Network traffic graph patterns reveal distinct cyber-attack types
Topological Signatures of Cyber-Attack Classes in Natural Visibility Graph Representations of Network Traffic
Cryptography and SecurityArtificial Intelligence
Summary
Detecting cyber-attacks often requires recognizing patterns in network data. The authors showed that turning network traffic into special graphs highlights unique shapes for different kinds of attacks. They tested this on a popular dataset and used a neural network to identify attacks with high accuracy. Their work also found specific graph features linked to certain attack types, helping to better understand and detect threats.
What this means in practice
- •For network security teams: Improve cyber-attack detection systems by incorporating graph-based traffic features that distinguish attack types with high accuracy.
- •For data science teams in telecommunications: Develop analytics tools that use graph representations of traffic data to monitor network health and spot anomalies related to attacks.
Authors
Ali Melih Kanca, Ilker Turker
Abstract
Natural Visibility Graph (NVG)-based representations provide a promising approach for capturing structural patterns in sequential network traffic. However, whether different cyber-attack classes exhibit distinctive topological signatures in such representations remains insufficiently understood. This study investigates the discriminative and structural characteristics of NVG-based network traffic representations using the CSE-CIC-IDS2018 dataset. Seventy-six numerical traffic features were independently transformed into NVGs within overlapping frames of 40 observations, and ten graph-theoretic metrics were extracted from each graph, resulting in 760 topological descriptors per frame. The discriminative capability of these representations was evaluated using a multi-branch convolutional neural network (CNN) with stratified five-fold cross-validation. The model achieved an average accuracy of 96.20% and a Matthews correlation coefficient (MCC) of 0.9566. To characterize class-specific topological differences, Kruskal-Wallis and Mann-Whitney U tests were combined with Benjamini-Hochberg false discovery rate correction and effect-size measures. Of the 10,640 attack-versus-benign comparisons, 7,777 (73.1%) remained statistically significant after FDR correction, with 4,844 exhibiting large Cliff's delta effects. The strongest global differences were predominantly associated with backward-traffic and packet-length-related features combined with connectivity, clustering, and centrality measures. These findings indicate that NVG-derived representations can provide strong discriminative capability while revealing class-dependent topological patterns associated with different cyber-attack classes.