Hybrid Edge-Centric Graph Transformers: Overcoming Representation Bottlenecks in Self-Supervised Network Intrusion Detection System

Traditional supervised Network Intrusion Detection Systems (NIDS) are more and more ineffective against evolving zero-day threats. This is due to their statistical anchoring to known attack signatures. Now we have seen that self-supervised Graph Neural Networks (GNNs) offer a promising paradigm for modeling relational dependencies in unlabeled traffic, but they too often suffer from representation bottlenecks. This paper presents an evolutionary research journey, encompassing the entire journey of the development of GateNIDS. How the development of GflowNIDS, a spatial-temporal framework, shaped its successor, GateNIDS . Our initial investigation revealed that standard node-centric aggregation leads to "feature dilution," where critical NetFlow statistics are averaged out during message passing. In order to formally address this, GateNIDS utilizes an edge-centric Residual Edge-Gated SAGE (RE-SAGE) encoder. This is seen to preserve micro-level flow attributes while capturing macro-topological context. Besides this, the GateNIDS architecture optimizes this encoder with a Transformer-based Masked Autoencoder (MAE) for temporal reconstructibility and replaces the rigid scalar thresholding, which was used earlier, with a Gradient-Boosted Anomaly Refinement (GBAR) module. This module will analyze multidimensional reconstruction residuals. Empirical evaluations demonstrate state-of-the-art performance across heterogeneous environments, for example: the model achieves a perfect 0.9999 PR-AUC (0.9998 F1-score) on NF-UNSW-NB15-v3 and a superior 0.9813 F1-score (0.9723 PR-AUC) on the enterprise-scale NF-CSE-CIC-IDS2018-v3 dataset. With a sub-1.5 GB memory footprint and microsecond-level latency, GateNIDS provides a scalable, real-time solution for zero-day threat mitigation, offering a transparent roadmap for designing high-fidelity graph-based security systems.