AC-ODE: A Dynamic Network Attack Prediction Model Based on Attack-Context Graph Neural Ordinary Differential Equations

To address the characteristics of persistent attack propagation, heterogeneous associations, and temporal evolution of attack behaviors in dynamic networks, this paper proposes AC-ODE, a dynamic network attack prediction model based on attack-context graph neural ordinary differential equations, which jointly predicts host node risk and attack propagation along links. Specifically, a relation-aware historical state encoding module is first designed to extract multidimensional and comprehensive cybersecurity context from multi-frame temporal graph snapshots. An attack-context-conditioned continuous propagation module is then constructed to model the continuous evolution of latent states on discretely observed graphs, while using attack context to modulate propagation intensity. Finally, a historical–future state gated fusion mechanism is introduced to enable joint node–edge prediction. Compared with existing methods based on discrete snapshot modeling, AC-ODE more accurately characterizes risk variation trends as network attacks transition from activation to attenuation. Experimental results on three public datasets—LANL, the DARPA Operationally Transparent Cyber (OpTC) dataset, and CICIDS2017—show that AC-ODE outperforms multiple baseline methods in terms of both AP and Hits@10, achieving an edge-level AP of 0.974 on OpTC, which corresponds to a 73.8% relative improvement over the second-best method. Ablation studies and temporal evolution analyses further demonstrate that the core modules play an important role in improving prediction accuracy and capturing the temporal evolution patterns of network attacks.