Network Scanning Detection Based on Spatiotemporal Behavior

Network scanning stands as a crucial tactic for attackers to identify and access network assets. Timely recognition of network scanning behavior facilitates early detection of attackers’ intentions, enabling proactive defensive measures. However, network scans often involve attempts to access specific pathways, and the traffic itself doesn’t exhibit overt malicious traits, making it challenging to discern whether a single traffic instance represents scanning behavior. This paper devises a spatiotemporal behavior detection method that integrates temporal features of traffic content and network node access relationship features. Leveraging LSTM, the paper amalgamates network traffic data over a period, resulting in a graph data structure encompassing node features, edge features, and node access relationships. The EdgeGAT network is employed for classifying and identifying graph data. Experimental findings indicate the positive impact of node access relationships within traffic data on identifying asset scanning behavior, thereby enhancing the effectiveness of traditional traffic identification methods.