Abstract:As an important direction for the evolution of next-generation wireless communication technology, 6G will comprehensively promote the wave of economic and social digitization. Services carried by 6G network will rely heavily on the sharing and processing of massive amounts of data between entities, data security is therefore of great importance. Currently, most network applications utilize SSL/TLS protocols to ensure the confidentiality and security of network communications, while encryption mechanism also brings huge challenges to network security supervision. Though encrypted malicious traffic detection in traditional networks has become a research hotspot, existing technologies cannot be directly applied in 6G networks. In a 6G network with massive, instant and unlimited communications between heterogeneous terminals, network communication behavior patterns are much more diversified, which makes the boundary between normal traffic and malicious traffic more blurred in 6G networks than in traditional networks. Existing studies either analyze encrypted traffic in isolation or aggregation, while they all ignore the rich correlations among encrypted traffic. To this end, we propose an encrypted malicious traffic detection framework based on the graph neural network towards the network security problem of future 6G networks, ET-RSGAT. First, considering the characteristics of super high speed and super large connection of 6G network, we design a simple feature extraction method of encrypted traffic: extracting the TLS handshake raw bytes and TLS record length sequence for one single encrypted session. Second, in view of the correlations of large numbers of heterogeneous terminals and the coexistence of multi-source heterogeneous data communication in 6G networks, we analyze the correlations between encrypted sessions from 2 aspects, which are service correlations and communication behavior correlations. Then we construct an encrypted traffic graph, named ETG. On the basis of ETG, we introduce a graph attention network to utilize the correlations between encrypted sessions to enrich the feature representation of nodes. With rich representation, we build the detection model based on a multi-layer perceptron to identify threats. Considering that the simulation environment of 6G networks is immature, we deploy a variety of heterogeneous terminal nodes and run various network services to simulate the 6G communication scenario, and design related experiments for the interconnection of many heterogeneous terminals in 6G networks. The evaluation and experimental results show that our method can obtain satisfactory detection results in both traditional network and simulated environment datasets.

Unsupervised Graph-Sequence Anomaly Detection for 5G Core Network Control Plane Traffic

Accurate Anomaly Detection Leveraging Knowledge-enhanced GAT

Practical Cyber Attack Detection With Continuous Temporal Graph in Dynamic Network System

An Anomaly Detection Algorithm Based on Ensemble Learning for 5G Environment

NCGs: Building a Trustworthy Environment to Identify Abnormal Events Based on Network Connection Behavior Analysis.

Network Anomaly Detection in 5G Networks

Unsupervised Network Traffic Anomaly Detection Method Based on Attribute Graph in Power Internet of Things

Towards traffic supervision in 6G:a graph neural network-based encrypted malicious traffic detection method

Deep Learning-Based Log Anomaly Detection for 5G Core Network.

Machine Learning based Anomaly Detection for 5G Networks

A Multi-View Framework for BGP Anomaly Detection Via Graph Attention Network

Detecting Traffic Anomaly in Wireless Networks, an Analytics Methodology

A Neural Network Approach for Wireless Spectrum Anomaly Detection in 5G-Unlicensed Network

Graph Anomaly Detection at Group Level: A Topology Pattern Enhanced Unsupervised Approach

GADY: Unsupervised Anomaly Detection on Dynamic Graphs

Unsupervised Abnormal Traffic Detection through Topological Flow Analysis

A Human-in-the-Loop Anomaly Detection Architecture for Big Traffic Data of Cellular Network

Anomaly Detection of Network Streams Via Dense Subgraph Discovery

Anomaly traffic detection in IoT security using graph neural networks

Graph Convolutional Adversarial Networks for Spatiotemporal Anomaly Detection

Big Data Driven Anomaly Detection for Cellular Networks