Detecting Malicious Traffic Through Hypergraph Learning in Non-Terrestrial Internet of Things

The large number of devices and complex communication requirements pose challenges to ensuring the security of Non-Terrestrial Internet of Things (NT-IoT). The large-scale data and complex communication requirements make accurate detection of malicious traffic even more challenging in NT-IoT. Hypergraph neural networks have strong performance in extracting multi-relational features. However, most existing hypergraph neural networks are tailored for graph data, and hyperedge construction methods are not well-suited. To address these challenges, we propose a malicious encrypted traffic detection method based on a hypergraph neural network. First, we propose an efficient hypergraph construction method for encrypted traffic named JointKNN. JointKNN calculates the Euclidean distance between traffic flows and adds the target nodes into the neighbor sets to form the hyperedges. Then, we propose an Encrypted Traffic HyperGraph Convolution Network (ETHGCN), which takes the encrypted traffic hypergraph as the input. ETHGCN extracts and fuses both connection and temporal features to accurately detect malicious traffic. We conduct comparative experiments on IoT and Onion Network encrypted traffic datasets for multi-class and binary classification tasks. Results indicate that ETHGCN achieves an accuracy exceeding 99.8% in IoT tasks and demonstrates an improvement of nearly 20% in Onion Network tasks.