Forecasting Individual NetFlows using a Predictive Masked Graph Autoencoder

TL;DR

This paper introduces a graph neural network model that predicts network flow traffic by modeling graph structures and connection features, demonstrating superior identification of connection points.

Contribution

The paper presents a novel GNN-based approach for per-flow NetFlow prediction, effectively modeling graph evolution and connection features.

Findings

Superior accuracy in identifying IP and Port connections.

Competitive feature reconstruction performance.

Effective modeling of network traffic dynamics.

Abstract

In this paper, we propose a proof-of-concept Graph Neural Network model that can successfully predict network flow-level traffic (NetFlow) by accurately modelling the graph structure and the connection features. We use sliding-windows to split the network traffic in equal-sized heterogeneous bidirectional graphs containing IP, Port, and Connection nodes. We then use the GNN to model the evolution of the graph structure and the connection features. Our approach shows superior results when identifying the Port and IP to which connections attach, while feature reconstruction remains competitive with strong forecasting baselines. Overall, our work showcases the use of GNNs for per-flow NetFlow prediction.