Saturation attacks pose a critical threat to the reliability and stability of SDN by injecting attack traffic flows targeting switches or controllers, leading to service degradation. Existing Graph Neural Network-based detection methods often fail to capture structured interactions among heterogeneous network entities and overlook the inherent temporal dynamics of traffic flows, resulting in limited detection effectiveness. To address these limitations, we propose Hawk, a saturation attack detection method that improves SDN reliability by representing traffic flows as a heterogeneous dynamic graph and detecting attacks through structured spatial interactions and temporal dependencies. In the heterogeneous dynamic graph, we incorporate the relationships among hosts, switches, and flows. We also designed a new GNN model that mainly contains a structured interaction aggregation module and an inherent temporal aggregation module to update node embeddings based on structured spatial interactions and temporal dependencies. Experiments conducted on both FatTree and Agis topologies with real-world background traffic demonstrate that Hawk significantly outperforms existing methods in detection accuracy and stability across different topologies and traffic patterns. For example, Hawk achieves accuracy and macro-precision at 0.991 and 0.982 when using the IMC-10 data set in FatTree, outperforming FTODefender, whose accuracy and macro-precision are 0.938 and 0.905.