Self-supervised graph neural networks for network intrusion detection in cloud-edge collaboration environments

Cloud–edge collaboration enables intelligent services by combining powerful cloud computation with latency-sensitive edge analytics, but it also widens the attack surface as distributed nodes exchange model updates and traffic over heterogeneous networks, heightening privacy and security risks. Graph neural networks (GNNs) are promising for network intrusion detection (NID) by capturing topological and feature dependencies, yet most approaches rely on supervised, centralized training, limiting scalability and privacy in distributed settings. Additionally, these methods aggregate node and edge features uniformly, overlooking differences among malicious traffic types and limiting detection. To address these challenges, this paper proposes Self-Supervised Graph Multi-Head Attention Networks (SSGMHAN) for NID. The proposed method employs structure-aware graph contrastive learning to form positive and negative pairs and learn from large-scale unlabeled traffic, yielding representations robust to structural perturbations. A multi-head node–edge attention module dynamically emphasizes attack-specific nodes and edges, producing more expressive embeddings. On three benchmarks, SSGMHAN surpasses state-of-the-art unsupervised NID methods, offering an effective self-supervised framework with attention-based aggregation.