A Multi Method Importance and Performance Efficiency Analysis of Topological Metrics for Natural Visibility Graph Based Cyber Attack Detection
Summary
This paper evaluates 21 Natural Visibility Graph topological metrics for cyber-attack classification using SHAP, Permutation Importance, Boruta, and RFE consensus ranking, showing that a Top3 clustering-coefficient subset achieves 97.15% accuracy on CICIDS2018 while cutting runtime by 96%.
View Cached Full Text
Cached at: 10/05/26, 09:56 AM
# A Multi Method Importance and Performance Efficiency Analysis of Topological Metrics for Natural Visibility Graph Based Cyber Attack Detection Source: [https://arxiv.org/abs/2610.02342](https://arxiv.org/abs/2610.02342) [View PDF](https://arxiv.org/pdf/2610.02342) > Abstract:Natural Visibility Graph \(NVG\) based analysis characterizes network traffic through topological descriptors reflecting different structural properties\. However, not all descriptors contribute equally to cyber\-attack classification, and extracting a large metric set can increase computational cost\. This study evaluates 21 NVG derived topological metrics and investigates whether a compact subset can preserve classification capability while improving computational efficiency\. Four importance analysis methods SHAP, grouped Permutation Importance, Boruta, and Recursive Feature Elimination \(RFE\) are integrated through a Consensus Ranking strategy\. Based on this ranking, Full21, Top15, Top10, Top7, Top5, and Top3 configurations are evaluated using the CICIDS2018 dataset, a CNN classifier, and stratified 5 fold cross validation\. The three highest ranked metrics are avg\_clustering\_coeff\_median, avg\_clustering\_coeff\_std, and avg\_clustering\_coeff\_mean\. Top3 achieved the highest observed mean performance, with 97\.148% accuracy, 97\.055% weighted F1 score, and an MCC of 0\.9675, compared with 95\.999%, 95\.521%, and 0\.9549 for Full21, respectively\. It also reduced total runtime from 14,961\.39 s to 589\.22 s \(96\.06%\)\. These results indicate that importance guided metric reduction can provide a compact NVG representation with higher observed mean predictive performance and substantially lower computational cost under the evaluated setting\. ## Submission history From: Ali Melih Kanca \[[view email](https://arxiv.org/show-email/e80204b5/2610.02342)\] **\[v1\]**Thu, 1 Oct 2026 18:15:38 UTC \(544 KB\)
Similar Articles
Topology-Informed Neural Networks for Flood Detection in Optical and Synthetic Aperture Radar Imagery
This paper applies topological data analysis to flood detection by extracting topological features from satellite imagery and incorporating them into neural networks, demonstrating improved robustness and interpretability over conventional methods.
Evaluating Graph Neural Networks for Change-Criticality Classification in Maritime Navigation Charts
This paper evaluates graph neural networks for classifying changes in electronic navigational charts as critical or non-critical to navigational safety, demonstrating improved accuracy with graph-based representations.
$\Psi$-Resilience: Model-Free Feature Importance from 1D Topological Signals
The paper introduces Ψ-Resilience, a model-free feature importance method that derives explanations from 1D topological signals using 0-dimensional persistence of class-disagreement landscapes, achieving competitive Spearman correlations with SHAP and mutual information on synthetic and real datasets.
Clustering-Based Collective Anomaly Detection in IoT Systems: A Graph Neural Network Approach
The paper proposes UGCAD, an unsupervised framework using variational graph autoencoders and clustering to detect collective anomalies in IoT network traffic, with experiments on benchmark datasets showing its effectiveness.
Modeling Normal Is All You Need: Joint Latent Clustering for Anomaly Detection in Multimodal Cyber-Physical Systems
This paper introduces a joint latent clustering approach for anomaly detection in multimodal cyber-physical systems, modeling normal behavior as a mixture of Gaussians in latent space, and proposes a fair evaluation protocol. It achieves state-of-the-art results on three real-world CPS datasets, particularly on difficult subsets.