Concept drift mitigation through community and spectral graph analysis for the detectionof cyberattacks in network traffic

2026-09-08

AI Summary

本文通过社区和谱图分析方法选择稳定特征来解决网络流量中因概念漂移导致的检测模型过时问题，提高对网络攻击的检测能力。

Abstract

In network traffic, legitimate behaviours and attack techniques evolve jointly - the phenomenon known as 'concept drift' [1]. Every detector is thereby left obsolete between two updates, and always one step behind adversaries. In this work, we propose to move the point of intervention from the model, repaired after the drift, to the feature space, selected before learning. We therefore introduce t-robustness, a stability score defined for each feature independently of any detection model, comparable across an entire feature space. It combines the step-by-step distance between successive statistical states of a feature, and its cumulative divergence from its initial state, so that a slow monotonic drift cannot pass for stability. The candidates are drawn from abnormal network connectivity patterns left by scans, DoS and communications between endpoints, read through graph community metrics and spectral metrics. The evaluation is performed on the UGR16 dataset, across three learning scenarios and a control scenario, as well as without model update, and demonstrate that t-robust feature spaces sustain detection where the baselines collapse: retained expectancy at the last test interval reaches 0.6025, against 0.5230 for graph community features and 0.3831 for the base NetFlow features.

Problem

• concept drift
• network traffic
• cyberattacks

Innovation

• concept drift
• t-robustness
• graph community metrics
• spectral metrics
• network traffic