摘要： 软件定义网络（SDN）中的嗅探攻击是一类以探测交换机敏感配置与状态为目的的隐蔽攻击。因其低速率、小流量和高隐蔽性的特征，现有攻击检测方法对其识别能力极为有限。已有的面向控制器饱和或流表溢出等攻击的图神经网络（GNN）方法往往依赖密集的拓扑交互或强信号特征，难以有效刻画嗅探网络流之间稀疏的相关性以及主机层面的隐式结构关系，使其攻击检测性能受限。为解决上述问题，提出一种面向SDN嗅探攻击的检测方法HSENet。该方法首先通过设计异构语义超图生成算法HSHG，刻画网络流的微观通信语义与宏观主机行为语义；进而构建异构边卷积网络HEC-GCN，实现针对不同语义关系的自适应卷积与融合，得到判别力更强的节点嵌入表示。基于两个网络流数据集的实验结果表明，HSENet在准确率、加权F1值与宏F1值等多项指标上均显著优于多种GNN与传统机器学习基线。相比较最佳基线，准确率分别提升2.65%和3.34%，加权F1值分别提升2.64%和2.48%，宏F1值分别提升2.91%和11.37%。这些结果表明，该方法能够有效增强对低速率、小流量且高度隐蔽的嗅探流的识别能力，为SDN环境下的早期威胁发现提供了一种可行且高效的解决方案。

Abstract: Probing attacks in Software-Defined Networking (SDN) are stealthy attacks that probe switches for sensitive configurations and states. Their low rate, small volume, and high stealth make detection difficult. Existing detection methods show limited recognition ability. Graph Neural Network (GNN) methods designed for overt attacks such as controller saturation or flow-table overflow often rely on dense topological interactions or strong signal features. These methods fail to capture sparse correlations among probing flows and implicit host-level structures, which restricts their performance. This paper proposes HSENet, a detection method for SDN probing attacks. The method first designs a Heterogeneous Semantic Hypergraph generation algorithm called HSHG. The algorithm encodes micro-level communication semantics and macro-level host behavior semantics of network flows. The method then builds a Heterogeneous-Edge Convolutional GCN called HEC-GCN. The network performs adaptive convolution and fusion over different semantic relations and produces more discriminative node embeddings. Experiments on two network flow datasets show that HSENet significantly outperforms multiple GNN and traditional machine-learning baselines on Accuracy, Weighted-F1, and Macro-F1. Compared with the best baseline, Accuracy increases by 2.65% and 3.34%, Weighted-F1 by 2.64% and 2.48%, and Macro-F1 by 2.91% and 11.37%. These results indicate that the method strengthens the identification of low-rate, small-volume, and highly covert sniffing flows and provides a practical and efficient solution for early threat discovery in SDN.