Deep learning (DL) greatly enhances cyber anomaly detection capabilities through effective statistical network characteristic. However, previous methods have not fully addressed two real-world scenario-driven challenges. 1) Frequent node access and disconnection sourced from free-bounded 5G/B5G cyberspace introduce unfamiliar communication behavior patterns, reducing the detection ability of the pre-trained DL model. 2) Low-frequency or sporadic communication behaviors lack stable patterns, posing a challenge for existing AI-driven models, including DL-based detection methods. To address these issues, we propose a cyber anomaly detection framework based on Continuous Temporal Graph (CTG) neural network from a new interaction-centered perspective. The proposed framework refines the concrete information interaction between network entities into the CTG evolution process, thereby naturally incorporating new node access behaviors into feature extraction on CTG neural network. We furthermore present a message aggregation scheme on CTG with fusion of spatio-temporal neighborhood, the actual time distribution and the historical state, thus transforming communication into a more stable pattern for the learning of low-frequency interactions. Extensive experiments on 4 novel datasets, including ToN-IoT, UNSWNB15, CIC-Dark2020, J.P. Morgan payment, demonstrate that our approach outperforms state-of-the-art methods, particularly in detecting new access and low-frequency behaviors.

Deep learning (DL) greatly enhances binary anomaly detection capabilities through effective statistical network characterization; nevertheless, the intrusion class differentiation performance is still insufficient. Two related challenges have not been fully explored. 1) Statistical attack characteristics are overemphasized while ignoring inherent attack topologies; sequence features are extracted from whole traffic flows, but the interaction evolution of each IP pair over time is rarely considered, such as in long short-term memory (LSTM) and gated recurrent units (GRUs). 2) Meeting the need for many high-quality labeled data samples is an expensive and labor-intensive task in large-scale, complex, and heterogeneous networks. To address these issues, we propose a dynamic line graph neural network (DLGNN)-based intrusion detection method with semisupervised learning. Our model converts network traffic into a series of spatiotemporal graphs. A dynamic GNN (DGNN) is employed to extract spatial information from each discrete snapshot and capture the contextual evolution of communication between IP pairs through consecutive snapshots. Moreover, a line graph realizes edge embedding expressions corresponding to network communications and strengthens the message aggregation ability of graph convolution. Experiments on 6 novel datasets demonstrate that our approach achieves 98.15–99.8% accuracy in abnormality detection with fewer labeled samples. Meanwhile, state-of-the-art multiclass performance is achieved, e.g., the average detection accuracy for DDoS across the 6 datasets reaches 95.32%.