Research on network security situation awareness based on graph neural networks

To address key limitations in network security situation awareness, including the high dimensionality of traffic data, the increasing stealth of encrypted traffic, and the difficulty of Euclidean deep learning models in capturing non-Euclidean topological dependencies, this study proposes an adaptive spatiotemporal situation awareness framework based on a Graph Attention Network and a dynamic graph reconstruction mechanism. The model jointly represents structural dependencies and temporal evolution in network traffic, enabling an effective description of complex spatiotemporal relationships. By integrating multi-head graph attention with Temporal Convolutional Networks, the framework strengthens the detection of cross-domain interactions and short-term and medium-term temporal patterns. Experiments on the CIC-IDS2017 dataset show that the model achieves a detection accuracy of 99.96% with a false positive rate of 0.04%. On the UNSW-NB15 dataset, it attains an F1-score of 99.76%. In zero-day attack detection, it provides a 15.4% improvement compared with CNNs and LSTM models. These results demonstrate that the proposed approach maintains stable detection performance in highly dynamic and heterogeneous environments and provides an effective foundation for intelligent and adaptive network defense systems.