Feature stability improves detection of evolving cyberattacks in network traffic
Concept drift mitigation through community and spectral graph analysis for the detectionof cyberattacks in network traffic
Cryptography and SecurityMachine LearningNetworking and Internet Architecture
Summary
Detecting cyberattacks is hard because both normal user behavior and attacker methods change over time, making existing models out-of-date quickly. The authors suggest focusing on choosing features that stay stable despite these changes, rather than constantly fixing detection models. They introduce a score called t-robustness that measures how steady each feature is over time, helping pick those most reliable for detection. Their tests show this approach keeps attack detection working better compared to older methods, even as attack patterns evolve.
What this means in practice
- •For network security teams: Maintain cyberattack detectors that remain effective longer by selecting stable graph-based features identified by t-robustness to handle evolving traffic patterns.
- •For security software developers: Design network monitoring tools that incorporate spectral and community graph features prioritized by t-robustness to improve detection durability without frequent model retraining.
Authors
Julien Michel, Abdul Qadir Khan, Majed Jaber, Pierre Parrend
Abstract
In network traffic, legitimate behaviours and attack techniques evolve jointly - the phenomenon known as 'concept drift' [1]. Every detector is thereby left obsolete between two updates, and always one step behind adversaries. In this work, we propose to move the point of intervention from the model, repaired after the drift, to the feature space, selected before learning. We therefore introduce t-robustness, a stability score defined for each feature independently of any detection model, comparable across an entire feature space. It combines the step-by-step distance between successive statistical states of a feature, and its cumulative divergence from its initial state, so that a slow monotonic drift cannot pass for stability. The candidates are drawn from abnormal network connectivity patterns left by scans, DoS and communications between endpoints, read through graph community metrics and spectral metrics. The evaluation is performed on the UGR16 dataset, across three learning scenarios and a control scenario, as well as without model update, and demonstrate that t-robust feature spaces sustain detection where the baselines collapse: retained expectancy at the last test interval reaches 0.6025, against 0.5230 for graph community features and 0.3831 for the base NetFlow features.