Graph stages shape network intrusion detection quality and speed
A First-Principles Evaluation of Graph-Based Network Intrusion Detection Systems
Cryptography and Security
Summary
Detecting bad behavior on computer networks often uses systems that analyze network data as graphs. The authors found that different parts of these detection systems, like how data is prepared or grouped, greatly change how well they work. They created a new setup to test these parts fairly, showing that simpler methods can sometimes do better and run much faster than complex ones. This means complex designs aren’t always better for spotting network attacks.
What this means in practice
- •For network security engineers: Choose and tune intrusion detection components by separately evaluating each stage to balance detection quality and system performance.
- •For cybersecurity operations teams: Deploy faster and simpler graph-based monitoring setups that maintain high detection accuracy, reducing resource use and attack surface.
Authors
Rui Zhao, Wajih Ul Hassan
Abstract
Graph-based network intrusion detection systems (GIDS) report strong benchmark detection metrics, but those metrics establish little about deployability. We approach the problem from first principles: rather than inheriting the preprocessing, windowing, and thresholding conventions of each published system, we ask what a controlled comparison requires and impose it uniformly. The result is GIDS-Eval, an evaluation framework that decomposes a GIDS into six interchangeable stages and turns those conventions into explicit experimental variables, so reported performance can be attributed to individual stages instead of whole pipelines. We survey nine representative GIDS, reimplement five of them within GIDS-Eval, and evaluate them on four datasets under one matched protocol. We identify nine recurring evaluation gaps and quantify the impact of each: two crafted edges achieve full evasion against three of the eight detector-dataset pairs with anything to hide; the snapshot window alone accounts for a mean 38.3% relative swing in average precision (AP); aligning preprocessing across systems moves AP by up to 61.8 percentage points for a single detector; and none of the 18 detector-dataset pairs we replay can alert as events arrive. We introduce GIDS-Lite, an encoder-free control built in the same framework, which ranks first by AP on two of the four datasets at up to 575$\times$ lower runtime. Architectural complexity is therefore not a consistent driver of detection quality under our matched protocol on current benchmarks, but it does enlarge the runtime, calibration, and attack surfaces operators must defend.