Enhancing Intrusion Detection via Interpretable Inter-Flow Spatio-Temporal Graphs and Intra-Flow Features

The performance of network intrusion detection systems (IDS) critically depends on the completeness of traffic feature representation. Existing methods predominantly focus either on intra-flow features (e.g., packet length sequences) or single-dimensional inter-flow relationships, limiting optimal classification. To address this restriction, we propose IF$^{2}$-STG to enhance intrusion detection via interpretable inter-flow spatio-temporal graphs and intra-flow features. The key innovation of our scheme is the construction of an Inter-flow Spatio-Temporal relationship Graph (ISTG), with two-dimensional edges explicitly quantifying the correlation strength between flows. On this basis, a GNN learns the inter-flow context. In parallel, a CNN extracts fine-grained intra-flow features from raw bytes of individual flows. Finally, the two modal features are fused to acquire a comprehensive representation. This representation can effectively capture both intrinsic behavior patterns of flows and contextual inter-flow relationships, thereby significantly enhancing the detection performance and robustness of model. Experimental results show that the proposed IF$^{2}$-STG achieves over 99% accuracy on three real-world datasets, outperforming existing approaches. The constructed ISTG provides explicit visual interpretation of flow dependencies. More importantly, IF$^{2}$-STG-Inter, using only inter-flow features, maintains 97.78% detection accuracy in cross-dataset tests involving time-disparate datasets, validating superior generalization of inter-flow spatio-temporal features. This advantage renders it particularly promising for practical intrusion detection applications.