An abnormal traffic detection method based on graph time sequence double-branch gate attention
By constructing an abnormal traffic detection model with graph temporal dual-branch gated attention, the problems of non-adaptive feature fusion and insufficient dynamic filtering ability in existing methods in network attack identification are solved, and a more efficient network attack identification effect is achieved.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- GUILIN UNIVERSITY OF TECHNOLOGY
- Filing Date
- 2026-04-03
- Publication Date
- 2026-07-21
AI Technical Summary
Existing abnormal traffic detection methods suffer from several drawbacks in network attack identification. They lack a comprehensive understanding of network traffic behavior patterns from a single perspective, ignore topological interactions and dynamic patterns, have non-adaptive feature fusion methods, and lack dynamic filtering capabilities, resulting in insufficient detection accuracy and specificity.
An abnormal traffic detection model based on graph temporal dual-branch gated attention is constructed. The topological relationship and time series features of the traffic are extracted by graph topology encoding branch and temporal feature extraction branch, respectively. The gated cross-attention fusion module is used to perform adaptive feature fusion and generate independent fusion weights.
It significantly improves the accuracy of abnormal traffic detection and the macro-average F1 score, especially in distinguishing attack categories with sparse signals or requiring dual-branch cooperation, thus achieving more efficient network attack identification.
Smart Images
Figure CN122437674A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of network security technology, and more specifically, to an anomaly traffic detection method based on graph temporal dual-branch gating attention in the field of network traffic anomaly detection technology. Background Technology
[0002] As cyberattack methods continue to evolve, various attack techniques, such as port scanning, denial-of-service attacks, and backdoor implantation, often appear in combination in actual intrusion incidents. Research focus in anomaly traffic detection has shifted to multi-class, fine-grained classification. Network traffic records contain different types of fields, including protocol metadata, transmission statistics, and connection timing. Clues for different attack categories are scattered across different feature dimensions. In existing technologies, deep learning-based anomaly traffic detection methods are mainly divided into two categories: one is based on temporal features, such as using convolutional neural networks or recurrent neural networks to extract temporal dependencies in traffic; the other is based on graph structures, such as using graph neural networks to model the communication topology relationships between flow records.
[0003] However, existing abnormal traffic detection methods still have the following shortcomings: First, single-perspective models are difficult to comprehensively depict the behavioral patterns of network traffic. Temporal features ignore the topological interactions between flows, while graph structure features weaken the dynamic laws of traffic evolution over time. Second, simple multi-branch feature fusion methods, such as feature concatenation or proportional weighting, cannot adaptively adjust the contribution of different branch features according to the characteristics of the sample itself. When a branch is affected by contextual noise, the bias will be directly transmitted to the final decision. Third, different feature dimensions have different discriminative power against various attacks, and existing methods lack the ability to dynamically filter key feature dimensions. Summary of the Invention
[0004] To address the aforementioned technical problems, this invention proposes an abnormal traffic detection method based on graph temporal dual-branch gated attention.
[0005] To achieve the above objectives, the technical solution of the present invention includes the following steps: Step 1, construct the training dataset: (1a) Obtain network traffic records and preprocess the traffic records, including deduplication, feature construction and encoding, and grouping by communication identifier; (1b) Extract sequence samples from the grouped traffic records in chronological order using a sliding window, and construct a graph structure by establishing adjacency relationships between traffic records with the same communication identifier. Combine the sequence samples and the graph structure data to form training samples and obtain the training dataset. Step 2, construct the abnormal traffic detection network model: The network model includes a graph topology coding branch, a temporal feature extraction branch, and a gated cross-attention fusion module; The graph topology coding branch is used to extract the communication topology relationship between stream records and output the node embedding vector; The temporal feature extraction branch is used to extract the temporal sequence dependencies of stream records and output multi-time step features; The gated cross-attention fusion module is used to perform multi-head cross-attention operation with the output of the graph topology coding branch as the query and the output of the temporal feature extraction branch as the key and value. After performing residual connection between the operation result and the original graph embedding, it is then fused with the pooled temporal features in a dimension-wise gated manner to obtain fused features for final classification. Step 3: Train the abnormal traffic detection network model to obtain the trained abnormal traffic detection network model: All training samples in the training dataset are input into the abnormal traffic detection network model. The parameters of the network are iteratively updated using the gradient descent method until the loss function converges, thus obtaining the trained abnormal traffic detection network model. Step 4: Perform anomaly detection on network traffic: The network traffic data to be detected is input into the trained abnormal traffic detection network model, and after processing, the abnormal detection classification result is obtained.
[0006] Step 4, perform abnormal traffic detection: input the network traffic data to be detected into the trained abnormal traffic detection model, and obtain the traffic type determination result for each network flow after processing.
[0007] The preprocessing in step (1a) specifically includes: deduplicating completely duplicated stream records; calculating the inbound to outbound byte ratio, packet ratio, and throughput difference of the stream records as new features; performing one-hot encoding on the category field; and using the quadruple of source host, destination host, protocol type, and application layer protocol as the communication identifier.
[0008] The graph topology coding branch in step 2 consists of two GraphSAGE convolutional layers and a first-channel attention module connected in series; the temporal feature extraction branch consists of multiple stacked temporal convolutional blocks and a second-channel attention module connected in series; both the first-channel attention module and the second-channel attention module are compression activation modules.
[0009] The compression activation module is used to recalibrate the channels of the input features. The compression activation module first performs global average pooling on the input features to obtain channel descriptors, and then processes the channel descriptors sequentially through a first fully connected layer, a ReLU activation function, a second fully connected layer, and a Sigmoid function to obtain a channel weight vector. Finally, the input features are multiplied element-wise by the channel weight vector to output the weighted features.
[0010] The gated cross-attention fusion module includes a multi-head cross-attention unit, a residual connection unit, a temporal pooling unit, and a dimension-by-dimensional gated fusion unit. The multi-head cross-attention unit is used to obtain the query by linearly projecting the node embedding vector output by the graph topology coding branch, obtain the key and value by linearly projecting the multi-time step features output by the temporal feature extraction branch after layer normalization, perform multi-head scaling dot product attention operation, and output cross-attention features. The residual connection unit is used to add the cross-attention feature to the node embedding vector, and then output the enhanced graph feature after layer normalization; The temporal pooling unit is used to perform mean pooling on the multi-time-step features output by the temporal feature extraction branch along the time dimension, and after layer normalization, output the pooled temporal representation. The dimension-wise gated fusion unit is used to concatenate the enhanced graph features with the pooled temporal representation, input them into a fully connected layer, generate a gate vector through the Sigmoid function, and use the gate vector to perform element-wise weighted fusion of the enhanced graph features and the pooled temporal representation to obtain the fused features.
[0011] The residual connection unit multiplies the cross-attention features by a learnable scaling factor before adding them to the node embedding vector.
[0012] The loss function in step 3 is Focal Loss with class weights.
[0013] Compared with existing technologies, the beneficial effects of this invention are as follows: This invention proposes an abnormal traffic detection method based on graph temporal dual-branch gated attention. This method constructs a dual-branch network model that includes graph topology encoding and temporal feature extraction. On the one hand, channel attention modules are introduced into the graph topology encoding branch and the temporal feature extraction branch, respectively. This can generate channel weighting coefficients based on the feature values of each sample, amplifying the response of dimensions related to the current traffic pattern and reducing the influence of irrelevant dimensions, thus achieving adaptive filtering of feature dimensions. On the other hand, this invention employs a gated cross-attention fusion module, using graph embedding as the query and temporal features as the key to perform multi-head cross-attention operations. This allows graph features to actively extract information related to their own discrimination from temporal features, and generates independent branch fusion weights for each feature dimension through a dimensional gated network. This enables different samples to obtain different fusion schemes based on the differences between their two feature paths. Experimental results show that this method can effectively improve the accuracy and macro-average F1 score of abnormal traffic detection, especially showing significant gains in discriminating attack categories with sparse signals or requiring dual-branch cooperation. Attached Figure Description
[0014] Figure 1 This is an overall flowchart of the method of the present invention. Detailed Implementation
[0015] The present invention will now be described in further detail with reference to the accompanying drawings and specific embodiments.
[0016] Reference Figure 1 The implementation steps of this invention are as follows: Step 1, construct the training dataset: (1a) Obtain network traffic records and preprocess the traffic records.
[0017] Preprocessing includes: deduplicating completely duplicated stream records; calculating the inbound to outbound byte ratio, packet ratio, and throughput difference of stream records as new features to enrich the feature dimensions; performing one-hot encoding on category fields such as protocol type and application layer protocol; and finally, using the quadruple of source host, destination host, protocol type, and application layer protocol as a communication identifier, grouping stream records with the same communication identifier into the same communication group.
[0018] (1b) For the grouped traffic records, arrange them chronologically within each communication group and use a sliding window to extract a fixed-length sequence sample. Simultaneously, within each subset, establish adjacency relationships between flow records with the same communication identifier, constructing a graph structure. Nodes in the graph structure represent each flow record, and edges indicate that two flow records belong to the same communication session. Combine the constructed sequence samples with the graph structure data to form a pair of training samples, thus obtaining the training dataset. To avoid data leakage, the division of the training set, validation set, and test set is performed at the communication group level, ensuring that flow records within the same communication group do not cross subset boundaries.
[0019] Step 2: Construct an abnormal traffic detection model.
[0020] The abnormal traffic detection network model of the present invention includes a graph topology coding branch, a temporal feature extraction branch, and a gated cross-attention fusion module.
[0021] (2a) Graph topology coding module: The graph topology coding branch consists of two GraphSAGE convolutional layers and a first-channel attention module cascaded together. The graph convolutional layers aggregate neighbor node information and extract the communication topology relationships between stream records. The node feature matrix and graph edge indices are input into the graph topology coding branch, and after passing through two graph convolutional layers, the d-dimensional feature representation of each node is output. This feature representation is then input into the first-channel attention module for channel recalibration, and the weighted graph embedding vector is output.
[0022] (2b) Temporal feature extraction branch: The temporal feature extraction branch consists of multiple stacked temporal convolutional blocks (TCN blocks) and a second-channel attention module cascaded together. Each TCN block employs causal convolution and dilated convolution, with the dilation factor growing exponentially to expand the receptive field and capture long-range temporal dependencies. Traffic sequence samples are input into the temporal feature extraction branch, and after passing through the stacked TCN blocks, a three-dimensional feature of shape (B, d, T) is output, where B is the batch size, d is the number of channels, and T is the number of time steps. This three-dimensional feature is then input into the second-channel attention module for channel recalibration, outputting a weighted multi-time-step feature.
[0023] (2c) Both the first-channel attention module and the second-channel attention module are compression excitation (SE) modules: The compression excitation module is used to recalibrate the channels of the input features. The graph branch output is a node-wise one-dimensional vector, and the channel descriptor is the node feature. The temporal branch output is a three-dimensional feature. First, global average pooling is performed on the time dimension to compress the T time-step responses of each channel into a scalar, resulting in a d-dimensional channel descriptor. Channel attention performs two steps on the descriptor: activation and scaling. The activation phase involves... The descriptor is compressed from d-dimensional to m-dimensional, and then subjected to ReLU nonlinear activation. Restoring to d dimensions, the Sigmoid outputs a channel weight vector s, which is expressed by the following formula: in, h for d 3D channel descriptor, , These are the parameters for the compression layer and the recovery layer, respectively. It is the ReLU activation function. The activation function is Sigmoid. Two mapping layers form the bottleneck structure, with the intermediate dimension determined by the compression ratio. r Control. The scaling phase multiplies s with the original features to complete the recalibration. The graph branch then uses node features... With weight Multiplying element by element yields a weighted average. Its formula is expressed as follows: in, For element-wise multiplication, These are the weighted node features. In the time-series branch, the weights... The broadcast effect is applied to all time steps of the three-dimensional feature (B,d,T).
[0024] (2d) Gated cross-attention fusion module: The gated cross-attention fusion module includes a multi-head cross-attention unit, a residual connection unit, a temporal pooling unit, and a dimension-by-dimensional gated fusion unit.
[0025] The node embedding vectors output from the graph topology encoding branch and the multi-timestep features are input into the gated cross-attention fusion module.
[0026] Multi-head cross-attention unit: Graph embedding g is used as the query, and temporal features t are used as keys and values. The graph embedding is linearly projected to obtain the query, and the temporal features are projected as keys and values after layer normalization. The projection is performed independently by H attention heads, as expressed in the following formula: in, , , Let LN be the projection parameters for the h-th head, and LN be the layer normalization at the key end. Each head performs a scaled dot product attention operation, expressed by the following formula: The outputs of H heads are concatenated and linearly projected back to d-dimensional space: In the formula This is for outputting projection parameters.
[0027] Residual connection unit: The output 'a' of cross-attention is processed by a learnable scalar. After scaling, the result is added to the original residual g, and then normalized by layers to obtain the enhanced graph feature u, which is expressed by the following formula: in, For learnable scalar parameters, For the Sigmoid function, Initialized to 0.3.
[0028] Temporal pooling unit: Performs mean pooling on the temporal feature t along the time dimension, compressing T time steps into a single d-dimensional vector. After layer normalization, the time representation p after pooling is obtained, and its formula is as follows: Dimensionally Gated Fusion Unit: The enhanced graph feature u and the temporal representation p are concatenated along the feature dimension, and after being input into the fully connected layer, a gate vector is generated by the Sigmoid function. in, For gating parameters, For bias, This involves concatenating along the feature dimensions. The fused feature f is expressed by the following formula: in, This is an element-wise multiplication. The fused features f are linearly projected and normalized before being fed into the classification head to complete multi-class prediction.
[0029] Step 3: Train the abnormal traffic detection network model.
[0030] All training samples in the training dataset are input into the abnormal traffic detection network model. Focal Loss with class weights is used as the loss function, and the focusing parameter γ is 1.0. The parameters of the network are iteratively updated using gradient descent until the loss function converges, thus obtaining the trained abnormal traffic detection network model.
[0031] Step 4: Perform anomaly detection on network traffic.
[0032] The traffic data to be detected in the natural network environment is preprocessed in the same way as in step 1, and then input into the trained abnormal traffic detection network model. After processing by the model, the abnormal detection classification result is output.
[0033] The above description is merely one specific embodiment of the present invention and is not intended to limit the implementation of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.
[0034] As shown in Table 1, the method of this invention achieved an average accuracy of 95.59% on the NF-UNSW-NB15-v3 dataset, with an average F1 score of 85.62% across 10 macro classes. Specifically, the precision and recall for the Benign class both reached 100%, while the F1 scores for Generic, Reconnaissance, Exploits, and Fuzzers were all above 91%. This method also achieves effective detection results for sparse attack categories such as Backdoors, DoS, and Worms. Experimental results demonstrate that the proposed anomaly traffic detection method based on graph temporal dual-branch and gated cross-attention fusion effectively utilizes communication topology and temporal information, and achieves adaptive feature selection and fusion through channel attention and gated cross-attention mechanisms, significantly improving the performance of anomaly traffic detection.
[0035] Table 1. MAGCAN detection results for each category on NF-UNSW-NB15-v3 The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.
Claims
1. An abnormal traffic detection method based on graph temporal bi-branch gated attention, characterized in that, The method for constructing a training dataset and building an abnormal traffic detection network model includes the following steps: Step 1, construct the training dataset: (1a) Obtain network traffic records and preprocess the traffic records, including deduplication, feature construction and encoding, and grouping by communication identifier; (1b) Extract sequence samples from the grouped traffic records in chronological order using a sliding window, and construct a graph structure by establishing adjacency relationships between traffic records with the same communication identifier. Combine the sequence samples and the graph structure data to form training samples and obtain the training dataset. Step 2, construct the abnormal traffic detection network model: The network model includes a graph topology coding branch, a temporal feature extraction branch, and a gated cross-attention fusion module. The graph topology coding branch is used to extract the communication topology relationships between stream records and output node embedding vectors. The temporal feature extraction branch is used to extract the temporal sequence dependencies of stream records and output multi-time step features. The gated cross-attention fusion module uses the output of the graph topology coding branch as a query and the output of the temporal feature extraction branch as a key and value to perform multi-head cross-attention operations. After residual connection of the operation result with the original graph embedding, it performs dimension-wise gated fusion with the pooled temporal features to obtain fused features for final classification. Step 3: Train the abnormal traffic detection network model to obtain the trained abnormal traffic detection network model: Input all training samples in the training dataset into the abnormal traffic detection network model, and use the gradient descent method to iteratively update the network parameters until the loss function converges, thereby obtaining the trained abnormal traffic detection network model. Step 4: Perform anomaly detection on network traffic: The network traffic data to be detected is input into the trained abnormal traffic detection network model, and after processing, the abnormal detection classification result is obtained.
2. The abnormal flow detection method based on graph temporal dual-branch gated attention according to claim 1, characterized in that, The preprocessing in step (1a) specifically includes: deduplicating completely duplicated stream records; calculating the inbound to outbound byte ratio, packet ratio, and throughput difference of the stream records as new features; performing one-hot encoding on the category field; and using a quadruple of source host, destination host, protocol type, and application layer protocol as the communication identifier.
3. The abnormal flow detection method based on graph temporal dual-branch gated attention according to claim 1, characterized in that, The graph topology coding branch in step 2 consists of two GraphSAGE convolutional layers and a first-channel attention module connected in series; the temporal feature extraction branch consists of multiple stacked temporal convolutional blocks and a second-channel attention module connected in series; both the first-channel attention module and the second-channel attention module are compression activation modules.
4. The abnormal flow detection method based on graph temporal dual-branch gated attention according to claim 3, characterized in that, The compression activation module is used to recalibrate the channels of the input features. The compression activation module first performs global average pooling on the input features to obtain channel descriptors, and then processes the channel descriptors sequentially through a first fully connected layer, a ReLU activation function, a second fully connected layer, and a Sigmoid function to obtain a channel weight vector. Finally, the input features are multiplied element-wise by the channel weight vector to output the weighted features.
5. The abnormal flow detection method based on graph temporal dual-branch gated attention according to claim 1, characterized in that, The gated cross-attention fusion module includes a multi-head cross-attention unit, a residual connection unit, a temporal pooling unit, and a dimension-by-dimensional gated fusion unit. The multi-head cross-attention unit is used to obtain the query by linearly projecting the node embedding vector output by the graph topology coding branch, obtain the key and value by linearly projecting the multi-time step features output by the temporal feature extraction branch after layer normalization, perform multi-head scaling dot product attention operation, and output cross-attention features. The residual connection unit is used to add the cross-attention feature to the node embedding vector, and then output the enhanced graph feature after layer normalization; The temporal pooling unit is used to perform mean pooling on the multi-time-step features output by the temporal feature extraction branch along the time dimension, and after layer normalization, output the pooled temporal representation. The dimension-wise gated fusion unit is used to concatenate the enhanced graph features with the pooled temporal representation, input them into a fully connected layer, generate a gate vector through the Sigmoid function, and use the gate vector to perform element-wise weighted fusion of the enhanced graph features and the pooled temporal representation to obtain the fused features.
6. The abnormal flow detection method based on graph temporal dual-branch gated attention according to claim 5, characterized in that, The residual connection unit multiplies the cross-attention features by a learnable scaling factor before adding them to the node embedding vector.
7. The abnormal traffic detection method based on graph temporal dual-branch gated attention according to claim 1, characterized in that, The loss function in step 3 is Focal Loss with class weights.