An Anomalous Traffic Detection Method Combining Stream Data Compression and Self-Supervised Graph Learning

XIA Jiqiang; ZHAO Jianjin; WANG Zihao; TIAN Le; HU Yuxiang; LI Menglong

doi:10.11999/JEIT260118

Article Contents

Article Navigation > Journal of Electronics & Information Technology > 2026 >

XIA Jiqiang, ZHAO Jianjin, WANG Zihao, TIAN Le, HU Yuxiang, LI Menglong. An Anomalous Traffic Detection Method Combining Stream Data Compression and Self-Supervised Graph Learning[J]. Journal of Electronics & Information Technology. doi: 10.11999/JEIT260118

Citation:

XIA Jiqiang, ZHAO Jianjin, WANG Zihao, TIAN Le, HU Yuxiang, LI Menglong. An Anomalous Traffic Detection Method Combining Stream Data Compression and Self-Supervised Graph Learning[J]. Journal of Electronics & Information Technology. doi: 10.11999/JEIT260118

Citation:

XIA Jiqiang, ZHAO Jianjin, WANG Zihao, TIAN Le, HU Yuxiang, LI Menglong. An Anomalous Traffic Detection Method Combining Stream Data Compression and Self-Supervised Graph Learning[J]. Journal of Electronics & Information Technology. doi: 10.11999/JEIT260118

PDF( 2438 KB)

An Anomalous Traffic Detection Method Combining Stream Data Compression and Self-Supervised Graph Learning

doi: 10.11999/JEIT260118 cstr: 32379.14.JEIT260118

XIA Jiqiang¹,
ZHAO Jianjin²,
WANG Zihao¹,
TIAN Le^{1, 3, 4},
HU Yuxiang^{1, 3, 4
,
,},
LI Menglong^{1, 3, 4}

1.
Information Engineering University, Zhengzhou 450002, China
2.
Jiangsu Police Institute, Nanjing 210013, China
3.
Key Laboratory of Cyberspace Endogenous Safety & Security of Henan Province, Zhengzhou 450001, China
4.
Key Laboratory of Cyberspace Security Ministry of Education, Zhengzhou 450001, China

Received Date: 2026-01-13
Accepted Date: 2026-07-28
Rev Recd Date: 2026-07-17

Available Online: 2026-08-07

Abstract

Abstract

Objective With the continuous growth of network traffic scale and the increasing sophistication of attack methods, efficient and intelligent anomalous traffic detection has become essential for protecting critical information infrastructure. However, existing detection methods still face severe challenges when deployed in large-scale networks. On one hand, the analysis of raw packet sequences and deep learning-based end-to-end models incurs substantial computation and storage overhead, which is unaffordable in line-rate processing scenarios. On the other hand, flow records are usually treated as independent samples, and the topological structure and context information of inter-host communications are ignored, resulting in the lack of a global view when distributed and correlated threats are handled. Moreover, supervised learning schemes rely heavily on large amounts of labeled data, which can hardly be satisfied in practical deployment and weakens the generalization ability against unknown threats. Therefore, it is of great significance to develop an anomalous traffic detection method that supports efficient flow feature extraction under limited resources and achieves high-precision detection without relying on labeled data. Methods In the training phase, the graph encoder takes both the original communication graph and augmented negative samples as inputs to learn edge embeddings. The encoder outputs these embeddings to a discriminator. The discriminator estimates mutual information by contrasting edge embeddings of positive and negative samples against a global graph summary. The training objective maximizes scores for positive samples while minimizing them for negative ones. Through this self-supervised optimization, the encoder parameters are refined to enhance the discriminative power of edge embeddings. This iterative process continues until convergence via gradient descent. After training, the encoder parameters are fixed. The resulting edge embeddings then serve downstream anomaly detection tasks. In the inference phase, the feature extractor converts traffic into a communication graph. The trained graph encoder then generates corresponding edge embeddings. A lightweight classifier takes these embeddings as input for end-to-end anomaly detection, producing the final classification results. Results and Discussions Comprehensive experiments are conducted on four public datasets, i.e., CAIDA, CIC-IDS2018, UNSW-NB15, and TON-IoT. For feature extraction, under identical memory configurations, the average relative error (ARE) and per-flow weighted mean relative error (WMRE) of counter-type features measured by the optimized MFSketch are reduced by 31.5% and 31.0% on average compared with the fixed-structure baseline, and those of bitmap-type features are reduced by 36.1% and 34.9%, respectively (Fig. 4). Meanwhile, high throughput is maintained on datasets with different traffic skewness, and an average of about 12Mpps is reached on the CAIDA dataset (Fig. 4(c)). For detection accuracy, SketchGNN combined with PCA, HBOS, or IF stably achieves an accuracy no lower than 95.2%, a macro-F1 no lower than 90.1, and a weighted-F1 no lower than 96.7 on CIC-IDS2018 and UNSW-NB15, which outperforms Kitsune, Whisper, Anomal-E, and TS-IDS, whose accuracy either stays below 90% or fluctuates sharply across datasets (Fig. 5, Fig. 6). For detection efficiency, HBOS provides the most stable and highest throughput among the three classifiers (Fig. 7(a)), and the end-to-end packet-level equivalent throughput of SketchGNN reaches 640Kpps, which is about 17 times that of Kitsune (37Kpps) and is comparable in magnitude to the DPDK-accelerated Whisper (1.3Mpps) (Fig. 7(b)). In addition, the performance variation across different datasets is kept within 3%, demonstrating robust generalization to normal traffic fluctuations and diverse flow-level anomalous behaviors. Conclusions To address the challenges of high feature-extraction overhead, limited utilization of traffic context, and heavy reliance on labeled data, this paper proposes SketchGNN, an anomaly detection framework that integrates flow data compression with self-supervised graph learning. MFSketch, a dynamically configurable sketch, efficiently extracts and accurately measures diverse flow features under limited resources. Self-supervised graph neural networks then model host communication graphs and learn representations, enabling efficient anomaly detection without labeled data. Experimental results show that MFSketch can dynamically optimize its data structure based on traffic distribution, ensuring high-throughput, high-precision feature inputs for downstream detection tasks. The edge embeddings generated via graph-based self-supervised learning achieve higher detection accuracy across various unsupervised classifiers compared to baseline methods. The future work will further explore hybrid detection mechanisms that combine Deep Packet Inspection with programmable data planes to further enhance the ability to identify anomalous traffic at the application layer.
- Anomalous Traffic Detection,
- Graph Neural Networks,
- Streaming Data Compression,
- Self-Supervised Learning

FullText(HTML)

References(19)

References

[1]	胡钰林, 喻鑫岚, 高伟, 等. 低时延工业物联网中移动边缘计算的安全性与可靠性联合优化[J]. 电子与信息学报, 2025, 47(10): 3492–3504. doi: 10.11999/JEIT250262. HU Yulin, YU Xinlan, GAO Wei, et al. Security and reliability-optimal offloading for mobile edge computing in low-latency industrial IoT[J]. Journal of Electronics & Information Technology, 2025, 47(10): 3492–3504. doi: 10.11999/JEIT250262.
[2]	ERLACHER F and DRESSLER F. On high-speed flow-based intrusion detection using Snort-compatible signatures[J]. IEEE Transactions on Dependable and Secure Computing, 2022, 19(1): 495–506. doi: 10.1109/TDSC.2020.2973992.
[3]	TUDOSI A D, GRAUR A, BALAN D G, et al. Distributed firewall traffic filtering and intrusion detection using Snort on pfSense firewalls with random forest classification[C]. 2023 46th International Conference on Telecommunications and Signal Processing (TSP), Prague, Czech Republic, 2023: 101–104. doi: 10.1109/TSP59544.2023.10197784.
[4]	RESENDE P A A and DRUMMOND A C. A survey of random forest based methods for intrusion detection systems[J]. ACM Computing Surveys, 2019, 51(3): 48. doi: 10.1145/3178582.
[5]	MIRSKY Y, DOITSHMAN T, ELOVICI Y, et al. Kitsune: An ensemble of autoencoders for online network intrusion detection[C]. 25th Annual Network and Distributed System Security Symposium, San Diego, USA, 2018https://arxiv.org/abs/1802.09089, 2018.
[6]	FU Chuanpu, LI Qi, SHEN Meng, et al. Frequency domain feature based robust malicious traffic detection[J]. IEEE/ACM Transactions on Networking, 2023, 31(1): 452–467. doi: 10.1109/TNET.2022.3195871.
[7]	KHALID M, MOHSIN A R, ALI J, et al. Optimization of recurrent neural networks for high-performance intrusion detection in network traffic[J]. Cluster Computing, 2025, 28(9): 563. doi: 10.1007/s10586-025-05240-0.
[8]	顾伟, 行鸿彦, 侯天浩. 基于网络流量时空特征和自适应加权系数的异常流量检测方法[J]. 电子与信息学报, 2024, 46(6): 2647–2654. doi: 10.11999/JEIT230825. GU Wei, XING Hongyan, and HOU Tianhao. Abnormal traffic detection method based on traffic spatial-temporal features and adaptive weighting coefficients[J]. Journal of Electronics & Information Technology, 2024, 46(6): 2647–2654. doi: 10.11999/JEIT230825.
[9]	HSIEH K, WONG M, SEGARRA S, et al. NetVigil: Robust and low-cost anomaly detection for east-west data center security[C]. 21st USENIX Symposium on Networked Systems Design and Implementation, Santa Clara, USA, 2024: 1771–1789.
[10]	尹梓诺, 陈鸿昶, 马海龙, 等. 无监督自适应抽样与改进孪生网络结合的网络流量异常检测方法[J]. 电子与信息学报, 2025, 47(7): 2211–2224. doi: 10.11999/JEIT241115. YIN Zinuo, CHEN Hongchang, MA Hailong, et al. A network traffic anomaly detection method integrating unsupervised adaptive sampling with enhanced Siamese network[J]. Journal of Electronics & Information Technology, 2025, 47(7): 2211–2224. doi: 10.11999/JEIT241115.
[11]	HAN Hui, YAN Zheng, JING Xuyang, et al. Applications of sketches in network traffic measurement: A survey[J]. Information Fusion, 2022, 82: 58–85. doi: 10.1016/j.inffus.2021.12.007.
[12]	LI Yuanpeng, NIU Xian, ZHAO Yikai, et al. TitanLog: Hierarchical and elastic logging for high-speed network data stream[J]. IEEE Transactions on Networking, 2026, 34: 1988–2003. doi: 10.1109/TON.2025.3636509.
[13]	YUAN Ziqi, SUN Qingyun, ZHOU Haoyi, et al. A comprehensive survey on GNN-based anomaly detection: Taxonomy, methods, and the role of large language models[J]. International Journal of Machine Learning and Cybernetics, 2025, 16(7/8): 4407–4432. doi: 10.1007/s13042-024-02516-6.
[14]	MA Jie, SU Wei, LI Yikun, et al. Synchronizing DDoS detection and mitigation based graph learning with programmable data plane, SDN[J]. Future Generation Computer Systems, 2024, 154: 206–218. doi: 10.1016/j.future.2023.12.033.
[15]	LO W W, LAYEGHY S, SARHAN M, et al. E-GraphSAGE: A graph neural network based intrusion detection system[J/OL]. https://arxiv.org/abs/2103.16329v1, 2021. doi: 10.48550/arXiv.2103.16329.
[16]	VELIČKOVIĆ P, FEDUS W, HAMILTON W L, et al. Deep Graph Infomax[C]. 7th International Conference on Learning Representations, New Orleans, USA, 2019.
[17]	CAVILLE E, LO W W, LAYEGHY S, et al. Anomal-E: A self-supervised network intrusion detection system based on graph neural networks[J]. Knowledge-Based Systems, 2022, 258: 110030. doi: 10.1016/j.knosys.2022.110030.
[18]	LIU Jiaqian, BASAT R B, WARDT L D, et al. DISCO: A dynamically configurable sketch framework in skewed data streams[C]. 2024 IEEE 40th International Conference on Data Engineering, Utrecht, Netherlands, 2024: 4801–4814. doi: 10.1109/ICDE60146.2024.00365.
[19]	NGUYEN H and KASHEF R. TS-IDS: Traffic-aware self-supervised learning for IoT network intrusion detection[J]. Knowledge-Based Systems, 2023, 279: 110966. doi: 10.1016/j.knosys.2023.110966.