Forecasting Individual NetFlows using a Predictive Masked Graph Autoencoder

2026-04-22

AI Summary

This study addresses the challenge of accurately predicting individual NetFlow records with a focus on identifying the source and destination IP addresses and ports associated with each connection. To this end, the authors propose a sliding window–based approach to construct a heterogeneous bidirectional graph that models network traffic as a dynamic structure comprising IP nodes, port nodes, and connection nodes. They introduce, for the first time, a predictive masked graph autoencoder to jointly capture spatial and temporal dependencies in this graph representation. The proposed method not only reconstructs connection features with high fidelity but also significantly enhances the accuracy of identifying target IPs and ports, demonstrating strong performance on relevant tasks and validating the effectiveness and potential of graph neural networks for fine-grained NetFlow prediction.

Technology Category

• Machine Learning: Graph-based Machine Learning
• Data Mining & Knowledge Management: Graph Mining, Social Network Analysis & Community
• Planning, Routing, and Scheduling: Activity and Plan Recognition

Application Category

• Graph Algorithms and Modeling for the Web: Graph neural networks and deep learning approaches for Web-related graphs
• Social Networks and Social Media: Influence propagation, information diffusion, and the prediction on networks
• Web Mining and Content Analysis: Large pretrained models with web data

Abstract

In this paper, we propose a proof-of-concept Graph Neural Network model that can successfully predict network flow-level traffic (NetFlow) by accurately modelling the graph structure and the connection features. We use sliding-windows to split the network traffic in equal-sized heterogeneous bidirectional graphs containing IP, Port, and Connection nodes. We then use the GNN to model the evolution of the graph structure and the connection features. Our approach shows superior results when identifying the Port and IP to which connections attach, while feature reconstruction remains competitive with strong forecasting baselines. Overall, our work showcases the use of GNNs for per-flow NetFlow prediction.

Problem

• NetFlow prediction
• Graph Neural Network
• network traffic forecasting
• flow-level traffic
• IP and Port prediction

Innovation

• Graph Neural Network
• NetFlow prediction
• Masked Graph Autoencoder
• Heterogeneous graph
• Sliding window