Extracting Spatiotemporal Features For Detecting the Beginning of a Network Layer Attack with a Graph Neural Autoencoder and Deep Metric Learning

Detection and mitigation of ongoing network layer attacks from real-time network traffic data is essential for normal operations and availability of the interconnected devices in a network. Our study focuses on detecting the presence of network layer attacks from simultaneously available network flow data using a model that utilizes Graph Neural Networks (GNN), Long Short-Term Memory (LSTM), deep metric learning, and Support Vector Machine (SVM). The GNN-LSTM model extracts spatiotemporal features from network traffic segments. A deep metric learning method is utilized to enhance the differentiation between normal and attack traffic data, which are then classified using SVM. The proposed approach outperforms the existing machine learning models on a publicly available dataset, which shows the effectiveness of the GNN-LSTM model in detecting network layer attacks.