GraphWave: A Dynamic Context-Adaptive Multimodal Feature Fusion Framework for Threat Detection

Abstract

Accurate network traffic classification is critical for defending against evolving cyber threats. However, mainstream methods relying solely on intra-flow features fail to distinguish malicious traffic with highly similar legitimate patterns, lacking contextual modeling and robustness to adversarial evasion. To address these limitations, this paper proposes GraphWave, a dynamic context-adaptive multimodal framework built on a novel heterogeneous Graph2Seq paradigm. It constructs maximal connected subgraphs leveraging attacker, target and temporal context to capture key contextual correlations of attack chains. It integrates wavelet-enhanced dynamic graph attention networks for spatial context learning and Transformer encoders for long-range intra-flow temporal modeling. A multimodal cross-attention fusion mechanism aligns spatial and temporal representations to enhance discriminative feature integration. Extensive evaluations on six real-world datasets show GraphWave achieves a 99.13% F1-score, outperforming state-of-the-art methods by 7.62% on average. Theoretical analysis and empirical results validate its strong robustness against traffic obfuscation, temporal confusion, high intra-flow similarity, and low-and-slow evasion, demonstrating its superiority in complex adversarial network environments.