An Anomalous Traffic Detection Method Integrating Flow Data Compression and Self-supervised Graph Learning

XIA Jiqiang; ZHAO Jianjin; WANG Zihao; TIAN Le; HU Yuxiang; LI Menglong

doi:10.11999/JEIT260118

Article Contents

Article Navigation > Journal of Electronics & Information Technology > 2026 >

XIA Jiqiang, ZHAO Jianjin, WANG Zihao, TIAN Le, HU Yuxiang, LI Menglong. An Anomalous Traffic Detection Method Integrating Flow Data Compression and Self-supervised Graph Learning[J]. Journal of Electronics & Information Technology. doi: 10.11999/JEIT260118

Citation:

XIA Jiqiang, ZHAO Jianjin, WANG Zihao, TIAN Le, HU Yuxiang, LI Menglong. An Anomalous Traffic Detection Method Integrating Flow Data Compression and Self-supervised Graph Learning[J]. Journal of Electronics & Information Technology. doi: 10.11999/JEIT260118

Citation:

XIA Jiqiang, ZHAO Jianjin, WANG Zihao, TIAN Le, HU Yuxiang, LI Menglong. An Anomalous Traffic Detection Method Integrating Flow Data Compression and Self-supervised Graph Learning[J]. Journal of Electronics & Information Technology. doi: 10.11999/JEIT260118

PDF( 2732 KB)

An Anomalous Traffic Detection Method Integrating Flow Data Compression and Self-supervised Graph Learning

doi: 10.11999/JEIT260118 cstr: 32379.14.JEIT260118

XIA Jiqiang¹,
ZHAO Jianjin²,
WANG Zihao¹,
TIAN Le^{1, 3, 4},
HU Yuxiang^{1, 3, 4
,
,},
LI Menglong^{1, 3, 4}

1.
Information Engineering University, Zhengzhou 450001, China
2.
Jiangsu Police Institute, Nanjing 210031, China
3.
Key Laboratory of Cyberspace Endogenous Safety & Security of Henan Province, Zhengzhou 450001, China
4.
Key Laboratory of Cyberspace Security Ministry of Education, Zhengzhou 450001, China

Received Date: 2026-01-30
Accepted Date: 2026-07-28
Rev Recd Date: 2026-07-24

Available Online: 2026-08-07

Abstract

Abstract

Objective As network traffic volumes continue to grow and attack methods become increasingly sophisticated, efficient and intelligent anomalous traffic detection is essential for protecting critical information infrastructure. However, existing detection methods still face substantial challenges in large-scale network environments. On one hand, analyzing raw packet sequences and using deep learning-based end-to-end models incur considerable computational and storage overhead, making them difficult to deploy in line-rate processing scenarios. On the other hand, flow records are usually treated as independent samples, while the topological structure and contextual information of inter-host communications are often ignored. This limitation makes it difficult to detect distributed and correlated threats from a global perspective. In addition, supervised learning methods rely heavily on large amounts of labeled data, which are difficult to obtain in practical deployments and limit generalization to unknown threats. Therefore, an anomalous traffic detection method that supports efficient flow feature extraction under limited resources and enables accurate detection without labeled data is needed. Methods During training, the original communication graph and augmented negative samples are simultaneously input into a graph encoder to learn edge embeddings. The resulting embeddings are then fed into a discriminator. Mutual information scores are estimated by contrasting the edge embeddings of positive and negative samples with a global graph summary. The training objective is to maximize the scores of positive samples and minimize those of negative samples. Through this self-supervised optimization, the encoder parameters are refined to improve the discriminative capability of the edge embeddings. The process is iterated using gradient descent until convergence. After training, the encoder parameters are fixed, and the resulting edge embeddings are used for downstream anomalous traffic detection. During inference, traffic is converted into a communication graph by the feature extractor and then fed into the trained graph encoder to generate the corresponding edge embeddings. A lightweight classifier takes these embeddings as input to perform end-to-end anomalous traffic detection and output the final classification results. Results and Discussions Comprehensive experiments are conducted on four public datasets, namely CAIDA, CIC-IDS2018, UNSW-NB15, and TON-IoT. For feature extraction, under identical memory configurations, the Average Relative Error (ARE) and per-flow Weighted Mean Relative Error (WMRE) of counter features measured by MFSketch-OP are reduced by 31.5% and 31.0%, respectively, compared with the baseline MFSketch with a fixed structure. For bitmap features, the corresponding reductions are 36.1% and 34.9%, respectively (Fig. 4). High throughput is maintained across datasets with different degrees of traffic skewness, with an average throughput of approximately 12 Mpps achieved on CAIDA (Fig. 4(c)). For detection accuracy, when combined with Principal Component Analysis (PCA), Histogram-Based Outlier Score (HBOS), or Isolation Forest (IF), SketchGNN consistently achieves an accuracy of at least 95.2%, a macro-F1 score of at least 90.1%, and a weighted-F1 score of at least 96.7% on CIC-IDS2018 and UNSW-NB15. These results generally outperform the baseline methods and show more stable performance across datasets (Figs. 5 and 6). For detection efficiency, HBOS provides high and stable throughput among the three classifiers (Fig. 7(a)). The end-to-end packet-level equivalent throughput of SketchGNN reaches 640 kpps, approximately 17 times that of Kitsune (37 kpps), and is comparable in magnitude to that of Whisper accelerated by the Data Plane Development Kit (DPDK) (1.3 Mpps) (Fig. 7(b)). In addition, the performance variation across different datasets remains within 3%, indicating robust generalization to normal traffic fluctuations and diverse flow-level anomalous behaviors. Conclusions To address the high overhead of feature extraction, insufficient use of traffic context, and strong dependence on labeled data in existing anomalous traffic detection methods, SketchGNN, an anomalous traffic detection framework integrating flow data compression with self-supervised graph learning, is proposed. A dynamically configurable sketch, MFSketch, is used to efficiently extract and accurately measure diverse flow features under limited resource constraints. A self-supervised graph neural network is then used to model host communication graphs and learn traffic representations, enabling efficient anomalous traffic detection without labeled data. Experimental results show that MFSketch dynamically optimizes its data structure according to traffic distribution and provides high-throughput and high-precision feature inputs for downstream detection. The edge embeddings generated through self-supervised graph learning achieve higher detection accuracy than the baseline methods when combined with different unsupervised classifiers. In future work, hybrid detection mechanisms that combine Deep Packet Inspection (DPI) with programmable data planes will be explored to further improve the detection of application-layer anomalous traffic.
- Anomalous traffic detection,
- Graph Neural Networks(GNN),
- Flow data compression,
- Self-supervised learning

FullText(HTML)

References(19)

References

[1]	胡钰林, 喻鑫岚, 高伟, 等. 低时延工业物联网中移动边缘计算的安全性与可靠性联合优化[J]. 电子与信息学报, 2025, 47(10): 3492–3504. doi: 10.11999/JEIT250262. HU Yulin, YU Xinlan, GAO Wei, et al. Security and reliability-optimal offloading for mobile edge computing in low-latency industrial IoT[J]. Journal of Electronics & Information Technology, 2025, 47(10): 3492–3504. doi: 10.11999/JEIT250262.
[2]	ERLACHER F and DRESSLER F. On high-speed flow-based intrusion detection using Snort-compatible signatures[J]. IEEE Transactions on Dependable and Secure Computing, 2022, 19(1): 495–506. doi: 10.1109/TDSC.2020.2973992.
[3]	TUDOSI A D, GRAUR A, BALAN D G, et al. Distributed firewall traffic filtering and intrusion detection using Snort on pfSense firewalls with random forest classification[C]. 2023 46th International Conference on Telecommunications and Signal Processing (TSP), Prague, Czech Republic, 2023: 101–104. doi: 10.1109/TSP59544.2023.10197784.
[4]	RESENDE P A A and DRUMMOND A C. A survey of random forest based methods for intrusion detection systems[J]. ACM Computing Surveys, 2019, 51(3): 48. doi: 10.1145/3178582.
[5]	MIRSKY Y, DOITSHMAN T, ELOVICI Y, et al. Kitsune: An ensemble of autoencoders for online network intrusion detection[C]. 25th Annual Network and Distributed System Security Symposium, San Diego, USA, 2018https://arxiv.org/abs/1802.09089, 2018.
[6]	FU Chuanpu, LI Qi, SHEN Meng, et al. Frequency domain feature based robust malicious traffic detection[J]. IEEE/ACM Transactions on Networking, 2023, 31(1): 452–467. doi: 10.1109/TNET.2022.3195871.
[7]	KHALID M, MOHSIN A R, ALI J, et al. Optimization of recurrent neural networks for high-performance intrusion detection in network traffic[J]. Cluster Computing, 2025, 28(9): 563. doi: 10.1007/s10586-025-05240-0.
[8]	顾伟, 行鸿彦, 侯天浩. 基于网络流量时空特征和自适应加权系数的异常流量检测方法[J]. 电子与信息学报, 2024, 46(6): 2647–2654. doi: 10.11999/JEIT230825. GU Wei, XING Hongyan, and HOU Tianhao. Abnormal traffic detection method based on traffic spatial-temporal features and adaptive weighting coefficients[J]. Journal of Electronics & Information Technology, 2024, 46(6): 2647–2654. doi: 10.11999/JEIT230825.
[9]	HSIEH K, WONG M, SEGARRA S, et al. NetVigil: Robust and low-cost anomaly detection for east-west data center security[C]. 21st USENIX Symposium on Networked Systems Design and Implementation, Santa Clara, USA, 2024: 1771–1789.
[10]	尹梓诺, 陈鸿昶, 马海龙, 等. 无监督自适应抽样与改进孪生网络结合的网络流量异常检测方法[J]. 电子与信息学报, 2025, 47(7): 2211–2224. doi: 10.11999/JEIT241115. YIN Zinuo, CHEN Hongchang, MA Hailong, et al. A network traffic anomaly detection method integrating unsupervised adaptive sampling with enhanced Siamese network[J]. Journal of Electronics & Information Technology, 2025, 47(7): 2211–2224. doi: 10.11999/JEIT241115.
[11]	HAN Hui, YAN Zheng, JING Xuyang, et al. Applications of sketches in network traffic measurement: A survey[J]. Information Fusion, 2022, 82: 58–85. doi: 10.1016/j.inffus.2021.12.007.
[12]	LI Yuanpeng, NIU Xian, ZHAO Yikai, et al. TitanLog: Hierarchical and elastic logging for high-speed network data stream[J]. IEEE Transactions on Networking, 2026, 34: 1988–2003. doi: 10.1109/TON.2025.3636509.
[13]	YUAN Ziqi, SUN Qingyun, ZHOU Haoyi, et al. A comprehensive survey on GNN-based anomaly detection: Taxonomy, methods, and the role of large language models[J]. International Journal of Machine Learning and Cybernetics, 2025, 16(7/8): 4407–4432. doi: 10.1007/s13042-024-02516-6.
[14]	MA Jie, SU Wei, LI Yikun, et al. Synchronizing DDoS detection and mitigation based graph learning with programmable data plane, SDN[J]. Future Generation Computer Systems, 2024, 154: 206–218. doi: 10.1016/j.future.2023.12.033.
[15]	LO W W, LAYEGHY S, SARHAN M, et al. E-GraphSAGE: A graph neural network based intrusion detection system[J/OL]. https://arxiv.org/abs/2103.16329v1, 2021. doi: 10.48550/arXiv.2103.16329.
[16]	VELIČKOVIĆ P, FEDUS W, HAMILTON W L, et al. Deep Graph Infomax[C]. 7th International Conference on Learning Representations, New Orleans, USA, 2019.
[17]	CAVILLE E, LO W W, LAYEGHY S, et al. Anomal-E: A self-supervised network intrusion detection system based on graph neural networks[J]. Knowledge-Based Systems, 2022, 258: 110030. doi: 10.1016/j.knosys.2022.110030.
[18]	LIU Jiaqian, BASAT R B, WARDT L D, et al. DISCO: A dynamically configurable sketch framework in skewed data streams[C]. 2024 IEEE 40th International Conference on Data Engineering, Utrecht, Netherlands, 2024: 4801–4814. doi: 10.1109/ICDE60146.2024.00365.
[19]	NGUYEN H and KASHEF R. TS-IDS: Traffic-aware self-supervised learning for IoT network intrusion detection[J]. Knowledge-Based Systems, 2023, 279: 110966. doi: 10.1016/j.knosys.2023.110966.