BiTA: Bidirectional Gated Recurrent Unit-Transformer Aggregator in a Temporal Graph Network Framework for Alert Prediction in Computer Networks

Zahra Makki Nayeri; Mohsen Rezvani

cs.LGApr 3, 2026

BiTA: Bidirectional Gated Recurrent Unit-Transformer Aggregator in a Temporal Graph Network Framework for Alert Prediction in Computer Networks

Authors: Zahra Makki Nayeri, Mohsen Rezvani

Organizations: Faculty of Computer Engineering, Shahrood University of Technology, Shahrood, Iran

Abstract

Proactive alert prediction in computer networks is critical for mitigating evolving cyber threats and enabling timely defensive actions. Temporal Graph Neural Networks (TGNs) provide a principled framework for modeling time-evolving interactions; however, existing TGN-based methods predominantly rely on unidirectional or single-mechanism temporal aggregation, which limits their ability to capture recursive, multi-scale temporal patterns commonly observed in real-world attack behaviors. In this paper, we propose BiTA, a Bidirectional Gated Recurrent Unit-Transformer Aggregator for temporal graph learning. Rather than introducing a deeper or higher-capacity model, BiTA redesigns the temporal aggregation function within the TGN framework by jointly encoding bidirectional sequential dependencies and long-range contextual relations over each node's temporal neighborhood. This aggregation strategy enables complementary temporal reasoning at different scales while preserving the original TGN memory and message-passing structure. We evaluate BiTA on real-world alert datasets, demonstrating significant improvements in key performance metrics such as area under the curve, average precision, mean reciprocal rank, and per-category prediction accuracy when compared to state-of-the-art temporal graph models. BiTA outperforms baseline methods under both transductive and inductive settings, highlighting its robustness and generalization capabilities in dynamic network environments. BiTA is a scalable and interpretable framework for real-time cyber threat anticipation, paving the way toward more intelligent and adaptive intrusion detection systems.

Figures & tables

Symbol	Description
$u,v,i,j$	Node indices in the temporal graph
$e_{uv}$	Feature vector of the edge $(u,v)$
$t$	Timestamp of an interaction event
$(u,v,e_{uv},t)$	Temporal interaction tuple
$m_{uv}^{(t)}$	Raw message constructed from interaction $(u,v)$ at time $t$
$\text{TE}(t)$	Time encoding function

Table 1: Notation summary used throughout the paper.

Figure 1: Overview of the proposed BiTA module integrated into TGN. Unlike conventional TGNs where message aggregation is performed using heuristic operators (e.g., mean or last), BiTA realizes aggregation through unified temporal–contextual representation learning. Incoming messages are jointly encoded via a BiGRU and a Transformer to model bidirectional temporal dependencies and global contextual interactions. The final mean pooling operation serves only as a readout mechanism, not as the aggregation itself.

Detect Time	Flow Count	Source IP	Target IP	Port	Protocol	Category
2019-03-11T00:05:00+02:00	17094	185.192.59.136	142.252.135.136	22	TCP	Recon scan
2019-03-12T00:45:00+02:00	5113	78.234.46.141	142.252.32.63	443	TCP	Availability Dos
2019-03-14T00:25:00+02:00	39	78.234.46.141	142.252.32.63	22	UDP	Anomaly.Traffic

Table 2: A sample of typical alert data.

Figure 2: Sample of a graph-based representation of alert data.

Figure 3: The graph evolution in time.

Event	Attacker	Victim	Time	Edge Feature	Attack Category
1	A	B	$t_{1}$	0.2	DoS
2	C	D	$t_{2}$	0.5	Scan
3	A	D	$t_{3}$	?	?

Table 3: Example temporal interactions with attacker, victim, and attack category.

Figure 4: Example of the BiTA framework for link prediction and category prediction

Figure 5: Distribution of Attack Intervals.

Figure 6: Attack Accumulation Over Time.

Panel of Figure 7 — Figure 7: BiTA comparison with baselines-ROC Curve. (a) TPR vs. FPR (b) Recall.Precision. The AUC of new nodes (inductive setting) and old nodes (transductive setting)

Panel of Figure 8 — Figure 8: BiTA comparison with baselines-ROC Curve. (a) TPR vs. FPR (b) Precision-Recall.

Figure 9: Comparison of Metrics for multiple time windows.

Aggregator	Class	Transductive				Inductive
Aggregator	Class	Accuracy	Precision	AUC	Recall	Accuracy	Precision	AUC	Recall
BiGRU Transformer	Anomaly.Traffic	0.9761	0.9522	0.9974	0.9639	0.9703	0.9389	0.9839	0.9541
	Availability.DDoS	1.0	0.9992	1.0	0.9976	1.0	1.0	1.0	1.0
	Availability.DoS	1.0	1.0	1.0	1.0	N/A	N/A	N/A	N/A
	Recon.Scanning	0.9505	0.9714	0.9974	0.9635	0.8645	0.8859	0.9730	0.8516
BiTransformer	Anomaly.Traffic	0.9761	0.8559	0.9964	0.9761	0.9649	0.8483	0.9802	0.9649

Table 4: Per-class metrics (Accuracy, Precision, AUC, Recall) across inductive and transductive settings for each aggregator.

Figure 10: Comparison of Metrics for baselines approaches.

Figure 11: Comparison of Metrics for baselines and graph based approaches.

Figure 12: Comparison of metrics for multiple approaches over time.

Panel of Figure 13 — Figure 13: Metrics Comparision for NF-UNSW dataset based on multiple aggregators.

Aggregator	Recursive	Temporal-Aware	Architecture Type
LastMessageAggregator	✗	✗	Simple / Baseline
MeanMessageAggregator	✗	✗	Pooling-based
BiGRUTransformerAggregator	✓	✓	BiGRU + Transformer
BiTransformerAggregator	✗	✓	Transformer-based
BiTransformerTemporalAggregator	✗	✓	Transformer + Temporal Encoding
RelativeTransformerAggregator	✗	✓	Transformer + Relative Bias

Table 5: Comparison of different message aggregators. Recursive indicates whether the architecture uses recurrence (e.g., GRU or TCN). Temporal-awareness denotes if the aggregator models temporal order or intervals explicitly.

Figure 14: Comparison of metrics for baseline aggregators and the proposed aggregator (Transductive setting).

Figure 15: Comparison of metrics for baseline aggregators and the proposed aggregator (Inductive setting).

Aggregator	Transductive					Inductive
	AUC	AP	F1	MRR	Recall	AUC	AP	F1	MRR	Recall
BiGRUTransformerAggregator	0.9511	0.9509	0.9809	0.9895	0.9812	0.7689	0.7722	0.9383	0.9707	0.9352
BiTransformerAggregator	0.9321	0.9316	0.9580	0.9764	0.9612	0.7414	0.7558	0.8665	0.9423	0.8485
BiTransformerTemporalAggregator	0.9341	0.9392	0.9761	0.9868	0.9772	0.7391	0.7511	0.9296	0.9668	0.9232
RelativeTransformerAggregator	0.9268	0.9240	0.9599	0.9777	0.9645	0.7444	0.7547	0.8783	0.9485	0.8570
StackedBiTransformerAggregator	0.9280	0.9271	0.8644	0.9403	0.8655	0.7228	0.7237	0.5435	0.8757	0.4941

Table 6: Performance comparison of message aggregators across inductive and transductive settings on core metrics.

Aggregator	Transductive				Inductive
	FPR	FNR	TPR	TNR	FPR	FNR	TPR	TNR
BiGRUTransformerAggregator	0.0069	0.0208	0.9791	0.9930	0.0194	0.0584	0.9415	0.9805
BiTransformerAggregator	0.0154	0.0464	0.9535	0.9845	0.0380	0.1140	0.8859	0.9619
BiTransformerTemporalAggregator	0.0087	0.0261	0.9738	0.9912	0.0219	0.0657	0.9342	0.9780
RelativeTransformerAggregator	0.0147	0.0442	0.9557	0.9852	0.0341	0.1023	0.8976	0.9658
StackedBiTransformerAggregator	0.0392	0.1178	0.8821	0.9607	0.0808	0.2426	0.7573	0.9191

Table 7: Extended metrics analysis for all aggregators.

Aggregator	Transductive			Inductive
	Hits@1	Binary Loss	Edge Loss	Hits@1	Binary Loss	Edge Loss
BiGRUTransformerAggregator	0.9791	0.0140	1.1364	0.9415	0.0580	1.2947
BiTransformerAggregator	0.9535	0.0277	1.1483	0.8859	0.0959	1.2868
BiTransformerTemporalAggregator	0.9738	0.0139	1.1380	0.9342	0.0545	1.2989
RelativeTransformerAggregator	0.9557	0.0274	1.1615	0.8976	0.0767	1.2866
StackedBiTransformerAggregator	0.8821	0.0419	1.1662	0.7573	0.0970	1.3135

Table 8: Performance comparison of message aggregators across inductive and transductive settings on auxiliary metrics.

Panel of Figure 16 — Figure 16: Comparison of metrics illustrating the influence of message sequence length.

Figure 17: Comparison of metrics based on contribution of the Transformer component.

Configuration	Aggregator	Test AP	Test AUC	Test Acc.	Test F1	New Node AP	New Node AUC	New Node Acc.	New Node F1
Only GRU	GRU	0.8944	0.9285	0.9776	0.8809	0.7541	0.7581	0.9357	0.7265
Only BiGRU	BiGRU	0.9459	0.9493	0.9842	0.8634	0.7580	0.7597	0.9518	0.6681
Only Transformer	Transformer	0.8875	0.9026	0.9650	0.8394	0.6240	0.7054	0.9123	0.6873
GRU + Transformer	GRU+Trans.	0.8784	0.8585	0.9851	0.7821	0.7094	0.6681	0.9576	0.6667
BiGRU + Transformer	BiGRU+Trans.	0.9323	0.9414	0.9875	0.8741	0.7429	0.7461	0.9620	0.7160

Table 9: Ablation study on architectural components. We evaluate different aggregator configurations to understand the contribution of each component to overall performance.

Figure 18: Improvement percentage comparison of metrics based on contribution of the Transformer component.

Figure 19: Temporal Order Sensitivity Analysis.

Figure 20: Training Batch Order Sensitivity Analysis.

Hyperparameters
Batch Size	128	Learning Rate	0.0001
Epochs	50	Patience	5
Dropout	0.1	Attention Heads	2
Node Dim.	100	Time Dim.	100
Message Dim.	100	Memory Dim.	9
Dataset Statistics

Table 10: Experimental setup and dataset statistics: all aggregators use identical hyperparameters and model capacity to ensure fair comparison. The only difference is the aggregation mechanism.

Model Capacity		Computational Cost
Method	Params	Train (s)	Infer. (s)	Memory
TGN-Vanilla (Last)	2,381	122.68	0.48	583.03 MB
TGN-Vanilla (Mean)	2,381	128.80	0.65	604.98 MB
BiTA	2,381	188.18	0.62	583.73 MB

Table 11: Fair comparison: equal parameters across methods.

Panel of Figure 21 — Figure 21: ROC curve comparison of BiTA with SOTA methods. (a) Performance of BiTA, TGN-Vanilla with mean aggregator configuration and SOTA. (b) Performance of BiTA, TGN-Vanilla with last aggregator configuration and SOTA.

Figure 22: ROC curve comparison of BiTA with SOTA baselines.

Figure 23: Inference time comparison of SOTA.

Figure 24: Comprehensive performance comparison of BiTA against SOTA baselines across multiple evaluation metrics.

Figure 25: Batch Size Scalability: Impact of batch size on latency and throughput.

Figure 26: Graph Size Scalability: Scalability with increasing graph size.

Figure 27: Latency Distribution: Demonstrating real-time inference capability.

Explore similar work

Timestamp-Aware Spatio-Temporal Graph Contrastive Learning for Network Intrusion Detection
Jun 15, 2026Jianli Dai, Guangwei Wu, Jiacheng Li +3Temporal GNNs Graph SSL
Central South University of Forestry and Technology, School of Computer Science and Mathematics, Changsha, 410004, Hunan, P.R. China · Central South University, School of Computer Science and Engineering, Changsha, 410083, Hunan, P.R. China
TGFormer: Towards Temporal Graph Transformer with Auto-Correlation Mechanism
May 24, 2026Hongjiang Chen, Pengfei Jiao, Ming Du +4Temporal GNNs Sequence Modeling
Hangzhou Dianzi University, School of Cyberspace, Hangzhou, 310018, China · Tianjin University, College of Intelligence and Computing, Tianjin, 300072, China · State Key Laboratory of Systems Medicine for Cancer, Shanghai Cancer Institute, Shanghai, 200127, China
GTIN: A Unified Framework for Joint Event and Time Prediction in Temporal Graphs
Jul 26, 2026Mohammad Ostadmohammadi, Sepehr Kazemi, Hamid R. RabieeEvent Time Prediction Dynamic Graph Learning
Department of Computer Engineering, Sharif University of Technology, Azadi Ave., Tehran, Iran · Department of Electrical Engineering, Sharif University of Technology, Azadi Ave., Tehran, Iran · Sharif University of Technology, Azadi Ave., Tehran, Iran

Jun 15, 2026J/K move · Enter open · S save

Timestamp-Aware Spatio-Temporal Graph Contrastive Learning for Network Intrusion Detection

Jianli Dai, Guangwei Wu, Jiacheng Li, Weiping Wang+2

Central South University of Forestry and Technology, School of Computer Science and Mathematics, Changsha, 410004, Hunan, P.R. China · Central South University, School of Computer Science and Engineering, Changsha, 410083, Hunan, P.R. China

Temporal GNNs Graph SSL Network Intrusion Detection Graph Contrastive Learning Spatiotemporal GNNs

Open paper AskPDF arXiv

Given their effectiveness in modeling the relational structure among network traffic flows, graph neural networks (GNNs) have been widely adopted in network intrusion detection systems (NIDSs). However, most existing GNN-based NIDS approaches focus on the relational structure of traffic flows, and treat them as temporally independent, which limits their ability to cope with evolving attack behaviors. Moreover, their reliance on supervised or semi-supervised learning often restricts generalization to unseen attacks. To address these limitations, we propose a novel self-supervised GNN-based framework. To the best of our knowledge, the proposed model is among the first self-supervised GNN-based NIDS models to explicitly leverage real timestamps, which provides faithful temporal dependencies for representation learning. We first construct a series of temporal graphs from network traffic flows according to their timestamps, and then employ an E-GraphSAGE and LSTM based encoder to fully extract temporal information and spatial dependencies of network traffic, without introducing time-costly attention mechanisms. A multi-view graph contrastive learning (GCL) scheme is introduced, where temporal, spatial, and feature contrasts are jointly performed to capture temporal continuity, preserve structural consistency, and improve the generalization and robustness of the learned representations, respectively. In addition, a gradient-norm-based adaptive weighting strategy is designed to optimize the contrastive loss weights. Experimental results on four representative NIDS datasets with real timestamps demonstrate that our method significantly outperforms existing self-supervised approaches and achieves performance comparable to the supervised state-of-the-art GNN method, while maintaining high computational efficiency.

Abstract

Explore similar work

Timestamp-Aware Spatio-Temporal Graph Contrastive Learning for Network Intrusion Detection

TGFormer: Towards Temporal Graph Transformer with Auto-Correlation Mechanism

GTIN: A Unified Framework for Joint Event and Time Prediction in Temporal Graphs