DyGCN: Dynamic Graph Convolution Network-based Anomaly Network Traffic Detection

Traditional abnormal network traffic detection methods only consider statistical features and ignore structural relationships, which makes them difficult to detect advanced attacks. In this paper, we propose DyGCN(Dynamic Graph Convolution Network) for anomaly network traffic detection. Firstly, we represent the network at a given time with a graph using hosts as nodes and construct a graph stream according to the dynamic network. We propose a dynamic graph model with structural learning and temporal learning for hosts. Secondly, we put forward a normal traffic pattern-based contrastive learning method by analyzing the structural characteristics of normal traffic. Thirdly, we obtain the graph representation with edge anomaly probability-based graph embedding method to mine the anomalous substructures in the graph. Finally, we use an anomaly detection model to judge the anomaly of the current network. Experimental results on two datasets demonstrate that DyGCN outperforms traditional anomaly detection methods and state-of-the-art dynamic graph embedding methods.