Robust Semi-Supervised Temporal Intrusion Detection for Adversarial Cloud Networks

Anasuya Chattopadhyay; Daniel Reti; Hans D. Schotten

cs.LGApr 14, 2026

Robust Semi-Supervised Temporal Intrusion Detection for Adversarial Cloud Networks

Authors: Anasuya Chattopadhyay, Daniel Reti, Hans D. Schotten

Organizations: German Research Center for Artificial Intelligence (DFKI), Germany · RPTU University Kaiserslautern-Landau, Germany

Abstract

Cloud networks increasingly rely on machine learning based Network Intrusion Detection Systems to defend against evolving cyber threats. However, real-world deployments are challenged by limited labeled data, non-stationary traffic, and adaptive adversaries. While semi-supervised learning can alleviate label scarcity, most existing approaches implicitly assume benign and stationary unlabeled traffic, leading to degraded performance in adversarial cloud environments. This paper proposes a robust semi-supervised temporal learning framework for cloud intrusion detection that explicitly addresses adversarial contamination and temporal drift in unlabeled network traffic. Operating on flow-level data, this framework combines supervised learning with consistency regularization, confidence-aware pseudo-labeling, and selective temporal invariance to conservatively exploit unlabeled traffic while suppressing unreliable samples. By leveraging the temporal structure of network flows, the proposed method improves robustness and generalization across heterogeneous cloud environments. Extensive evaluations on publicly available datasets (CIC-IDS2017, CSE-CIC-IDS2018, and UNSW-NB15) under limited-label conditions demonstrate that the proposed framework consistently outperforms state-of-the-art supervised and semi-supervised network intrusion detection systems in detection performance, label efficiency, and resilience to adversarial and non-stationary traffic.

Figures & tables

Dataset	Split	Samples	Attack Ratio (%)
CIC-IDS2017	Train	180K	18.5
	Val	40K	17.9
	Test	60K	18.2
CSE-CIC-IDS2018	Test	120K	16.7
UNSW-NB15	Test	100K	14.2

TABLE I: Dataset Statistics After Cleaning and Windowing

Model	Accuracy (%)	F1-score (%)	AUROC
CNN (Supervised)	91.2	88.5	0.921
LSTM (Supervised)	92.4	89.6	0.934
Transformer (Supervised)	93.1	90.2	0.941
Autoencoder (Unsupervised)	84.7	79.3	0.861
SSL-NIDS (FixMatch-style)	94.0	91.1	0.952
SSL-NIDS (SimCLR-style)	94.6	91.8	0.958

TABLE II: Detection Performance on CIC-IDS2017.

Model	Metric	CIC $\rightarrow$ CSE-CIC	CIC $\rightarrow$ UNSW
Transformer (Supervised)	AUROC	$0.802\pm 0.011$	$0.765\pm 0.014$
	MCC	$0.41\pm 0.03$	$0.37\pm 0.04$
SSL (Contrastive)	AUROC	$0.836\pm 0.009$	$0.801\pm 0.012$
	MCC	$0.49\pm 0.02$	$0.46\pm 0.03$
CCSSL-style	AUROC	$0.851\pm 0.010$	$0.814\pm 0.011$
	MCC	$0.52\pm 0.03$	$0.48\pm 0.03$

TABLE III: Cross-Dataset Generalization Performance (Mean

\pm

Std)

Attack Category	Transformer	SSL (Contrastive)	RSST-NIDS
DoS / DDoS	88.3	90.7	94.9
Brute Force	71.4	76.2	83.5
Infiltration	62.1	66.8	74.3
Web Attacks	68.9	72.5	80.1
Botnet / C2	73.6	77.9	85.4

TABLE IV: Per-Attack Category Detection Performance (F1-score %)

Poisoning	AUROC	MCC	Admitted (%)
5%	0.97	0.61	42%
10%	0.95	0.58	31%
15%	0.93	0.54	22%

TABLE V: Impact of Data Poisoning on RSST-NIDS Performance

Model Variant	F1-score (%)	AUROC
Full RSST-NIDS	94.5	0.973
- Confidence-aware pseudo-labeling	91.7	0.952
- Temporal invariance loss	92.1	0.957
- Consistency regularization	90.9	0.946
- All SSL components (Supervised only)	89.8	0.938

TABLE VI: Ablation Study of RSST-NIDS Components. (-) indicates the removal of the named component from the model.

Network Intrusion Detection

Network intrusion detection identifies malicious or abnormal network activity to help protect computers, connected devices, and critical infrastructure.

See all 168 papers

Timestamp-Aware Spatio-Temporal Graph Contrastive Learning for Network Intrusion Detection
Jun 15, 2026Jianli Dai, Guangwei Wu, Jiacheng Li +3Temporal GNNs Graph SSL
Central South University of Forestry and Technology, School of Computer Science and Mathematics, Changsha, 410004, Hunan, P.R. China · Central South University, School of Computer Science and Engineering, Changsha, 410083, Hunan, P.R. China
Robust Unsupervised Network Intrusion Detection via Federated Learning with Selective Aggregation under Anomalous Sample Contamination
Jul 28, 2026Shohei Kamiguchi, Takayuki NishioNetwork Intrusion Detection Unsupervised Anomaly Detection
School of Engineering, Institute of Science Tokyo, Tokyo 152-8550, Japan
A Multi-Layer Cloud-IDS Pipeline with LLM and Adaptive Q-Learning Calibration
May 15, 2026Syed Waqas Ali, Ibrar Ali Shah, Farzana Zahid +2Network Intrusion Detection Cybersecurity
Department of Computer Software Engineering, University of Engineering and Technology, Mardan, 23200, Khyber Pakhtunkhwa, Pakistan · Department of Computer Science, University of Waikato, Hamilton, 3240, New Zealand · WICON, RPTU University, Kaiserslautern-Landau, Kaiserslautern, 67663, Germany +1

Jun 15, 2026J/K move · Enter open · S save

Timestamp-Aware Spatio-Temporal Graph Contrastive Learning for Network Intrusion Detection

Jianli Dai, Guangwei Wu, Jiacheng Li, Weiping Wang+2

Central South University of Forestry and Technology, School of Computer Science and Mathematics, Changsha, 410004, Hunan, P.R. China · Central South University, School of Computer Science and Engineering, Changsha, 410083, Hunan, P.R. China

Temporal GNNs Graph SSL Network Intrusion Detection Graph Contrastive Learning Spatiotemporal GNNs

Open paper AskPDF arXiv

Given their effectiveness in modeling the relational structure among network traffic flows, graph neural networks (GNNs) have been widely adopted in network intrusion detection systems (NIDSs). However, most existing GNN-based NIDS approaches focus on the relational structure of traffic flows, and treat them as temporally independent, which limits their ability to cope with evolving attack behaviors. Moreover, their reliance on supervised or semi-supervised learning often restricts generalization to unseen attacks. To address these limitations, we propose a novel self-supervised GNN-based framework. To the best of our knowledge, the proposed model is among the first self-supervised GNN-based NIDS models to explicitly leverage real timestamps, which provides faithful temporal dependencies for representation learning. We first construct a series of temporal graphs from network traffic flows according to their timestamps, and then employ an E-GraphSAGE and LSTM based encoder to fully extract temporal information and spatial dependencies of network traffic, without introducing time-costly attention mechanisms. A multi-view graph contrastive learning (GCL) scheme is introduced, where temporal, spatial, and feature contrasts are jointly performed to capture temporal continuity, preserve structural consistency, and improve the generalization and robustness of the learned representations, respectively. In addition, a gradient-norm-based adaptive weighting strategy is designed to optimize the contrastive loss weights. Experimental results on four representative NIDS datasets with real timestamps demonstrate that our method significantly outperforms existing self-supervised approaches and achieves performance comparable to the supervised state-of-the-art GNN method, while maintaining high computational efficiency.

Abstract

Network Intrusion Detection

Explore similar work

Timestamp-Aware Spatio-Temporal Graph Contrastive Learning for Network Intrusion Detection

Robust Unsupervised Network Intrusion Detection via Federated Learning with Selective Aggregation under Anomalous Sample Contamination

A Multi-Layer Cloud-IDS Pipeline with LLM and Adaptive Q-Learning Calibration