# Hierarchical Local-Global Feature Learning for Few-shot Malicious Traffic Detection

arXiv: https://arxiv.org/abs/2504.03742 · HTML: https://mlsanity.com/paper/2504.03742/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 13 of its 48 references that are in the map.
- First posted on arXiv 1 Apr 2025.

## Builds on (most cited first, 13 of 13)

- [Semi-Supervised Classification with Graph Convolutional Networks](https://mlsanity.com/paper/1609.02907/) (2016)
- [Kitsune: An Ensemble of Autoencoders for Online Network Intrusion Detection](https://mlsanity.com/paper/1802.09089/) (2018)
- [ET-BERT: A Contextualized Datagram Representation with Pre-training Transformers for Encrypted Traffic Classification](https://mlsanity.com/paper/2202.06335/) (2022)
- [New Directions in Automated Traffic Analysis](https://mlsanity.com/paper/2008.02695/) (2020)
- [Small Sample Learning in Big Data Era](https://mlsanity.com/paper/1808.04572/) (2018)
- [Behavior-aware Account De-anonymization on Ethereum Interaction Graph](https://mlsanity.com/paper/2203.09360/) (2022)
- [Unveiling the potential of Graph Neural Networks for robust Intrusion Detection](https://mlsanity.com/paper/2107.14756/) (2021)
- [Low-Quality Training Data Only? A Robust Framework for Detecting Encrypted Malicious Network Traffic](https://mlsanity.com/paper/2309.04798/) (2023)
- [Clarify Confused Nodes via Separated Learning](https://mlsanity.com/paper/2306.02285/) (2023)
- [Multi-view Correlation-aware Network Traffic Detection on Flow Hypergraph](https://mlsanity.com/paper/2501.08610/) (2025)
- [CBSeq: A Channel-level Behavior Sequence For Encrypted Malware Traffic Detection](https://mlsanity.com/paper/2307.09002/) (2023)
- [EG-ConMix: An Intrusion Detection Method based on Graph Contrastive Learning](https://mlsanity.com/paper/2403.17980/) (2024)
- [Network Anomaly Traffic Detection via Multi-view Feature Fusion](https://mlsanity.com/paper/2409.08020/) (2024)

## Abstract (arXiv)

With the rapid growth of internet traffic, malicious network attacks have become increasingly frequent and sophisticated, posing significant threats to global cybersecurity. Traditional detection methods, including rule-based and machine learning-based approaches, struggle to accurately identify emerging threats, particularly in scenarios with limited samples. While recent advances in few-shot learning have partially addressed the data scarcity issue, existing methods still exhibit high false positive rates and lack the capability to effectively capture crucial local traffic patterns. In this paper, we propose HLoG, a novel hierarchical few-shot malicious traffic detection framework that leverages both local and global features extracted from network sessions. HLoG employs a sliding-window approach to segment sessions into phases, capturing fine-grained local interaction patterns through hierarchical bidirectional GRU encoding, while simultaneously modeling global contextual dependencies. We further design a session similarity assessment module that integrates local similarity with global self-attention-enhanced representations, achieving accurate and robust few-shot traffic classification. Comprehensive experiments on three meticulously reconstructed datasets demonstrate that HLoG significantly outperforms existing state-of-the-art methods. Particularly, HLoG achieves superior recall rates while substantially reducing false positives, highlighting its effectiveness and practical value in real-world cybersecurity applications.