Malicious traffic detection is a major challenge due to the concealed and varied nature of real-world attacks. Current methods face two main limitations: first, they often represent bidirectional traffic as undirected graphs or sequences, which limits their ability to capture both temporal information and interaction patterns that provide critical attack clues. Second, supervised methods excel at identifying known malicious traffic, while unsupervised methods are more suitable for unknown attacks. Most studies focus on a single learning method, neglecting the benefits of integrating both approaches. To address these issues, we introduce Directional Graph Network (DGNet), the first framework combining directional graph modeling with hybrid learning paradigms for malicious traffic detection. To capture directional traffic information and interaction patterns in bi-flow traffic, we propose Directional Flow Graph modeling and a tailored DIRectional Graph Isomorphism Networks (DIRGIN) learning directional graph representation. To address the performance degradation caused by the inconsistent distribution of known and unknown attack data, we propose a hybrid learning framework based on the tailored graph neural network that combines the advantages of supervised and unsupervised learning. Comprehensive evaluations on two public datasets demonstrate that DGNet consistently outperforms state-of-the-art baselines across both detection scenarios.