Automated graph learning dominates cyber attack detection research
A Quantitative Analysis of Graph Representation Strategies for Cyber Attack Detection
Artificial Intelligence
Summary
Cybersecurity teams use graphs—networks of connected data points—to spot cyber attacks. This study looked at 37 recent papers to see how these graphs are created and represented. They found most studies use automated ways to learn these graph features rather than handcrafted ones. The choice of how to represent the graph depends on the specific cybersecurity problem being tackled. This helps show which techniques are popular and where different methods work best.
What this means in practice
- •For cybersecurity engineers: Select appropriate graph representation strategies tailored to specific cyber attack detection tasks for improved analysis.
- •For network analysts: Use insights into graph learning methods to choose effective detection approaches for analyzing network security events.
A survey. It maps existing work.
Authors
Ali Melih Kanca, Ilker Turker
Abstract
Graph based cyber attack detection studies employ various graph construction and representation strategies across different cybersecurity application domains. This diversity motivates a quantitative examination of how representation strategies are distributed across these application domains. This study presents a quantitative analysis of 37 original studies published between 2019 and 2026. Each study was coded according to publication year, application domain, graph representation type, feature extraction strategy, learning paradigm, algorithm, and dataset. Frequency analysis, cross tabulation, and statistical association tests were applied. Automated representation learning was the most frequently employed strategy, accounting for 73.0% of the studies, while handcrafted representation strategies accounted for 27.0%. The Fisher Freeman Halton exact test revealed a statistically significant association between application domain and representation strategy (exact p = 0.008; Cramer's V = 0.540). The findings indicate that automated representation learning predominates within the analyzed corpus and that the distribution of representation strategies differs across cybersecurity application domains.