基于自然可见性图的网络攻击检测：多方法评估拓扑指标的重要性与性能效率

arXiv cs.AI 论文
topological-metrics visibility-graphs cyber-attack-detection feature-selection network-traffic cnn

摘要

本文使用 SHAP、置换重要性（Permutation Importance）、Boruta 和 RFE 共识排名，评估了 21 种自然可见性图（Natural Visibility Graph）拓扑指标在网络攻击分类中的效果。结果表明，仅选取 Top3 聚类系数子集即可在 CICIDS2018 数据集上达到 97.15% 的准确率，同时将运行时间缩短 96%。

arXiv:2610.02342v1 Announce Type: new Abstract: Natural Visibility Graph (NVG) based analysis characterizes network traffic through topological descriptors reflecting different structural properties. However, not all descriptors contribute equally to cyber-attack classification, and extracting a large metric set can increase computational cost. This study evaluates 21 NVG derived topological metrics and investigates whether a compact subset can preserve classification capability while improving computational efficiency. Four importance analysis methods SHAP, grouped Permutation Importance, Boruta, and Recursive Feature Elimination (RFE) are integrated through a Consensus Ranking strategy. Based on this ranking, Full21, Top15, Top10, Top7, Top5, and Top3 configurations are evaluated using the CICIDS2018 dataset, a CNN classifier, and stratified 5 fold cross validation. The three highest ranked metrics are avg_clustering_coeff_median, avg_clustering_coeff_std, and avg_clustering_coeff_mean. Top3 achieved the highest observed mean performance, with 97.148% accuracy, 97.055% weighted F1 score, and an MCC of 0.9675, compared with 95.999%, 95.521%, and 0.9549 for Full21, respectively. It also reduced total runtime from 14,961.39 s to 589.22 s (96.06%). These results indicate that importance guided metric reduction can provide a compact NVG representation with higher observed mean predictive performance and substantially lower computational cost under the evaluated setting.
查看原文
查看缓存全文

缓存时间: 2026/10/05 09:56 

# A Multi Method Importance and Performance Efficiency Analysis of Topological Metrics for Natural Visibility Graph Based Cyber Attack Detection
Source: [https://arxiv.org/abs/2610.02342](https://arxiv.org/abs/2610.02342)
[View PDF](https://arxiv.org/pdf/2610.02342)

> Abstract:Natural Visibility Graph \(NVG\) based analysis characterizes network traffic through topological descriptors reflecting different structural properties\. However, not all descriptors contribute equally to cyber\-attack classification, and extracting a large metric set can increase computational cost\. This study evaluates 21 NVG derived topological metrics and investigates whether a compact subset can preserve classification capability while improving computational efficiency\. Four importance analysis methods SHAP, grouped Permutation Importance, Boruta, and Recursive Feature Elimination \(RFE\) are integrated through a Consensus Ranking strategy\. Based on this ranking, Full21, Top15, Top10, Top7, Top5, and Top3 configurations are evaluated using the CICIDS2018 dataset, a CNN classifier, and stratified 5 fold cross validation\. The three highest ranked metrics are avg\_clustering\_coeff\_median, avg\_clustering\_coeff\_std, and avg\_clustering\_coeff\_mean\. Top3 achieved the highest observed mean performance, with 97\.148% accuracy, 97\.055% weighted F1 score, and an MCC of 0\.9675, compared with 95\.999%, 95\.521%, and 0\.9549 for Full21, respectively\. It also reduced total runtime from 14,961\.39 s to 589\.22 s \(96\.06%\)\. These results indicate that importance guided metric reduction can provide a compact NVG representation with higher observed mean predictive performance and substantially lower computational cost under the evaluated setting\.

## Submission history

From: Ali Melih Kanca \[[view email](https://arxiv.org/show-email/e80204b5/2610.02342)\] **\[v1\]**Thu, 1 Oct 2026 18:15:38 UTC \(544 KB\)

相似文章