In this paper, an adaptive traffic detection framework based on Dynamic Graph Neural Network for Adaptive Traffic Anomaly Detection (DGNN-ATAD) is proposed to deal with complex attacks such as Advanced Persistent Threat (APT), Zero-Day Exploitation and Distributed Denial of Service (DDoS). Traditional methods have limitations in dealing with dynamic network attacks, such as static rules are difficult to cover unknown threats, manual feature engineering is inefficient, and traffic correlation is ignored. In order to overcome these limitations, this paper designs an overall architecture including four core modules: dynamic diagram construction module, spatial feature extraction module, temporal feature extraction module and anomaly detection module. By introducing time series sliding window mechanism and graph attention mechanism, the model can dynamically construct heterogeneous graphs and automatically learn the importance relationship between nodes. Hierarchical graph convolution module decouples local neighbor aggregation and time series modeling, and integrates channel attention mechanism to optimize feature representation. The experimental results show that DGNN-ATAD is significantly superior to other comparison methods on CIC-IDS-2017 data set, and the F1-Score reaches 93.80%, which proves its effectiveness in capturing the time series evolution of network behavior and improving the quality of features. The ablation experiment further verified the necessity of each core component.
Huang et al. (Sun,) studied this question.