GGT-Net: a multimodal graph-sequence fusion model for crypto-malicious traffic detection

With the rapid growth of network traffic and the widespread adoption of encryption, traditional detection methods have increasingly revealed limitations in feature extraction. To address this issue, this paper proposes a detection model called the Graph Convolutional Network–Gated Recurrent Unit–Transformer Network (GGT-Net). The model represents network traffic separately as a protocol graph structure and a statistical sequence: a Graph Convolutional Network (GCN) extracts TLS protocol interaction information, a Gated Recurrent Unit (GRU) captures statistical behaviors, and a Transformer deeply fuses the two modalities. Skip connections are introduced to enhance the expressive power of the GCN, while contrastive loss is employed to strengthen the consistency of multimodal representations. Experimental results demonstrate that GGT-Net achieves significantly better accuracy and recall than existing methods, and also exhibits strong generalization across multiple benchmark datasets.