GAGA-Net: A GAN and GNN Hybrid Model for Enhanced Network Anomaly Detection in Cybersecurity

Abstract

As network threats increase in complexity, traditional signature- and rule-based detection systems find it challenging to recognize unexpected or zero-day attacks. This study presents GAGA-Net (Generative Adversarial and Graph-based Anomaly Network), an innovative hybrid framework for anomaly detection that combines Generative Adversarial Networks (GANs) to model benign traffic distributions with Graph Neural Networks (GNNs) to capture spatiotemporal relationships in network traffic. The GAN component is trained on benign samples to identify behavioral abnormalities, whereas the GNN employs graph-structured representations to categorize anomalies based on structural discrepancies. Upon evaluation using NSL-KDD, CICIDS 2017, and a real-world dataset, GAGA-Net attains an accuracy of 97.35%, a false positive rate of 2.10%, and a false negative rate of 1.80% on NSL-KDD, with an average inference time of 120 milliseconds per sample, thereby exhibiting real-time capability. These results substantially exceed the performance of traditional models such as CNN-LSTM and Autoencoder-IDS. The model has significant robustness in noisy and adversarial conditions, successfully detecting zero-day assaults with an efficacy of up to 92%. GAGA-Net provides a scalable and generalizable solution for contemporary intrusion detection issues.