Web service threat detection method based on traffic interaction graph analysis

Yu Beiyuan; Zeng Guangjie; Peng Hao; Liu Jianwei; Li Hongliang; Tan Xueshi

doi:10.11959/j.issn.2096-109x.AQ25264

您当前的位置：

首页 >

文章列表页 >

Web service threat detection method based on traffic interaction graph analysis

Papers | 更新时间：2026-05-11

- Web service threat detection method based on traffic interaction graph analysis
- Chinese Journal of Network and Information Security Vol. 12, Issue 2, Pages: 41-54(2026)
- 作者机构：
  
  1.北京航空航天大学网络空间安全学院，北京 100191
  2.北京航空航天大学计算机学院，北京 100191
  3.奇安信科技集团股份有限公司，北京 100088
- 作者简介：
- 基金信息：
  
  The National Key Research and Development Program of China(2024YFB3108901);The National Natural Science Foundation of China(U21B2021;62472015;62202027)
- DOI：10.11959/j.issn.2096-109x.AQ25264
  CLC： TP393
- Received：23 October 2025，
  
  Revised：2026-03-23，
  
  Accepted：24 March 2026，
  
  Published：25 April 2026
- 稿件说明：
移动端阅览
余北缘, 曾广杰, 彭浩, 等. 基于流量交互图分析的Web服务威胁检测方法[J]. 网络与信息安全学报, 2026, 12(2): 41-54.

Yu Beiyuan, Zeng Guangjie, Peng Hao, et al. Web service threat detection method based on traffic interaction graph analysis[J]. Chinese Journal of Network and Information Security, 2026, 12(2): 41-54.
余北缘, 曾广杰, 彭浩, 等. 基于流量交互图分析的Web服务威胁检测方法[J]. 网络与信息安全学报, 2026, 12(2): 41-54. DOI： 10.11959/j.issn.2096-109x.AQ25264.

Yu Beiyuan, Zeng Guangjie, Peng Hao, et al. Web service threat detection method based on traffic interaction graph analysis[J]. Chinese Journal of Network and Information Security, 2026, 12(2): 41-54. DOI： 10.11959/j.issn.2096-109x.AQ25264.

摘要

随着Web服务应用功能的不断扩展，其面临的安全威胁日益严峻，对服务安全性与可靠性的要求也逐步提高。在服务资源规模持续增长的同时，攻击面不断扩大，攻击者的能力不断增强，使得未知威胁与群体性攻击逐渐增多。特别是在实际网络环境中存在大量无标签流量数据的情况下，实现Web服务流量的轻量化交互关系表征、有效检测多源威胁，以及在无标签环境下构建具备良好的可解释性的检测模型，成为突破当前安全瓶颈的关键。为此，提出了一种基于流量分析的轻量化流量交互图构建方法，以实现高效表征。通过引入结构熵博弈划分机制，实现了对流量交互图社区的自适应划分。在此基础上，通过分析社区子图的拓扑特性，并借助图指标排序识别关键社区。进一步提出了一种基于

分数的威胁顶点自适应检测方法，以有效识别关键社区中的高威胁顶点。同时，提出基于结构熵的群体威胁检测方法，以精准发现群体威胁实体。该方法无须依赖先验知识与数据标签，兼具对未知威胁的适应能力、对加密流量的鲁棒性、模型的可解释性。在公开数据集与实际网络流量数据上的测试结果表明，该方法能够有效识别多种威胁Web服务可用性的实体与攻击行为，具有较高的检测准确率和实际工程应用价值。

Abstract

With the continuous expansion of Web service functionalities

the security threats they face have become increasingly severe

leading to growing demands for service security and reliability. As service resources scale up

the attack surface widens

and attacker capabilities strengthen

resulting in a rise in unknown threats and swarm attack. Particularly in real-world network environments where large amounts of unlabeled traffic data exist

key challenges include achieving lightweight characterization of Web service traffic interactions

effectively detecting multi-source threats

and constructing a detection model with good interpretability in an unlabeled environment . These issues are critical to overcoming current security bottlenecks. To address these challenges

a lightweight traffic interaction graph construction method based on traffic analysis for efficient characterization was proposed. By introducing the structural entropy game partitioning mechanism

the adaptive partitioning of the communities in the traffic interaction graph has been achieved. On this basis

the topological cha

racteristics of communities subgraphs were analyzed

and key communities were identified through graph metric ranking. Furthermore

-score-based adaptive threat vertex detection method was proposed to effectively identify high-threat vertices in key communities. Simultaneously

a structural entropy-based swarm threat detection method was introduced to accurately detect swarm threat entities. The proposed method operates without relying on prior knowledge or data labels

while maintaining adaptability to unknown threats

robustness to encrypted traffic

and good interpretability. Experimental results on public datasets and real-world network traffic data demonstrated that the method could effectively identify various entities and attack behaviors that threaten the availability of Web services

achieving high detection accuracy and practical engineering application value.

关键词

Keywords

references

Bronte R , Bronte R , Shahriar H , et al . A signature-based intrusion detection system for web applications based on genetic algorithm [C ] // Proceedings of the 9th International Conference on Security of Information and Networks . New York : ACM , 2016 : 32 - 39 .

Díaz-Verdejo J , Muñoz-Calle J , Estepa Alonso A , et al . On the detection capabilities of signature-based intrusion detection systems in the context of web attacks [J ] . Applied Sciences , 2022 , 12 ( 2 ): 852 .

Yang R , Wang X , Luo K , et al . SWIDE: a semantic-aware detection engine for successful web injection attacks [C ] // Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security . New York : ACM , 2024 : 540 - 554 .

Kumar J , Santhanavijayan A , Rajendran B . Cross site scripting attacks classification using convolutional neural network [C ] // Proceedings of the 2022 International Conference on Computer Communication and Informatics (ICCCI) . Piscataway : IEEE Press , 2022 : 1 - 6 .

Alazab A , Khraisat A , Alazab M , et al . Detection of obfuscated malicious JavaScript code [J ] . Future Internet , 2022 , 14 ( 8 ): 217 .

Zhou Y H , Zhu H Y , Chai Y D , et al . Towards trustworthy web attack detection: an uncertainty-aware ensemble deep kernel learning model[PP] . arXiv [2025-10-13 ] . arXiv:arXiv . 2410 . 07725 .

Song X Y , Chen C , Cui B J , et al . Malicious JavaScript detection based on bidirectional LSTM model [J ] . Applied Sciences , 2020 , 10 ( 10 ): 3440 .

Liu M Y , Gou G P , Xiong G , et al . Enhanced detection of obfuscated HTTPS tunnel traffic using heterogeneous information network [J ] . Computer Networks , 2025 , 257 : 110975 .

Karbab E B , Debbabi M , Derhab A , et al . Scalable and robust unsupervised Android malware fingerprinting using community-based network partitioning [J ] . Computers & Security , 2020 , 96 : 101932 .

Li Y , Chen X S , Tang W Y , et al . Interaction matters: Encrypted traffic classification via status-based interactive behavior graph [J ] . Applied Soft Computing , 2024 , 155 : 111423 .

Li A S , Pan Y C . Structural information and dynamical complexity of networks [J ] . IEEE Transactions on Information Theory , 2016 , 62 ( 6 ): 3290 - 3339 .

Holt C A , Roth A E . The Nash equilibrium: a perspective [J ] . Proceedings of the National Academy of Sciences of the United States of America , 2004 , 101 ( 12 ): 3999 - 4002 .

Xian Y T , Xian Y T , Li P , et al . Community detection in large-scale complex networks via structural entropy game [C ] // Proceedings of the ACM on Web Conference 2025 . New York : ACM , 2025 : 3930 - 3941 .

Fenton A , Gillooly L , Vasilica C M . Female fans and social media: micro-communities and the formation of social capital [J ] . European Sport Management Quarterly , 2023 , 23 ( 2 ): 370 - 390 .

Montanari A . Finding one community in a sparse graph [J ] . Journal of Statistical Physics , 2015 , 161 ( 2 ): 273 - 299 .

Gleich D F . PageRank beyond the web [J ] . SIAM Review , 2015 , 57 ( 3 ): 321 - 363 .

Peng H , Zhang J Y , Huang X , et al . Unsupervised social bot detection via structural information theory [J ] . ACM Transactions on Information Systems , 2024 , 42 ( 6 ): 1 - 42 .

Fu C P , Li Q , Xu K . Flow interaction graph analysis: unknown encrypted malicious traffic detection [J ] . IEEE/ACM Transactions on Networking , 2024 , 32 ( 4 ): 2972 - 2987 .

Pellegrino G , Johns M , Koch S , et al . Deemon: detecting CSRF with dynamic analysis and property graphs [C ] // Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security . New York : ACM , 2017 : 1757 - 1771 .

Caballero J , Grier C , Kreibich C , et al . Measuring pay-per-install: the commoditization of malware distribution [C ] // Proceedings of the USENIX Security Symposium . Berkeley : USENIX Association , 2011 : 1 - 13 .

Ahmed M , Seraj R , Islam S M S . The k-means algorithm: a comprehensive survey and performance evaluation [J ] . Electronics , 2020 , 9 ( 8 ): 1295 .

Qi X Q , Wu Q , Zhang Y S , et al . A novel model for DNA sequence similarity analysis based on graph theory [J ] . Evolutionary Bioinformatics Online , 2011 , 7 : 149 - 158 .

Karbab E B , Debbabi M . ToGather: automatic investigation of Android malware cyber-infrastructures [C ] // Proceedings of the 13th International Conference on Availability, Reliability and Security . New York : ACM , 2018 : 1 - 10 .

张子龙 , 董卫宇 , 王奕森 . 保留因果关系的溯源图压缩方法 [J ] . 网络与信息安全学报 , 2025 , 11 ( 6 ): 105 - 119 .

Zhang Z L , Dong W Y , Wang Y S . Causality-preserving compression method on provenance graph [J ] . Chinese Journal of Network and Information Security , 2025 , 11 ( 6 ): 105 - 119 .

Zhao Y , Xie Y , Yu F , et al . BotGraph: Large scale spamming botnet detection [C ] // Proceedings of the USENIX Symposium on Networked Systems Design and Implementation . Berkeley : USENIX Association , 2009 : 321 - 334 .

Zeng X H , Peng H , Li A S . Proactive bot detection based on structural information principles [J ] . IEEE Transactions on Pattern Analysis and Machine Intelligence , 2026 , 48 ( 4 ): 4726 - 4743 .

Peng H , Huang X , Sun S , et al . Adaptive and robust DBSCAN with multi-agent reinforcement learning [J ] . IEEE Transactions on Pattern Analysis and Machine Intelligence , 2025 , 48 ( 4 ): 4860 - 2877 .

李一凡 , 李家印 , 林兴澎 , 等 . 基于数据增强的多视图对比学习图异常检测 [J ] . 网络与信息安全学报 , 2024 , 10 ( 5 ): 163 - 174 .

Li Y F , Li J Y , Lin X P , et al . Data augmentation based multi-view contrastive learning graph anomaly detection [J ] . Chinese Journal of Network and Information Security , 2024 , 10 ( 5 ): 163 - 174 .

Views

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Research on link detection technology based on dynamic browser fingerprint

Research on the SQL injection filtering based on SQL syntax tree

Related Author

Fan GAO

Jian WANG

Jiqiang LIU

Chen-wang HAN

Hui LIN

Chuan HUANG

Related Institution

School of Mathematics and Computer Science,Fujian Normal University

Fujian Provincial Key Laboratory of Network Security and Cryptology, Fujian Normal University

⁰