RESEARCH · RESEARCH · #1516
NVG metric reduction improves CNN-based attack detection accuracy and cuts runtime 96% (arXiv:2610.02342v1)
This paper evaluates 21 Natural Visibility Graph (NVG) topological metrics for cyber-attack classification on the CICIDS2018 dataset, combining SHAP, grouped permutation importance, Boruta and RFE into a consensus ranking and testing several reduced metric subsets with a CNN. The Top3 metrics (avg_clustering_coeff_median, avg_clustering_coeff_std, avg_clustering_coeff_mean) yielded the highest observed mean results — 97.148% accuracy, 97.055% weighted F1, MCC 0.9675 — versus Full21 (95.999% accuracy, 95.521% F1, MCC 0.9549), while reducing total runtime from 14,961.39 s to 589.22 s (96.06%) under the evaluated setting.
KEY POINTS
- This paper evaluates 21 Natural Visibility Graph (NVG) topological metrics for cyber-attack classification on the CICIDS2018 dataset, combining SHAP, grouped permutation importance, Boruta and RFE into a consensus ranking and testing several reduced metric subsets with a CNN.
- The Top3 metrics (avg_clustering_coeff_median, avg_clustering_coeff_std, avg_clustering_coeff_mean) yielded the highest observed mean results — 97.148% accuracy, 97.055% weighted F1, MCC 0.9675 — versus Full21 (95.999% accuracy, 95.521% F1, MCC 0.9549), while reducing total runtime from 14,961.39 s to 589.22 s (96.06%) under the evaluated setting.
- Shows that importance-guided reduction of NVG metrics can both improve predictive performance and drastically lower computational cost, supporting more practical and efficient NVG-based attack detection.
WHY IT MATTERS
Shows that importance-guided reduction of NVG metrics can both improve predictive performance and drastically lower computational cost, supporting more practical and efficient NVG-based attack detection.