TripleE-TGNN: Triple-Embedding Temporal Graph Neural Networks for Multi-Granularity Microservices Security

Microservices architectures decompose monolithic systems into hundreds of services communicating via complex dependency graphs, introducing security challenges including lateral movement attacks and stealthy intrusions. Existing intrusion detection systems fail to capture the multi-granularity nature of microservices threats, which manifest simultaneously at service-level aggregate behaviors, trace-level request flows, and node-level instance dynamics. We propose TripleE-TGNN, a tripleembedding temporal graph neural network that jointly learns hierarchical representations at three complementary granularities. Service-level embeddings capture behavioral patterns through temporal aggregation. Trace-level embeddings model distributed request flows using attention-weighted path encodings. Node-level embeddings represent pod dynamics and resource patterns. A temporal heterogeneous graph neural network integrates these embeddings with dynamic attention mechanisms. We evaluate TripleE-TGNN on five microservices datasets with 11 to 41 services, achieving 96.8% accuracy on Train-Ticket, outperforming baselines by 8.3%. Ablation studies reveal each granularity contributes unique discriminative power. The model maintains 94.7% accuracy under concept drift, advancing microservices security through principled multi-scale temporal graph learning.