GT²D: Unifying Temporal Dynamics and Spatial Topology for Encrypted Traffic Anomaly Detection

Encrypted traffic anomaly detection is critical for modern network security yet remains challenging due to the coupling of data privacy and intricate attack patterns. While recent advancements, particularly pre-trained models, effectively extract features by treating traffic bytes as textual sequences, they predominantly focus on intra-flow content representation. Consequently, these approaches often neglect the topological spatial structure of network interactions, failing to capture the collateral impact of attacks across communicating entities. To bridge this gap, we redefine the paradigm of encrypted traffic analysis by constructing a dynamic encrypted traffic time series graph, where IP addresses serve as vertices and traffic flows act as edges. On this basis, we propose GT²D (Graph Time Series Transformer-based Malicious Traffic Detector), a novel framework that unifies temporal dynamics with spatial topology. GT²D introduces a vertex decoupling repair mechanism that segments univariate flow time series into subsequence-level patches, enabling Transformer encoder to extract fine-grained local temporal patterns. To capture topological dependencies, we design a cross-vertex multivariate representation module that re-associates these temporal features with IP vertices, augmented by Laplacian positional encodings and refined via Graph Convolutional Networks. Extensive experiments on real-world datasets demonstrate the superiority of our framework. GT²D outperforms state-of-the-art baselines with a maximum F1-score improvement of 3.74% and a recall improvement of 6.02%, proving its robustness in identifying complex anomalies through joint spatio-temporal modeling.