Real-Time Graph Neural Network for Malicious Traffic Detection

Graph neural networks (GNNs) have been recently proposed as powerful tools for detecting cyberattacks, addressing the challenges in cybersecurity as traditional methods fail to keep up with the complexity and scale of modern threats. However, a solution that effectively balances performance, scalability, and practical usability in real-time scenarios is still lacking. Hence, in this work we propose a real-time GNN framework designed to detect malicious traffic with high speed and accuracy. To achieve this, network traffic is mapped onto a graph, with its properties optimized through experimental analysis. The framework is designed to balance accuracy and computational efficiency, addressing the scalability issues commonly encountered in real-time applications. This balance is reflected in the model’s ability to achieve an F1 score of 0.9 or higher with a classification window starting from 100 packets. Furthermore, the proposed model is compared against a state-of-the-art approach, highlighting its strengths in terms of inference speed and detection performance. Additionally, a scalability-accuracy analysis shows that accurate detection can be achieved with as few as 50-75 packets for certain attack types, proving the feasibility of the approach in real-time scenarios.