Malicious Traffic Classification for IoT based on Graph Attention Network and Long Short-Term Memory Network

With the rapid development of digital services and the Internet of Things (IoT), the number and diversity of cyber attacks have reached unprecedented levels, making network traffic classification a crucial means of maintaining network security. However, in the face of increasingly complex traffic attacks, traditional analysis of individual traffic flows is no longer sufficient for effective detection. Therefore, to reveal the potential correlations between network traffic flows, we propose a novel IoT malicious traffic classification model called EGAT-LSTM. This model combines an improved Graph Attention Network (GAT) with Long Short-Term Memory (LSTM) network to effectively capture the spatial topology and temporal features of network traffic, ultimately achieving efficient classification. Moreover, we optimize the aggregation function of network node features within the attention mechanism to effectively address the issue of essential information retention during the feature learning process. The experimental results on two publicly available IoT datasets demonstrate that our method achieves improvements in both binary and multi-class classification tasks, exhibiting significant advantages over some current approaches.