Dynamic Malicious Encrypted Traffic Detection via Temporal Knowledge Graph in Cloud-Edge Networks
Year: 2026
Type: conference-paper
Abstract: Traditional centralized security is inadequate for Cloud-Edge Networks, where massive distributed traffic and widespread protocol encryption create severe security blind spots. Continuous monitoring of network traffic is essential to identify malicious encrypted activities such as lateral movement and zero-day attacks. Existing graph-based detection methods typically model network flows as static graphs, which fail to capture the temporal dynamics of traffic patterns and face severe scalability bottlenecks when processing massive streaming data at resource-constrained edge nodes. Furthermore, supervised models heavily rely on exhaustive labeled datasets that are impractical to maintain in highly dynamic environments. To address these limitations, we propose TKG-ETA, a self-supervised Temporal Knowledge Graph (TKG) neural network equipped with an adaptive sketch mechanism for dynamic Encrypted Traffic Analysis in cloud-edge networks. We utilize a dynamically configurable sketch algorithm to efficiently compress and extract multi-dimensional statistical features from massive streaming traffic with minimal memory overhead, entirely bypassing payload inspection. These features are continuously transformed into a lightweight streaming TKG to model the fine-grained communication relations among network entities over time. Based on this temporal structure, we design a self-supervised time-aware message-passing mechanism to autonomously learn the evolutionary trajectories of normal encrypted traffic patterns without manual annotations. By capturing structural and temporal deviations, the proposed model accurately identifies malicious encrypted traffic. Extensive experiments on real-world network traffic datasets demonstrate that TKG-ETA achieves superior detection accuracy with an weighted F1 score exceeding 96% while maintaining the high throughput and low resource overhead imperative for cloud-edge collaborative deployment.
Language: English
Subfield: Computer Networks and Communications
Field: Computer Science
Domain: Physical Sciences
Open Access status: hybrid
OpenAlex ID: W7204234178