A Quantitative Analysis of Graph Representation Strategies for Cyber Attack Detection

Ali Melih Kanca; Ilker Turker

cs.AIOct 2, 2026

A Quantitative Analysis of Graph Representation Strategies for Cyber Attack Detection

Authors: Ali Melih Kanca, Ilker Turker

Organizations: Department of Computer Engineering, Faculty of Computing and Informatics Sciences, Karabuk University, Karabuk, Türkiye · Computer Engineering, Faculty of Computing and Informatics Sciences, Karabuk University, Karabuk, Türkiye

Abstract

Graph based cyber attack detection studies employ various graph construction and representation strategies across different cybersecurity application domains. This diversity motivates a quantitative examination of how representation strategies are distributed across these application domains. This study presents a quantitative analysis of 37 original studies published between 2019 and 2026. Each study was coded according to publication year, application domain, graph representation type, feature extraction strategy, learning paradigm, algorithm, and dataset. Frequency analysis, cross tabulation, and statistical association tests were applied. Automated representation learning was the most frequently employed strategy, accounting for 73.0% of the studies, while handcrafted representation strategies accounted for 27.0%. The Fisher Freeman Halton exact test revealed a statistically significant association between application domain and representation strategy (exact p = 0.008; Cramer's V = 0.540). The findings indicate that automated representation learning predominates within the analyzed corpus and that the distribution of representation strategies differs across cybersecurity application domains.

Cybersecurity

Cybersecurity develops methods to protect digital and cyber-physical systems from attacks, vulnerabilities, data loss, and misuse.

See all 354 papers

Topological Signatures of Cyber-Attack Classes in Natural Visibility Graph Representations of Network Traffic
Sep 22, 2026Ali Melih Kanca, Ilker TurkerNetwork Intrusion Detection Graph Classification
Department of Computer Engineering, Faculty of Computing and Informatics Sciences, Karabuk University, Karabuk, Türkiye
Operationalizing Cyber Threat Intelligence with GraphRAG
Aug 13, 2026Atul Kabra, Prakhar Paliwal, Manjesh K. HanawalCyber Threat Intelligence Graph Retrieval-Augmented Generation
MLiONS, Department of IEOR, IIT Bombay Mumbai, Maharashtra, India
A Multi Method Importance and Performance Efficiency Analysis of Topological Metrics for Natural Visibility Graph Based Cyber Attack Detection
Oct 1, 2026Ali Melih Kanca, Ilker TurkerNetwork Intrusion Detection Feature Selection
Department of Computer Engineering, Faculty of Computing and Informatics Sciences, Karabuk University, Karabuk, Türkiye

Sep 22, 2026J/K move · Enter open · S save

Topological Signatures of Cyber-Attack Classes in Natural Visibility Graph Representations of Network Traffic

Ali Melih Kanca, Ilker Turker

Department of Computer Engineering, Faculty of Computing and Informatics Sciences, Karabuk University, Karabuk, Türkiye

Network Intrusion Detection Graph Classification Topological Representation Learning

Open paper AskPDF arXiv

Natural Visibility Graph (NVG)-based representations provide a promising approach for capturing structural patterns in sequential network traffic. However, whether different cyber-attack classes exhibit distinctive topological signatures in such representations remains insufficiently understood. This study investigates the discriminative and structural characteristics of NVG-based network traffic representations using the CSE-CIC-IDS2018 dataset. Seventy-six numerical traffic features were independently transformed into NVGs within overlapping frames of 40 observations, and ten graph-theoretic metrics were extracted from each graph, resulting in 760 topological descriptors per frame. The discriminative capability of these representations was evaluated using a multi-branch convolutional neural network (CNN) with stratified five-fold cross-validation. The model achieved an average accuracy of 96.20% and a Matthews correlation coefficient (MCC) of 0.9566. To characterize class-specific topological differences, Kruskal-Wallis and Mann-Whitney U tests were combined with Benjamini-Hochberg false discovery rate correction and effect-size measures. Of the 10,640 attack-versus-benign comparisons, 7,777 (73.1%) remained statistically significant after FDR correction, with 4,844 exhibiting large Cliff's delta effects. The strongest global differences were predominantly associated with backward-traffic and packet-length-related features combined with connectivity, clustering, and centrality measures. These findings indicate that NVG-derived representations can provide strong discriminative capability while revealing class-dependent topological patterns associated with different cyber-attack classes.

Abstract

Cybersecurity

Explore similar work

Topological Signatures of Cyber-Attack Classes in Natural Visibility Graph Representations of Network Traffic

Operationalizing Cyber Threat Intelligence with GraphRAG

A Multi Method Importance and Performance Efficiency Analysis of Topological Metrics for Natural Visibility Graph Based Cyber Attack Detection