Fusing Flow and Packet Modalities: Toward Graph-Based, Interpretable Intrusion Detection

#network-intrusion-detection #neural-networks #intrusion-detection #graph-neural-networks

Network intrusion detection has long been divided between two perspectives: flow-level analysis, which efficiently identifies traffic trends, and packet-level inspection, which captures the detailed characteristics of payloads. While each approach offers value, their separation creates blind spots and limits effectiveness. This talk explores a new direction that fuses flow- and packet-level modalities into a unified graph-based framework, allowing both high-level patterns and fine-grained content to be analyzed together. By leveraging heterogeneous Graph Neural Networks, the system captures the complex interactions between flows and packets, resulting in more accurate and resilient detection. Beyond performance, equal emphasis is placed on interoperability and decision support: integrated Large Language Models generate clear, contextual explanations and actionable insights, bridging the gap between technical outputs and human decision-making. The outcome is a more comprehensive, interpretable, and user-friendly intrusion detection paradigm, designed not only to recognize diverse threats but also to support effective responses in real time.