A Multi-cycle Spatio-temporal Hypergraph and Dual-attention Residual Hypergraph Neural Network for Saturation Attack Detection in SDN

Saturation attacks in Software-Defined Networking (SDN) have evolved into stealthy attack patterns, especially the Down-to-Up Timeout Probing and Dynamically Flow Table Overflowing (DUDFTO) attack. Existing GNN-based attack detection methods have limitations in modeling complex traffic relationships. Connecting flows via shared attributes easily mixes benign and malicious features, inadvertently mix conflicting information of benign flows and attack flows. Meanwhile, existing Hypergraph Neural Networks (HGNNs)-based attack detection methods may lose cross-hyperedge and high-order correlation information by simply gathering flow node features as hyperedge features. To overcome the above limitations, this paper proposes ST-HGNN, a saturation attack detection method based on a multi-cycle spatio-temporal hypergraph and a dual-attention residual hypergraph neural network. ST-HGNN constructs ST-FlowGraph, a multi-cycle spatio-temporal hypergraph. Each node represents a network flow. The hypergraph contains three kinds of hyperedges: Source IP-Protocol hyperedges, destination port group hyperedges, and temporal window hyperedges. We further design ST-HGATNet, a dual-attention residual hypergraph neural network model. ST-HGATNet integrates a flow-level node learning module, a group-level hyperedge enhancement module, and a residual fusion and classification module to improve attack detection performance to refine node representations, capture group-level dependencies, and preserve critical and subtle anomalies information. Evaluation results demonstrate the detection effectiveness of ST-HGNN, achieving a detection accuracy exceeding 97%.