{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,1,5]],"date-time":"2026-01-05T22:29:42Z","timestamp":1767652182808,"version":"3.44.0"},"reference-count":40,"publisher":"Association for Computing Machinery (ACM)","issue":"4","funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"crossref","award":["62172194, 62202206 and U1836116"],"award-info":[{"award-number":["62172194, 62202206 and U1836116"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"crossref"}]},{"name":"Natural Science Foundation of Jiangsu Province, China","award":["BK20220515"],"award-info":[{"award-number":["BK20220515"]}]},{"DOI":"10.13039\/501100002858","name":"China Postdoctoral Science Foundation, China","doi-asserted-by":"crossref","award":["2021M691310"],"award-info":[{"award-number":["2021M691310"]}],"id":[{"id":"10.13039\/501100002858","id-type":"DOI","asserted-by":"crossref"}]},{"name":"Qinglan Project of Jiangsu Province, China"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Trans. Priv. Secur."],"published-print":{"date-parts":[[2025,11,30]]},"abstract":"<jats:p>Detecting malicious network traffic in large-scale, dynamic environments presents a significant challenge due to the complexity of network relationships and the evolving nature of cyber threats. Existing graph-based and sequence-based models often fail to capture both spatial dependencies and temporal patterns effectively, resulting in suboptimal detection. This study introduces the Multi-view Graph Adaptive Network (MGAN), a novel framework that integrates multi-hop graph neural network (GNN) aggregation with transformer-based sequence modeling to address these challenges. MGAN captures long-range spatial dependencies and temporal dynamics in network traffic, enabling the detection of complex attack patterns. It incorporates Dirichlet sampling for robust neighbor selection in sparse and noisy data environments and mutual information maximization to align multi-view representations for consistency. Additionally, a multi-view attention mechanism aggregates information across different hops, balancing local and global network context. Extensive experiments on four real-world datasets demonstrate MGAN\u2019s superiority over 7 baseline models, achieving an average F1-Score above 97%, surpassing the best baseline by 2.35%. MGAN maintains detection accuracy above 97% and remains robust under data sparsity, achieving F1-Scores over 95% even when 40% of connectivity information is removed. Under noisy conditions, MGAN retains accuracy above 93%, outperforming baselines by over 4.5%. In zero-day attack scenarios, it achieves detection rates exceeding 96% for previously unseen attack categories. MGAN also exhibits exceptional computational efficiency, processing 2,034 samples per second with a detection time of 3.00 milliseconds per sample, outperforming all competing models in both accuracy and speed.<\/jats:p>","DOI":"10.1145\/3757741","type":"journal-article","created":{"date-parts":[[2025,7,31]],"date-time":"2025-07-31T06:36:13Z","timestamp":1753943773000},"page":"1-35","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":2,"title":["MGAN: A Multi-view Graph Adaptive Network for Robust Malicious Traffic Detection"],"prefix":"10.1145","volume":"28","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-2540-3861","authenticated-orcid":false,"given":"Ernest","family":"Akpaku","sequence":"first","affiliation":[{"name":"School of Computer Science and Communication Engineering, Jiangsu University","place":["Zhenjiang, China"]}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3124-5452","authenticated-orcid":false,"given":"Jinfu","family":"Chen","sequence":"additional","affiliation":[{"name":"School of Computer Science and Communication Engineering, Jiangsu University","place":["Zhenjiang, China"]},{"name":"Jiangsu Key Laboratory of Security Technology for Industrial Cyberspace","place":["Zhenjiang, China"]}]},{"ORCID":"https:\/\/orcid.org\/0009-0000-0167-5593","authenticated-orcid":false,"given":"Mukhtar","family":"Ahmed","sequence":"additional","affiliation":[{"name":"School of Computer Science and Communication Engineering, Jiangsu University","place":["Zhenjiang, China"]}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-0569-2985","authenticated-orcid":false,"given":"Francis","family":"Agbenyegah","sequence":"additional","affiliation":[{"name":"Department of Information Technology, Ghana Communication Technology University","place":["Accra, Ghana"]}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7566-9989","authenticated-orcid":false,"given":"Joshua","family":"Ofoeda","sequence":"additional","affiliation":[{"name":"Department of information technology, University of Professional Studies","place":["Legon, Ghana"]}]}],"member":"320","published-online":{"date-parts":[[2025,9,11]]},"reference":[{"key":"e_1_3_1_2_2","doi-asserted-by":"publisher","DOI":"10.1007\/s11694-021-00878-x"},{"key":"e_1_3_1_3_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2025.111184"},{"key":"e_1_3_1_4_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2021.102542"},{"key":"e_1_3_1_5_2","doi-asserted-by":"publisher","DOI":"10.1155\/2021\/7367107"},{"key":"e_1_3_1_6_2","doi-asserted-by":"publisher","DOI":"10.1145\/3690637"},{"key":"e_1_3_1_7_2","doi-asserted-by":"crossref","DOI":"10.14722\/ndss.2021.24067","article-title":"FlowLens: Enabling efficient flow classification for ML-based network security applications","author":"Barradas Diogo","year":"2021","unstructured":"Diogo Barradas, Nuno Santos, Lu\u00eds Rodrigues, Salvatore Signorello, Fernando M. V. Ramos, and Andr\u00e9 Madeira. 2021. FlowLens: Enabling efficient flow classification for ML-based network security applications. Proceedings 2021 Network and Distributed System Security Symposium (2021). Retrieved from https:\/\/api.semanticscholar.org\/CorpusID:231590874","journal-title":"Proceedings 2021 Network and Distributed System Security Symposium"},{"key":"e_1_3_1_8_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.infsof.2023.107166"},{"key":"e_1_3_1_9_2","doi-asserted-by":"publisher","DOI":"10.1177\/0926227X251326282"},{"key":"e_1_3_1_10_2","doi-asserted-by":"publisher","DOI":"10.1109\/TAI.2023.3241896"},{"key":"e_1_3_1_11_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2024.104083"},{"key":"e_1_3_1_12_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.aei.2024.102357"},{"key":"e_1_3_1_13_2","volume-title":"29th Annual Network and Distributed System Security Symposium, NDSS 2022, San Diego, California, USA, April 24-28, 2022","author":"King Isaiah J.","year":"2022","unstructured":"Isaiah J. King and H. Howie Huang. 2022. Euler: Detecting network lateral movement via scalable temporal graph link prediction. In 29th Annual Network and Distributed System Security Symposium, NDSS 2022, San Diego, California, USA, April 24-28, 2022. The Internet Society."},{"key":"e_1_3_1_14_2","doi-asserted-by":"publisher","DOI":"10.1109\/TNET.2024.3370851"},{"key":"e_1_3_1_15_2","doi-asserted-by":"publisher","DOI":"10.1145\/3669906"},{"key":"e_1_3_1_16_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.artint.2022.103708"},{"key":"e_1_3_1_17_2","doi-asserted-by":"publisher","unstructured":"Yisroel Mirsky Tomer Doitshman Yuval Elovici and Asaf Shabtai. 2018. Kitsune: An ensemble of autoencoders for online network intrusion detection. In Proceedings of the Network and Distributed System Security (NDSS) Symposium (NDSS\u201918). Internet Society San Diego CA USA. DOI:10.14722\/ndss.2018.23204","DOI":"10.14722\/ndss.2018.23204"},{"key":"e_1_3_1_18_2","doi-asserted-by":"publisher","DOI":"10.1145\/3460120.3484585"},{"key":"e_1_3_1_19_2","doi-asserted-by":"publisher","DOI":"10.1145\/3460120.3484758"},{"key":"e_1_3_1_20_2","first-page":"6203","volume-title":"32nd USENIX Security Symposium (USENIX Security 23)","author":"Zhou Guangmeng","year":"2023","unstructured":"Guangmeng Zhou, Zhuotao Liu, Chuanpu Fu, Qi Li, and Ke Xu. 2023. An Efficient Design of Intelligent Network Data Plane. In 32nd USENIX Security Symposium (USENIX Security 23). USENIX Association, Anaheim, CA, 6203\u20136220. Retrieved from https:\/\/www.usenix.org\/conference\/usenixsecurity23\/presentation\/zhou-guangmeng"},{"key":"e_1_3_1_21_2","doi-asserted-by":"publisher","DOI":"10.1109\/MedAI59581.2023.00033"},{"key":"e_1_3_1_22_2","volume-title":"38th Annual AAAI Conference on Artificial Intelligence (AAAI 2024), 20th-27th February 2024, Vancouver, Canada","author":"Pfl\u00c3\u00bcger Maximilian","year":"2024","unstructured":"Maximilian Pfl\u00c3\u00bcger, David Tena Cucala, and Egor V. Kostylev. 2024. Recurrent graph neural networks and their connections to Bisimulation and Logic. In 38th Annual AAAI Conference on Artificial Intelligence (AAAI 2024), 20th-27th February 2024, Vancouver, Canada."},{"key":"e_1_3_1_23_2","unstructured":"Petar Veli\u010dkovi\u0107 Guillem Cucurull Arantxa Casanova Adriana Romero Pietro Li\u00f2 and Yoshua Bengio. 2018. Graph attention networks. In International Conference on Learning Representations (ICLR\u201918). OpenReview.net Vancouver BC Canada. https:\/\/openreview.net\/forum?id=rJXMpikCZ"},{"key":"e_1_3_1_24_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.heliyon.2024.e35938"},{"key":"e_1_3_1_25_2","doi-asserted-by":"publisher","DOI":"10.1109\/CCNC51664.2024.10454841"},{"key":"e_1_3_1_26_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2021.108658"},{"key":"e_1_3_1_27_2","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2024.3426304"},{"key":"e_1_3_1_28_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.ins.2023.119229"},{"key":"e_1_3_1_29_2","doi-asserted-by":"publisher","unstructured":"Jian Sun Yuhao Liu Gangshan Wu Yecheng Zhang Rongbiao Zhang and X. J. Li. 2021. A fusion parameter method for classifying freshness of fish based on electrochemical impedance spectroscopy. In Journal of Food Quality 2021 Article 6664291 (2021). Hindawi. DOI:10.1155\/2021\/6664291","DOI":"10.1155\/2021\/6664291"},{"key":"e_1_3_1_30_2","doi-asserted-by":"publisher","DOI":"10.1016\/B978-0-08-044894-7.01720-6"},{"key":"e_1_3_1_31_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.egyai.2023.100302"},{"key":"e_1_3_1_32_2","unstructured":"Dan Hendrycks and Kevin Gimpel. 2023. Gaussian Error Linear Units (GELUs). (2023). arXiv:1606.08415. Retrieved from https:\/\/arxiv.org\/abs\/1606.08415"},{"key":"e_1_3_1_33_2","doi-asserted-by":"publisher","unstructured":"Lulu Zhang Bo Zhang Huanhuan Zhang Wanting Yang Xinkang Hu Jianrong Cai Chundu Wu and Xiaowen Wang. 2025. Multi-source feature fusion network for LAI estimation from UAV multispectral imagery. Agronomy 15 4 Article 988 (2025). DOI:10.3390\/agronomy15040988","DOI":"10.3390\/agronomy15040988"},{"key":"e_1_3_1_34_2","doi-asserted-by":"publisher","DOI":"10.5220\/0006639801080116"},{"key":"e_1_3_1_35_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2014.05.011"},{"key":"e_1_3_1_36_2","doi-asserted-by":"publisher","DOI":"10.1145\/2079327.2079329"},{"key":"e_1_3_1_37_2","doi-asserted-by":"publisher","DOI":"10.1109\/JIOT.2024.3400056"},{"key":"e_1_3_1_38_2","doi-asserted-by":"publisher","unstructured":"Susu Cui Xueying Han Cong Dong Yun Li Song Liu Zhigang Lu and Yuling Liu. 2024. MVDet: Encrypted malware traffic detection via multi-view analysis. Journal of Computer Security 32 6 (Jan. 2024) 533\u2013555. NLD. DOI:10.3233\/JCS-230024","DOI":"10.3233\/JCS-230024"},{"key":"e_1_3_1_39_2","doi-asserted-by":"publisher","unstructured":"Haiqi Zhang Guangquan Lu Mengmeng Zhan and Beixian Zhang. 2022. Semi-supervised classification of graph convolutional networks with laplacian rank constraints. Neural Processing Letters 54 4 (Aug. 2022) 2645\u20132656. DOI:10.1007\/s11063-020-10404-7","DOI":"10.1007\/s11063-020-10404-7"},{"key":"e_1_3_1_40_2","doi-asserted-by":"publisher","DOI":"10.1109\/NOMS54207.2022.9789878"},{"key":"e_1_3_1_41_2","doi-asserted-by":"publisher","DOI":"10.1145\/3539597.3570404"}],"container-title":["ACM Transactions on Privacy and Security"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3757741","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,9,11]],"date-time":"2025-09-11T12:34:13Z","timestamp":1757594053000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3757741"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,9,11]]},"references-count":40,"journal-issue":{"issue":"4","published-print":{"date-parts":[[2025,11,30]]}},"alternative-id":["10.1145\/3757741"],"URL":"https:\/\/doi.org\/10.1145\/3757741","relation":{},"ISSN":["2471-2566","2471-2574"],"issn-type":[{"type":"print","value":"2471-2566"},{"type":"electronic","value":"2471-2574"}],"subject":[],"published":{"date-parts":[[2025,9,11]]},"assertion":[{"value":"2024-11-29","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2025-07-28","order":2,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2025-09-11","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}