Causal-Contrastive Graph Neural Networks for Robust, Explainable Multi-Modal Intrusion Detection

Robustness and explainability are major challenges for machine learning-based intrusion detection in dynamic cyber-physical environments. Current models often overfit to dataset-specific traits, which results in poor generalization when concepts change. This work presents Causal-Contrastive Graph Neural Networks (CCGNN), a new framework that aims to learn consistent, meaningful representations of malicious behavior. CCGNN uses a method called differentiable causal masking to remove misleading correlations. It also uses graph-based relational modeling to capture the complex interactions between hosts and network flows. In addition, a temporal contrastive goal ensures that representations remain consistent over time. This approach reduces the impact of changing traffic patterns. Extensive tests on a multi-modal dataset that combines network telemetry and host events show that CCGNN greatly exceeds current leading models in detection accuracy and calibration. This model also shows strong resilience to changes in data distribution and adversarial attacks while significantly reducing alert fatigue for operators. This approach offers a reliable path to effective, clear, and ready-to-use intrusion detection systems.