Detecting stealthy malicious communications from flow logs under benign-only training remains a critical challenge in network security. Malicious communications often camouflage as normal traffic like standard HTTPS flows. Conventional intrusion detectors rely strictly on known labeled attacks. Alternatively, they score flows completely independently. These approaches fail against sparse and context-dependent suspicious activity. To capture this essential context, graph anomaly detectors have been introduced to add valuable relational information to the analysis. However, existing methods fail to test the structural consistency of specific communication edges. To overcome these fundamental limitations, we present GESR, a novel graph-based framework for detecting suspicious communications and anomalous hosts under a benign-only training setting. GESR models complex network activity as attributed communication graphs. It cleverly reconstructs edge semantics entirely from local structural context rather than isolated features. This non-intuitive design forces the framework to predict expected communication patterns from neighborhood topologies. Attackers cannot easily manipulate this deep structural dependency. The model then converts the resulting structural inconsistencies into host-level anomaly scores. It utilizes robust Median Absolute Deviation (MAD) calibration for this final step. We evaluate GESR extensively on CTU-13 and CICIDS2017 datasets. These evaluations strictly impose tight false-positive operating constraints. On CICIDS2017, GESR achieves an outstanding ROC-AUC of 0.9753. It also yields a high TPR of 0.8569 at a strict 5% FPR threshold. GESR consistently outperforms existing methods across both evaluated benchmarks. The results prove that structure-conditioned edge reconstruction is a credible direction for practical intrusion detection.

翻译：在仅依靠良性流日志检测隐蔽恶意通信仍是网络安全领域的关键挑战。恶意通信常伪装成正常流量（如标准HTTPS流量），传统入侵检测系统严格依赖已知标注攻击标签，或完全独立地对流进行评分，这些方法难以应对稀疏且依赖上下文的可疑行为。为捕捉关键上下文信息，图异常检测器被引入以增加有价值的关系分析维度，但现有方法未能检验特定通信边缘的结构一致性。为克服这些根本性局限，我们提出GESR——一种基于图的框架，可在仅良性训练设置下检测可疑通信与异常主机。GESR将复杂网络活动建模为带属性通信图，巧妙地从局部结构上下文而非孤立特征重建边缘语义。这种非直观设计迫使框架从邻域拓扑结构预测预期通信模式，使攻击者难以操纵深层结构依赖性。模型随后将结构不一致性转换为主机级异常评分，并利用稳健的中位数绝对偏差（MAD）校准完成最终步骤。我们在CTU-13和CICIDS2017数据集上对GESR进行了广泛评估，严格限定误报率操作约束。在CICIDS2017上，GESR取得了0.9753的卓越ROC-AUC值，在严格5%误报率阈值下实现0.8569的高真正例率。GESR在两个基准测试中均持续优于现有方法，证明结构条件性边缘重建是面向实际入侵检测的可信方向。