeared to influence the work reported in this paper. References [1] N.Chaabouni,M.Mosbah,A.Zemmari,C.Sauvignac,P.Faruki,Net- work intrusion detection for iot security based onlearning techniques, IEEECommunicationsSurveys &Tutorials21(3)(2019)2671โ2701. [2] J. Fu, L. Wang, J. Ke, K. Yang, R. Yu, Tsids: Spatialtemporal fusion gating multilayer perceptron for network intrusion detection, Expert Systems with Applications 263 (2025) 125687. [3] Z. Chen, H. Zou, T. Hu, X. Yuan, X. Fang, Y. Pan, J. Li, Hc-nids: Historical contextual information based network intrusion detection system in internet of things, Computers & Security 152 (2025) 104367. [4] M. Zhong, M. Lin, C. Zhang, Z. Xu, A survey on graph neural networks for intrusion detection systems: Methods, trends and chal- lenges, Computers & Security 141 (2024) 103821. [5] A. Thakkar, R. Lohiya, A review on machine learning and deep learning perspectives of ids for iot: Recent updates, security issues, and challenges., Archives of computational methods in engineering 28 (4) (2021). [6] A. L. Buczak, E. Guven, A survey of data mining and machine learning methods for cyber security intrusion detection, IEEE Com- munications surveys & tutorials 18 (2) (2015) 1153โ1176. [7] N. Shone, T. N. Ngoc, V. D. Phai, Q. Shi, A deep learning approach to network intrusion detection, IEEE Transactions on Emerging Topics in Computational Intelligence 2 (1) (2018) 41โ50. [8] P. Veliฤkoviฤ, G. Cucurull, A. Casanova, A. Romero, P. Lio, Y. Ben- gio, Graph attention networks, arXiv preprint arXiv:1710.10903 (2017). [9] W. W. Lo, S. Layeghy, M. Sarhan, M. Gallagher, M. Portmann, E- graphsage: A graph neural network based intrusion detection system for iot, arXiv preprint arXiv:2103.16329 (2021). [10] G. Duan, H. Lv, H. Wang, G. Feng, Application of a dynamic line graph neural network for intrusion detection with semisupervised J. Dai et al.:Preprint submitted to ElsevierPage 15 of 16 learning, IEEE Transactions on Information Forensics and Security 18 (2022) 699โ714. [11] Y. Liu, M. Jin, S. Pan, C. Zhou, Y. Zheng, F. Xia, P. S. Yu, Graph self-supervised learning: A survey, IEEE Transactions on Knowledge and Data Engineering 35 (6) (2022) 5879โ5900. [12] W. Ju, Y. Wang, Y. Qin, Z. Mao, Z. Xiao, J. Luo, J. Yang, Y. Gu, D. Wang, Q. Long, et al., Towards graph contrastive learning: A survey and beyond, arXiv preprint arXiv:2405.11868 (2024). [13] Q. Liu, H. Zhang, Y. Zhang, L.Fan, X. Jin, Ssa-gat: Graph-based self- supervised learning for network intrusion detection, in: International Conference on Artificial Neural Networks, Springer, 2024, p. 476โ 491. [14] E. Caville, W. W. Lo, S. Layeghy, M. Portmann, Anomal-e: A self- supervised network intrusion detection system based on graph neural networks, Knowledge-Based Systems 258 (2022) 110030. [15] R. Xu, G. Wu, W. Wang, X. Gao, A. He, Z. Zhang, Applying self- supervised learning to network intrusion detection for network flows with graph neural network, Computer Networks 248 (2024) 110495. [16] Z. A. Sahili, M. Awad, Spatio-temporal graph neural networks: A survey, arXiv preprint arXiv:2301.10569 (2023). [17] L. Van Langendonck, Ppt-gnn: a practical pre-trained temporal graph neural network for intrusion detection, Masterโs thesis, Universitat Politรจcnica de Catalunya (2024). [18] E. S. Escriche, J. Nyberg, Y. Kim, G. Dรกn, Channel-centric spatio- temporal graph networks for network-based intrusion detection, in: 2024 IEEE Conference on Communications and Network Security (CNS), IEEE, 2024, p. 1โ9. [19] C. Wu, J. Sun, J. Chen, M. Alazab, Y. Liu, Y. Xiang,ํณํขํฆ-ํจํฃํฒ: Robust network intrusion detection via temporal contrastive graph learning, IEEE Transactions on Information Forensics and Security 20 (2025) 1475โ1486. [20] C.-H. Lee, Y.-Y. Su, Y.-C. Lin, S.-J. Lee, Machine learning based net- work intrusion detection, in: 2017 2nd IEEE International conference on computational intelligence and applications (ICCIA), IEEE, 2017, p. 79โ83. [21] R. Vinayakumar, K. P. Soman, P. Poornachandran, Applying con- volutional neural network for network intrusion detection, in: 2017 International conference on advances in computing, communications and informatics (ICACCI), IEEE, 2017, p. 1222โ1228. [22] H. He, X. Sun, H. He, G. Zhao, L. He, J. Ren, A novel multimodal- sequential approach based on multi-view features for network intru- sion detection, IEEE Access 7 (2019) 183207โ183221. [23] X. Liu, F. Zhang, Z. Hou, L. Mian, Z. Wang, J. Zhang, J. Tang, Self- supervised learning: Generative or contrastive, IEEE Transactions on Knowledge and Data Engineering 35 (1) (2021) 857โ876. [24] B. Perozzi, R. Al-Rfou, S. Skiena, Deepwalk: Online learning of social representations, in: Proceedings of the 20th ACM SIGKDD international conference on Knowledge discovery and data mining, 2014, p. 701โ710. [25] A. Grover, J. Leskovec, node2vec: Scalable feature learning for networks, in: Proceedings of the 22nd ACM SIGKDD international conference on Knowledge discovery and data mining, 2016, p. 855โ 864. [26] T. N. Kipf, M. Welling, Variational graph auto-encoders, arXiv preprint arXiv:1611.07308 (2016). [27] P. Veliฤkoviฤ, W. Fedus, W. L. Hamilton, P. Liรฒ, Y. Bengio, R. D. Hjelm, Deep graph infomax, arXiv preprint arXiv:1809.10341 (2018). [28] Y. You, T. Chen, Y. Sui, T. Chen, Z. Wang, Y. Shen, Graph con- trastive learning with augmentations, Advances in neural information processing systems 33 (2020) 5812โ5823. [29] Y. Han, L. Hui, H. Jiang, J. Qian, J. Xie, Generative subgraph con- trast for self-supervised graph representation learning, in: European Conference on Computer Vision, Springer, 2022, p. 91โ107. [30] E. Rossi, B. Chamberlain, F. Frasca, D. Eynard, F. Monti, M. Bron- stein, Temporal graph networks for deep learning ondynamic graphs, arXiv preprint arXiv:2006.10637 (2020). [31] K.-J. Chen, L. Liu, L. Jiang, J. Chen, Self-supervised dynamic graph representation learning via temporal subgraph contrast, ACM Trans- actions on Knowledge Discovery from Data 18 (1) (2023) 1โ20. [32] H. Wang, X. Di, Y. Wang, B. Ren, G. Gao, J. Deng, An intelligent digital twin method based on spatio-temporal feature fusion for iot attack behavior identification, IEEE Journal on Selected Areas in Communications 41 (11) (2023) 3561โ3572. [33] B.Yu, H. Yin,Z.Zhu,Spatio-temporal graphconvolutionalnetworks: A deep learning framework for traffic forecasting, arXiv preprint arXiv:1709.04875 (2017). [34] G. Duan, H. Lv, H. Wang, G. Feng, X. Li, Practical cyber attack detectionwithcontinuoustemporalgraphindynamicnetworksystem, IEEE Transactions on Information Forensics and Security 19 (2024) 4851โ4864. [35] Z. Lu,W. Wang, C. Wang, On the evolution and impact ofmobile bot- nets in wireless networks, IEEE Transactions on Mobile Computing 15 (9) (2016) 2304โ2316. [36] N. Samia, S. Saha, A. Haque, Predicting and mitigating cyber threats through data mining and machine learning, Computer Communica- tions 228 (2024) 107949. [37] X. Zang,J.Gong,M.Wang,P.Gao, G.Zhang, Ip traffic behavior char- acterization via semantic mining, Journal of Network and Computer Applications 213 (2023) 103603. [38] X. Ma, J. Wu, S. Xue, J. Yang, C. Zhou, Q. Z. Sheng, H. Xiong, L. Akoglu, Acomprehensive survey on graph anomaly detection with deep learning, IEEE transactions on knowledge and data engineering 35 (12) (2021) 12012โ12038. [39] A. Paszke, S. Gross, F. Massa, A. Lerer, J. Bradbury, G. Chanan, T. Killeen, Z. Lin, N. Gimelshein, L. Antiga, et al., Pytorch: An imperative style, high-performance deep learning library, Advances in neural information processing systems 32 (2019). [40] M. Fey, J. E. Lenssen,Fast graph representation learning with pytorch geometric, arXiv preprint arXiv:1903.02428 (2019). [41] N. Koroniotis, N. Moustafa, E. Sitnikova, B. Turnbull, Towards the development of realistic botnet dataset in the internet of things for network forensic analytics: Bot-iot dataset, Future Generation Com- puter Systems 100 (2019) 779โ796. [42] N. Moustafa, TON-IoT Dataset, [Online], available: https:// cloudstor.aarnet.edu.au/plus/s/ds5zW91vdgjEj9i (2020). [43] N. Moustafa, J. Slay, Unsw-nb15: a comprehensive data set for net- work intrusion detection systems (unsw-nb15 network data set), in: 2015 military communications and information systems conference (MilCIS), IEEE, 2015, p. 1โ6. [44] M. Luay, S. Layeghy, S. Hosseininoorbin, M. Sarhan, N. Moustafa, M. Portmann, Temporal analysis of netflow datasets for network intrusion detection systems, arXiv preprint arXiv:2503.04404 (2025). J. Dai et al.:Preprint submitted to ElsevierPage 16 of 16