arXiv preprint ·
Concept drift mitigation through community and spectral graph analysis for the detectionof cyberattacks in network traffic
- Published
- Source
- arXiv preprint, posted before peer review
- Original
- Read it at arXiv
- Topics
Abstract
In network traffic, legitimate behaviours and attack techniques evolve jointly - the phenomenon known as 'concept drift' [1]. Every detector is thereby left obsolete between two updates, and always one step behind adversaries. In this work, we propose to move the point of intervention from the model, repaired after the drift, to the feature space, selected before learning. We therefore introduce t-robustness, a stability score defined for each feature independently of any detection model, comparable across an entire feature space. It combines the step-by-step distance between successive statistical states of a feature, and its cumulative divergence from its initial state, so that a slow monotonic drift cannot pass for stability. The candidates are drawn from abnormal network connectivity patterns left by scans, DoS and communications between endpoints, read through graph community metrics and spectral metrics. The evaluation is performed on the UGR16 dataset, across three learning scenarios and a control scenario, as well as without model update, and demonstrate that t-robust feature spaces sustain detection where the baselines collapse: retained expectancy at the last test interval reaches 0.6025, against 0.5230 for graph community features and 0.3831 for the base NetFlow features.
The authors’ abstract, as arXiv lists it. arXiv’s listings, abstracts included, are free for anyone to reuse.
Read it on ReadSearch
Each opens after you create an account, and brings you back to this paper.
More in Cryptography & Security
Improving 5G AI-RAN MCS Selection by Predicting Retransmissions
Efficient Graph Neural Networks for Multicarrier Wideband Hybrid Beamforming Optimization
NEXUS-MI: Communication-Aware Federated Personalization for Gateway-Coordinated Motor-Imagery Brain-Computer Interfaces
Phase oscillator networks with multiple and state-dependent delays: A framework for exploring white matter plasticity in neurodynamics
Can AI Agents Detect and Repair Artifact Drift in Network Experiments?
Get the few papers worth your time in Cryptography & Security every morning.
ReadSearch reads the new papers in your field each day and brings you the few worth reading, each with its key finding in a sentence.