DST-AttG: Network attack chain inference and situational forecasting with dynamic spatiotemporal attention coupled graph network

In response to the current challenges in network threat detection, such as complex attack features, incomplete attack chain inference, and insufficient situational forecasting accuracy, this paper proposes the DST-AttG model, which integrates dynamic spatiotemporal attention and graph convolutional networks for network threat node classification, attack chain inference, and situational forecasting tasks. The model uses dynamic spatiotemporal attention to capture the temporal evolution patterns and spatial correlation features of attack behaviors, combines the graph convolution layer to model network node topologies, leverages the temporal prediction module to predict attack trends, and employs the closed-loop feedback mechanism to dynamically correct prediction biases and optimize robustness. Experiments on the CTU-13 and UNSW-NB15 publicly available datasets demonstrate that the DST-AttG model outperforms comparison models in all tasks, while improving training and inference efficiency by 25%–50% compared to the second-best models, achieving a balance between detection accuracy and operational efficiency. Ablation experiments confirm the critical role of dynamic spatiotemporal attention and graph convolution layers in achieving the model’s high performance. The study shows that the DST-AttG model provides an effective solution for threat identification, tracing, and forecasting in network security, offering valuable technical references for the intelligent upgrade of defense systems.