CT-TGNN: Continuous-Time Temporal Graph Neural Networks for Real-Time Threat Propagation Analysis in Encrypted Zero-Trust Microservices

Zero-trust architectures require continuous verification of all network communications, yet the proliferation of encrypted traffic-now exceeding 87% of enterprise communications-renders traditional deep packet inspection ineffective. Existing temporal graph neural networks operate on discrete time snapshots, missing critical inter-event attack propagation dynamics, while current encrypted traffic analyzers ignore network topology essential for detecting lateral movement and coordinated threats. This paper introduces Continuous-Time Temporal Graph Neural Networks (CT-TGNN) for encrypted traffic analysis in zero-trust microservices, enabling real-time threat propagation tracking through graph-structured continuous dynamics. We develop a unified framework coupling Neural Ordinary Differential Equations with temporal graph convolutions, allowing continuous evolution of node embeddings that capture both smooth state transitions and discrete security events across encrypted communication graphs. The proposed architecture integrates encrypted edge feature encoding that extracts timing patterns and protocol metadata without payload inspection, multi-scale temporal modeling spanning microseconds to hours, and zero-trust policy enforcement through continuous authentication verification. Theoretical analysis establishes gradient stability for continuous graph dynamics via Lyapunov methods and proves convergence guarantees under dynamic graph topology shifts. Experimental validation on six diverse datasets-including microservices traces with 15 million encrypted API calls, the IoT-23 dataset with 325 GB of encrypted traffic, UNSW-NB15 temporal splits, CIC-IDS2018, NF-ToN-IoT, and NF-BoT-IoT demonstrates up to 98.3% detection accuracy with 47 ms median latency, outperforming discrete temporal graph networks by up to 12.7% on zero-day lateral movement detection. The framework processes 8.7 million encrypted events per second while preserving privacy, enabling scalable and privacy-preserving threat intelligence across zero-trust service boundaries.