Network Traffic Anomaly Detection Based on Spatio-Temporal Dynamic Graph

The rapid advancement of emerging technologies, such as cloud computing, big data and artificial intelligence has facilitated a holistic digital transformation of society. This transformation has led to an increased diversity and complexity in network traffic and behavior, thereby presenting new challenges to cybersecurity. Network traffic anomaly detection plays a vital role in enhancing network security situation awareness and maintaining cyberspace security. However, existing anomaly detection algorithms are designed for single links and local networks, overlooking the interactive connection features(CF) of traffic during communication, making it difficult to capture the correlation between network traffics. To address this limitation, we proposed an anomaly detection algorithm based on spatio-temporal dynamic graphs that extract network interactive connection features (CF) by modeling network traffic as dynamic graphs while incorporating statistical features (SF) inherent in the traffic itself. Experimental results based on the IDS2017 public dataset show that by integrating all available spatio-temporal features, our algorithm outperforms comparative deep learning models and machine learning algorithms in terms of both accuracy and F1 score.