Scholarlink

With the increasing prevalence of encrypted traffic, machine learning and deep learning methods are widely used for detection but often struggle to capture complex flow interactions. Although Graph Neural Networks (GNNs) show promise, they lack effective early detection in dynamic environments. To address this, we propose an early detection approach integrating the Dynamic Interaction Flow Graphs (DIFG) with the Spatio-Temporal Attention (STA) mechanism. We model interactive flows in network traffic using the DIFG, and employ GNNs to extract interaction features from the DIFG. Meanwhile, the STA mechanism is utilized to capture spatiotemporal features from the graph structure. Additionally, we introduce the Super Path (SP), a subgraph derived from the Hamiltonian path in DIFG, to capture temporal traffic characteristics. Through the integration of various modules, we effectively represent the interactive behavior of network traffic. Experimental results demonstrate that the proposed approach achieves excellent performance on both public and self-constructed datasets. It attains an overall detection accuracy exceeding 99%, and maintains approximately 98% accuracy even when using only the first 10 packets of each interactive flow, effectively validating the effectiveness of our approach for early malicious traffic detection.

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

Early Detection of Malicious Traffic Based on Graph Modeling and Spatio-Temporal Attention Approach

  • 会议论文

  • 发表日期：

    2026年

查看全文
  • Jinchuan Liu,
  • Shuaishuai Tan,
  • Jiaxiong Chen,
  • Zehua Zhang,
  • Qiannan Lin,
  • Zhaoyan Chen,
  • Junhang Fu

摘要

With the increasing prevalence of encrypted traffic, machine learning and deep learning methods are widely used for detection but often struggle to capture complex flow interactions. Although Graph Neural Networks (GNNs) show promise, they lack effective early detection in dynamic environments. To address this, we propose an early detection approach integrating the Dynamic Interaction Flow Graphs (DIFG) with the Spatio-Temporal Attention (STA) mechanism. We model interactive flows in network traffic using the DIFG, and employ GNNs to extract interaction features from the DIFG. Meanwhile, the STA mechanism is utilized to capture spatiotemporal features from the graph structure. Additionally, we introduce the Super Path (SP), a subgraph derived from the Hamiltonian path in DIFG, to capture temporal traffic characteristics. Through the integration of various modules, we effectively represent the interactive behavior of network traffic. Experimental results demonstrate that the proposed approach achieves excellent performance on both public and self-constructed datasets. It attains an overall detection accuracy exceeding 99%, and maintains approximately 98% accuracy even when using only the first 10 packets of each interactive flow, effectively validating the effectiveness of our approach for early malicious traffic detection.