arXiv CSopen access

Concept drift mitigation through community and spectral graph analysis for the detectionof cyberattacks in network traffic

Concept drift mitigation through community and spectral graph analysis for the detection of cyberattacks in network traffic

arXiv:2609.09442v1 [cs.CR] 8 Sep 2026

Julien Michela,b , Abdul Qadir Khana , Majed Jabera,b , Pierre Parrenda,b a

Laboratoire de Recherche de l’EPITA, 14-16 Rue Voltaire, Le Kremlin-Bicêtre, 94270, France b ICube, UMR7357, Université de Strasbourg, Strasbourg, 67000, France

Abstract In network traffic, legitimate behaviours and attack techniques evolve jointly — the phenomenon known as ‘concept drift’. Every detector is thereby left obsolete between two updates, and always one step behind adversaries. In this work, we propose to move the point of intervention from the model, repaired after the drift, to the feature space, selected before learning. We therefore introduce t-robustness, a stability score defined for each feature independently of any detection model, comparable across an entire feature space. It combines the step-by-step distance between successive statistical states of a feature, and its cumulative divergence from its initial state, so that a slow monotonic drift cannot pass for stability. The candidates are drawn from abnormal network connectivity patterns left by scans, DoS and communications between endpoints, read through graph community metrics and spectral metrics. The evaluation is performed on the UGR16 dataset, across three learning scenarios and a control scenario, as well as without model update, and demonstrate that t-robust feature spaces sustain detection where the baselines collapse: retained expectancy at the last test interval reaches 0.6025, against 0.5230 for graph community features and 0.3831 for the base NetFlow features. Keywords: Attack detection, Time robustness, Concept drift, Feature Email addresses: [email protected] (Julien Michel), [email protected] (Abdul Qadir Khan), [email protected] (Majed Jaber), [email protected] (Pierre Parrend)

engineering, Graph community, Spectral metrics 1. Introduction The detection of anomalies in evolving networks that are affected by concept drift [1] is a complex and open challenge [2]. Internet access networks are a typical instance of such systems: user behaviours evolve continuously, and sustaining attack detection performance over time is a major challenge. We define concept drift in detection as the evolution of detection targets within an ever-changing environment over time [3]. This phenomenon is both a cause and a consequence of significant changes in data features. Concept drift is by nature tied to the feature space, that is, to the value space of communication packet parameters such as latency or size. The feature space can therefore be evaluated quantitatively over a given time frame. A feature space subject to high concept drift does not represent the general behaviour of the data; it only captures the patterns of the time period in which learning occurs. The challenge is therefore to identify a feature space which characterises the detection targets of the environment at any given time. A feature space less vulnerable to concept drift supports the construction of more time-robust machine learning pipelines. The requirement for such a feature space is to represent attack behaviours in a way which remains distinct from the normal data of the environment over time: it maintains its discriminative power for attack identification independently of external factors. Existing approaches detect concept drift and then adapt the learning model, a process which requires frequent model updates and substantial time and resources [4]. The complementary question — which features remain discriminative over time — is largely left aside: reviews of concept drift in intrusion detection systems emphasise the lack of research addressing the intersection of concept drift and feature drift [5], although feature stability is a determining factor of the long-term effectiveness of machine learning models [6]. We consider three families of candidates for time-robust features: original packet features, derived graph community metrics [7], and derived spectral metrics [8]. Popular approaches for graph models for intrusion detection explore implicit feature analysis through embeddings [9],through supervised or unsupervised learning models [10]. However, recent evaluations demonstrate 2

that the increase complexity of embeddings is not correlated with improved detection capabilities [11]. Two motivations support the use of graph community metrics and spectral metrics. First, topology-based graph metrics have few dependencies in their construction, which makes them resilient to data evolution [12]: fewer dependencies entail greater robustness against concept drift. Secondly, attack behaviours affect network structures such as communities in a manner which differs from the heterogeneous activity of legitimate traffic. Graph-based metrics are therefore more resistant to attacker strategies, since they do not rely on information which can easily be reconstructed. To define and evaluate robust feature spaces, we structure our work around three research questions: RQ1: How can concept drift be quantified in communication data?; RQ2: How can this quantification be used to build a feature space which remains robust over time?; RQ3: Are graph community metrics and spectral metrics relevant candidates for building a long-lasting feature space for attack detection? To answer these questions, we assess detection performance with feature sets enriched with graph community metrics and with spectral metrics in a concept drift context. We define metrics which quantify drift relatively to each feature of the feature space, and evaluate the stability of these features in the dataset. By combining graph community metrics and spectral metrics with feature stability metrics, we build a time-robust — hereafter t-robust — feature set, and evaluate its detection performance under concept drift. The proposal is validated over three learning scenarios and a control scenario on the UGR16 dataset [13, 14]. Models relying on the t-robust set prove more stable over time and achieve a better retained expectancy than models relying on the base set, on graph community metrics or on spectral metrics alone: the proposed metric retained expectancy has a value of 0.6025 at the last test interval of scenario 1, against 0.5230 for the graph community set and 0.3831 for the base set. The remainder of this paper is structured as follows. Section 2 presents the related research. Section 3 explains the impact of cyberattacks on network topologies and on graph metrics. Section 4 defines the metrics and the requirements of the proposed robust feature spaces. Section 5 provides the evaluation methodology and the implementation details. Section 6 presents 3

the results and the performance evaluation. Section 7 discusses the contribution of the proposed feature spaces and elicits further research challenges. Section 8 concludes the paper. 2. State of the art Concept drift denotes a change in the relationship between the detection targets, i.e. the elements of the data which carry the decision, and their environment, i.e. the data which the detection model treats as irrelevant [3]. It is to be distinguished from data drift, which is a shift in distribution between a training set and a test set [15]: under data drift the underlying behaviours are preserved and only their frequency changes, whereas concept drift redefines the behaviours themselves. The consequence for detection is direct. A drift which leaves the observed distribution of the data unchanged can nonetheless invalidate the decision boundary, so that concept drift is at once harder to observe and more damaging than data drift. The literature answers this difficulty with a family of Concept Drift Detection (CDD) approaches. We review these approaches below, then examine how the security domain exploits them, before establishing the position from which our own contribution proceeds. 2.1. Concept drift analysis Concept drift detection methods differ by the observable they monitor: the distribution of the features, the parameters of the drift episode, or the geometry of the data cloud. Three families localise, date and qualify the drift, yet none of them prevents it. Their common output is an event — a drift has occurred — whose only possible consequence is an intervention on the model. The Parallel Histograms through Time (PHT) model [16] monitors the first of these. It follows, for each relevant feature, the evolution of its distribution within sliding windows centred on the mean, which localises drift both in time and across the feature set. Drift is thereby made visible feature by feature, but the model stops at this visualisation: the exploitation of the localisation it produces is left to the analyst. QuadCDD [17] monitors the drift episode itself, which it describes with four parameters: the drift start, the last point at which the current data profile still holds; the drift end, the point at which the accuracy of the detection model falls below a chosen threshold; the drift type — incremental, 4

abrupt, recurring or gradual — which qualifies the transition between these two points; and the drift severity, which quantifies through accuracy rates the impact of the episode on the model. These parameters serve to adjust the model to the episode which has just been characterised: stability in the data stream is obtained by reaction. The Typicality and Eccentricity Data Analytics-based Concept Drift Detector (TEDA-CDD) [18] monitors the geometry of the data. It maintains a reference model, compares it with the current model by means of the Jaccard index and of Euclidean distances, and declares the current model abnormal — hence a drift — when the deviation becomes significant. Its value lies in dispensing with labels and in operating at low computational and memory cost, which makes it applicable to data streams. Its output, however, is an alarm bearing on the data as a whole and not a diagnosis at the level of the individual features. [19] defines density-aware learning dataset selection assisted with unsupervised generative labelling to leverage data geometry for detection in the presence of concept drift. Such an intervention is indeed required, since the efficiency of a detection system confronted with drift declines until detection performance drops sharply, both the detection target and its environment having moved [20]. Mitigation therefore consists in modifying the way the model learns and adapts [21], and no adaptation strategy is universal: the appropriate choice depends on the model, on the type of drift and on its intensity. Performancedriven strategies, the most widespread, update the learning model when its accuracy degrades, and are consequently no more reliable than the detection model whose degradation they measure. Distribution-driven strategies instead measure the distance between two data profiles, with a distance chosen according to the type of drift. Both share one prerequisite: the moment of the drift and the process which generates it must be identified before any correction can be applied. Tailored solutions can be devised for a given drift scenario and a given learning model, but in real data streams this identification is computationally expensive and cannot be sustained over time. Robust, long-lasting and generalisable solutions are needed instead. Adaptive learning [22] is one attempt in this direction: it takes several data streams as input and uses the correlations between them as a stable parameter, which allows it to outperform baseline models on six of the eight datasets evaluated under concept drift. The gain is obtained by seeking an invariant rather than by tracking the drift — a change of perspective which the present work carries over to the features. 5

The features are indeed the level at which an invariant may be sought, since they constitute the interface through which drift reaches the model. Feature spaces built over the same dataset do not undergo drift with the same severity [23], which establishes the feature space as a design variable of the detection problem rather than as one of its givens. When the statistical evolution of the features becomes strong enough to degrade detection, feature drift affects the subset of the feature space on which the learning model relies [24]. Feature drift is thus the measurable manifestation of concept drift, and the level at which a preventive treatment, rather than a reactive one, can be defined. 2.2. Concept drift and stability The key property for concept drift analysis is stability. Kalousis et al. [25] measure the stability of the feature preferences an algorithm expresses — weights, ranks, or a selected subset — by similarity indices across perturbed training sets. Nogueira et al. [26] gave the question axiomatic form, requiring a stability estimator to be fully defined, strictly monotone in the variance of the selection, bounded independently of the dimension, maximal only under deterministic selection, and corrected for chance. Invariant risk minimisation [27] seeks, one level higher, a representation whose optimal classifier holds across given environments. All three perturb the sample or presuppose the environments: none is indexed by time, and none returns a verdict on an individual feature. Hinder et al. [23] gives a formal notion of concept drift grounded in a distribution process. Let T denote a time domain and X the feature space of a data stream. A distribution process is a pair (Dt , PT ), where PT is a probability measure over T and Dt is a family of distributions over X indexed by t ∈ T , such that each observation Xi is drawn as Xi ∼ Dti for its associated observation time ti ∼ PT . The process Dt is said to exhibit drift if there is a strictly positive probability of drawing two time points with different underlying distributions, i.e. Pt1 ,t2 ∼PT [Dt1 ̸= Dt2 ] > 0.

(1)

Equivalently, drift holds if and only if the data X and the observation time T are not statistically independent, X ̸⊥⊥ T, 6

(2)

when (X, T ) is distributed according to the holistic distribution obtained by time-stamping each sample. A drift detector is then formalized as a decision procedure An : (T × X )n → {0, 1}

(3)

operating on a finite sample, which is called valid if the asymptotic falsealarm rate on non-drifting streams stays strictly below its asymptotic truedetection rate on drifting streams, and surely drift-detecting if it converges to the correct decision with probability one as the sample size grows. 2.3. Concept drift in attack detection Attack detection is a worst case for the reactive schemes described above, for three converging reasons. Attackers adopt new tools and new attack vectors as soon as these become available [28]; they alter their tactics precisely because Security Operations Centres (SOCs) track them [29]; and the environment is no more stable than the target, since new legitimate behaviours appear throughout the lifecycle of a network [30]. Drift is therefore permanent, partly adversarial, and simultaneously affects the detection target and its background. A defence which waits for drift to be measured before reacting is by construction one step behind an adversary who chooses the moment of the change: the representativity of learning data is therefore a well identified challenge [31]. Concept drift has received particular attention in malware detection, where classifiers trained on historical samples degrade rapidly as attackers evolve their techniques and the underlying data distribution shifts over time. Pendlebury et al. [32] exposed how spatial and temporal biases in experimental design inflate reported performance, proposing the TESSERACT framework and the AUT metric to enforce temporally consistent evaluation and reveal the true, drift-degraded performance of malware classifiers. Building on this evaluative foundation, Barbero et al. [33] revisited the Transcend conformal-evaluation approach [34], showing that its original drift-detection thresholds were miscalibrated and introducing a more robust, statistically grounded rejection mechanism that better isolates drifting samples before they corrupt classifier decisions. Chen et al. [35] shifted the focus from the model to the feature space itself, analyzing which features are most responsible for drift in malware detectors and questioning whether the field’s growing reliance on multi-source, feature-space explanations of drift is proportionate to the actual gains they deliver over simpler baselines. 7

A review of concept drift detection in intrusion detection systems (IDS) [5] ascribes the difficulty of detecting and categorising drift to three obstacles — the high dimensionality of the data, class imbalance, and the optimisation of the learning model — and designates the intersection of concept drift and feature drift as a blind spot of the field. The works which do reach the feature level confirm this diagnosis while remaining reactive in their principle. The DI-NIDS (Domain-Invariant Network Intrusion Detection) framework leverages Domain-Adversarial Neural Networks (DANN) to tackle concept drift [36]. After training on labelled and unlabelled date, the authors exploit the feature extraction branch of the DANN to obtain the domain invariant features. Then, they apply one-class Support Vector Machines or One-Class SVM (OSVM) on the extracted features to build a model for cross-domain anomaly detection. The FeSAD framework [37, 38] pursues the same objective for a learning-based ransomware detector, with the explicit aim of extending its lifespan: drift severity is quantified with the Heterogeneous Euclidean Overlap metric, the model is retrained on a core feature set, and a genetic algorithm generates a new set of features whenever drift intensity exceeds a predefined threshold [39]. Recda framework [40] favours noise generation during the initial learning phase combined with manually crafted sampling at fine-tuning to reduce the dependency on labelled learning date. In each of these cases, the feature space is repaired once the drift has been observed. Its stability is an outcome of the procedure; it is never a criterion applied before selection. 2.4. Positioning of the contribution The state of the art thus converges on a single loop: characterise the drift by its severity and its type, then update the model, at a cost in time and resources which recurs at each episode [4]. The limitation of this loop lies not in the quality of its detectors but in its structure, which can only yield models that are already outdated at the moment they are replaced. Feature stability, whose role in the long-term effectiveness of learning models is established [6], offers a way out of the loop, on the condition that it be measured on the features themselves rather than inferred from the degradation of a model. Two properties of the security context make such a measurement worthwhile. Concept drift is mediated by the feature space, and the resistance of features to drift is unequal within one and the same detection problem. Attacks, for their part, are constrained by their objectives. An adversary who alters the traffic her campaign emits is not free to alter it arbitrarily: 8

every modification must leave the campaign still capable of achieving what it was mounted to achieve. This is the constraint which the problem-space formulation of adversarial machine learning makes precise [41], and which the attacker models proposed for network intrusion detection translate into the capabilities an adversary realistically holds over network traffic [42]. Features which are simultaneously discriminative for attacks and stable over time should therefore be identified. We consequently formulate the hypothesis which this paper sets out to demonstrate: a stable feature space can be constructed a priori, by quantifying the statistical evolution of the features — their feature drift — and by retaining those features which represent attack behaviours consistently over time. Establishing this hypothesis requires three elements, which the remainder of the paper provides in turn: a family of candidate features whose construction depends little on the volatile parameters of traffic, namely graph community metrics and spectral metrics (Section 3); a measure of drift defined at the level of the individual feature and independent of any detection model (Section 4); and an experimental protocol which evaluates detection performance along the time axis rather than at a single point (Sections 5 and 6). 3. Graph connectivity models Access networks are heterogeneous environments whose traces are generated by continuously evolving behaviours, among which attacks of several kinds occur. In an attack detection pipeline, the features are the first component over which the designer retains control: the representation chosen for the data determines what the learning model is in a position to discriminate. This section establishes the first of the three elements announced in Subsection 2.4, namely a family of candidate features whose construction rests on the topology of the exchanges rather than on the volatile parameters of the traffic. The argument proceeds in three steps. We first show that attacks inscribe in the connectivity of the network a small number of motifs which are dictated by their objective and which recur from one occurrence to the next (Subsection 3.1). We then derive from these motifs two families of measurements: graph community metrics, which partition the graph and characterise the resulting groups (Subsection 3.2), and spectral metrics, which summarise the whole graph through the spectrum of its Laplacian (Subsection 3.3). The demonstration is conducted on the UGR16 dataset [14].

9

3.1. Impact of cyberattacks on network topologies Attacks observed in access networks differ in their operating methods, and our aim is to represent them in a way which exposes the process by which they proceed, so that the information essential to that process can be extracted from the representation itself. We therefore analyse two dynamic graph representations, which carry complementary information: in the first, nodes are machines, i.e. IP addresses (IP/IP graph); in the second, nodes are services, i.e. pairs formed by an IP address and a service port (IP,Port/IP,Port graph). The comparison between the two granularities is itself part of the analysis, since a motif invisible at one scale may be manifest at the other.

Figure 1: Graph representations of ports scans in UGR16 dataset (scan11 and scan44)

Among the phases of the cyber kill chain [43], two govern what is observable in connectivity. Exploration, during which the attacker probes the target network, has reconnaissance as its purpose. ‘Actions on Objectives’, during which the attack produces its actual effect, aims at altering one or several of the Confidentiality, Integrity and Availability (CIA) properties of the victim [44]: a breach of confidentiality is typically data theft, a breach of integrity the alteration of data or of configurations, and an attack on avail10

ability is generally a denial of service. Both phases require the attacker to establish exchanges which would not otherwise take place. We consequently restrict our attention to the attacks which create new connections and thereby modify connectivity patterns, since these are the attacks which graph connectivity models are able to expose: broadcast attacks such as scans and denials of service, and targeted attacks between otherwise unrelated nodes, such as endpoint-to-endpoint injections of malicious commands. Reconnaissance collects information on a system in order to map it and to locate its vulnerabilities [45]. Port scans belong to this category, their purpose being to identify the service ports left open on a device. Figure 1 displays the dynamic graph representations of the port scans of the dataset. The IP/IP graph associates one victim with each attacker and remains stable over the successive time steps: at this granularity the attack exhibits no discernible evolution. The same attack is unambiguous in the IP,Port/IP,Port graph. Each attacker-victim pair is initially rendered by several components, most of them star graphs centred on the attacker; the remaining ones depart from the star by one or two edges while still being bipartite [46]. As the attack progresses, the number of attacker nodes increases, which reflects the opening of connections from successive ports of the same attacker address. The star components are correspondingly fewer and the bipartite components larger. The port scan is thus not merely visible at the service granularity: its progression is legible in the shift of the component population from stars towards larger bipartite structures.

Figure 2: Graph representations of denial of service type of attacks in UGR16 dataset (DoS)

Denials of service (DoS) constitute a second category. They are single11

step attacks whose objective is to prevent a system or a service from operating [47], and which most commonly proceed by flooding the victim subnetwork with connections issued from the attacker. The method is elementary, yet remains difficult to counter [48]. In the IP,Port/IP,Port graph of Figure 2, the attack is characterised by an abrupt multiplication of attacker nodes converging on a single victim, that is, by a star structure whose central node is the target. The suddenness of the attack leaves no transition phase between the normal regime and the attack regime, and the star is already formed within a capture window of less than one minute. Where the scan is identified by the evolution of its motif, the denial of service is identified by the instantaneous appearance of one.

Figure 3: Graph representations of botnet type of attacks in UGR16 dataset (nerisbotnet)

A third category comprises the attacks whose behaviour differs from one time step to another. The UGR16 dataset contains such a multi-step attack in the form of botnet activity, the Nerisbotnet, whose trace has been recorded and replayed in the dataset and whose dynamic graph is given in Figure 3. Botnets are autonomous malware which traverse the whole kill chain: they identify new victims, perform an initial injection, establish persistence, then restart the cycle in order to propagate. Their behaviours are highly heteroge12

neous when different botnets are compared, but each botnet is highly regular in its own operation — a dissociation which matters here, since regularity per family is what a stable feature can capture. All of them share the property of being installed on individual devices without the knowledge of their owners, the compromised devices then becoming attack vectors available to the operator. Two steps are distinguishable in both representations: an exploration phase and an exploitation phase. During exploration, the IP/IP graph exhibits one markedly large bipartite component, whose extremity nodes are the victims, together with a large number of smaller bipartite components; the corresponding IP,Port/IP,Port graph only exhibits small star graphs centred on the victims. During exploitation, the number of components involved in the attack decreases noticeably in the IP/IP graph, to the point where a single bipartite component may account for the whole attack; as in the exploration phase, the extremity nodes of the largest connected component are almost always victims. In the IP,Port/IP,Port graph, the components remain star graphs, with the exception of one singular star in which the number of attacker nodes surrounding the central victim node increases abruptly. In the dynamic graph, an exploitation phase is invariably preceded by several exploration phases, so that the succession of the motifs, and not only their presence, carries information about the attack. Three properties emerge from these observations, and the remainder of the paper rests upon them. First, the motifs are few and recurrent: star components centred on an attacker or on a victim, bipartite components, and the fragmentation or coalescence of the component population account for everything observed here. Secondly, these motifs are imposed by the objective of the attack — a scan must reach many ports, a denial of service must converge many sources on one target, a botnet must alternate propagation and exploitation — so that an attacker cannot suppress them without abandoning the objective itself. Thirdly, their visibility depends on the granularity of the nodes: the port scan is invisible in the IP/IP graph and manifest in the IP,Port/IP,Port graph, whereas the botnet is legible in both, at different scales. The features derived in the following two subsections are consequently computed at both granularities, and are designed to measure the number, the size, the internal density and the temporal persistence of the components, rather than the value of any parameter of the traffic.

13

3.2. Graph communities Graph community metrics form our first family of candidates for robust features. Their construction has minimal dependencies, requiring only the end-to-end topology of the network and time [49], and the community structures of a network topology are known to be tightly related to attack behaviours [50]. Both properties are those sought in Section 2.4: a construction insensitive to the volatile parameters of the traffic, and discriminative information specific to the attack itself. Two types of graphs are generated from the flow data, here NetFlow captures, in accordance with the two granularities of Section 3.1. In the first, nodes are IP addresses and each edge corresponds to an individual communication, that is, to one NetFlow record. In the second, nodes are pairs formed by an IP address and a port. The graphs are partitioned into communities, from which we compute the average degree of the communities, their number of nodes, their density, their expansion [7] and the NEDIndex [51]. This choice of metrics follows the inventory of motifs established above. The number of nodes and the average degree measure the extent of a component and the concentration of its edges, hence the growth of the stars of a denial of service and the enlargement of the bipartite components of a scan. Density and expansion [7] oppose an internally cohesive community to one whose edges point outwards, which is the formal counterpart of the distinction between a compact community of legitimate exchanges and the bipartite structure left by an attacker addressing many unrelated targets. The NEDIndex [51] completes the set to quantify the internal and external connectivity of communities. The third property established in Section 3.1, the temporal succession of the motifs, requires the metrics to be computed dynamically. We therefore apply time windows of 5 and 20 minutes and derive, for one and the same community between t and t+1, the variations of the average degree (∆degree) and of the density (∆density). We further define Stability as the ratio of similarity between two consecutive states of a community, Vt denoting the set of nodes of the community at time t: Stability =

|Vt ∩ Vt+1 | − |(Vt ∩ V̄t+1 ) ∪ (Vt+1 ∩ V̄t )| |Vt ∪ Vt+1 |

(4)

Stability measures the persistence of a group of nodes across successive states, and thereby renders measurable the transitions which characterise multi-step attacks, such as the passage of the botnet from exploration to exploitation. 14

3.3. Graph spectral analysis Spectral metrics form our second family of candidates [52]. Where community metrics describe the graph after it has been partitioned, spectral metrics characterise it globally, without any partitioning step, through the spectrum Λt of its Laplacian at time t. The two families therefore provide complementary readings of the same connectivity, and their dependencies are of the same nature: the topology of the exchanges and time. The complete detection pipeline builds on spectral graph analysis [53]. Let λi denote the ith Laplacian eigenvalue, i ∈ [1, n], sorted in non-decreasing order, and let Z(t) be the multiplicity of the zero eigenvalue in Λt . Connectedness quantifies the global interconnectivity of the network through its number of components, which the multiplicity of the zero eigenvalue provides directly. It thus addresses the fragmentation and coalescence of the component population observed for the scan and for the botnet. Connectedness is denoted µ1 (t) and is formulated as follows: µ1 (t) =

1 exp Z(t)

exp(1)

(5)

Flooding describes the behaviour of the low, non-zero part of the spectrum, which is associated with the most connected backbone of the graph, and therefore reflects the concentration of exchanges on the central nodes — the signature of the star motif of a denial of service. Let N denote the number of central devices of the monitored network, such as switches and servers, and let µ2 (t) denote flooding:   Z(t)+N X 1 λi (t)  − 1 (6) µ2 (t) =  N i=Z(t)+1

Wiriness captures the variations of the upper tail of the spectrum, which reflect changes in dense or highly weighted interaction patterns. It is denoted µ3 (t): n 1 X (t) µ3 (t) = λi (7) N i=n−N +1 Asymmetry measures spectral dispersion by counting the distinct eigenvalue gaps, and thereby tracks the structural evolution between two consecutive states of the graph, which is the spectral counterpart of the temporal 15

succession of motifs. It is denoted µ4 (t): µ4 (t) = Card {i ≥ 2 ; λi (t) − λi−1 (t) > 10−12 }

(8)

These four metrics are computed on weighted graphs extracted from time windows built from raw traffic traces, the weights being derived from packet counts, byte volumes and rates. Each metric is thereby associated with an operational signal: Connectedness indicates the fragmentation or the merging of components, Flooding an abnormal load around the central devices, Wiriness a regime of high-intensity interaction, and Asymmetry a structural shift consistent with an attack-driven change of topology. Community metrics and spectral metrics thus offer two complementary readings of one and the same connectivity, and both are computed from the topology of the exchanges and from time alone, without reading the value of any traffic parameter. This is what qualifies them as candidates for time-robustness. It does not, however, establish that they are time-robust: robustness is not a consequence of the construction of a feature but a property of its behaviour over time, which has to be measured. Defining that measurement is the object of the following section. 4. Tackling concept drift Concept drift is well characterised in the literature, yet the metrics available to measure it do not answer the question raised in Section 2.4. They report drift either through the degradation of a detection model, which makes the measurement dependent on the very model whose obsolescence is at stake, or through a distance between two profiles of the whole dataset, which returns a single verdict for the entire feature space. Neither form allows features to be compared with one another, which is precisely what the construction of a robust feature space requires. This section supplies the missing instrument: a quantification of drift defined feature by feature and independent of any detection model, together with the conditions under which such a quantification can be evaluated. Four metrics are introduced for this purpose — median-centered cut, state distance, t-equivalency and t-robustness. They form a chain in which each level aggregates the preceding one, so as to provide a single bounded score per feature. Quantifying concept drift. The quantification proceeds in two steps: the feature states of the dataset under analysis are extracted, then stability metrics are computed over these states in order to quantify the drift itself. 16

Feature states represent the statistical state of a feature over a time interval δt . Two states are retained. The standard deviation σ summarises the dispersion of the values. The median-centered cut summarises their distribution: it is a clustering of the values taken by the feature during δt , parametrised by the number of clusters n and by the percentage difference p from the median, a larger n yielding a finer cut. The cut is centred on the median rather than on the mean, which keeps the state representative of the ordinary regime of the feature in traces where extreme values are frequent. State distance is the proportional distance between two feature states, and the first of our stability metrics. It compares the two states bin by bin and sums the absolute differences of the bin proportions, so that a distribution which has been displaced and one which has been reshaped are both detected. With pt1k the proportion of bin k at time t1, pt2k the proportion of bin k at time t2, n the number of bins and k the index of the bin, whose content depends on the proportional distance from the median: Sd =

n X

|pt2k − pt1k |

(9)

k=1

Computed between two consecutive intervals, state distance measures a step, and a step alone. A feature may vary little from one interval to the next and nonetheless move far from its original behaviour by accumulation, which no local measurement detects. t-equivalency, or time-equivalency, closes this gap. It is the average proportional difference of the median-centered cut over n intervals δt , taken with respect to the first state, and is likewise a stability metric. With Sdk , 1 < k ≤ n, the state distance between state k and state 1: equiT = |Sdk |

(10)

Where state distance measures the step, t-equivalency measures the distance covered since the origin. The two are complementary and neither subsumes the other: an abrupt drift followed by a new stable regime is visible to the first and attenuated in the second, whereas a slow monotonic drift is invisible to the first and accumulated by the second. t-robustness, or time-robustness, converts these measurements into the selection criterion the methodology requires. Three constraints govern its definition: the score must be high when the feature is stable rather than when it drifts, it must be comparable from one feature to the next, and 17

it must not be granted to a feature which is stable in one respect only. It is defined as the minimum between, on the one hand, the average state distance averaged with the average standard deviation difference and, on the other hand, the average t-equivalency, over a distribution reduced to the [0, 1] interval. With 1 ≤ k < n, Sdk the state distance and Stddk the standard deviation difference, reduced to the [0, 1] interval, between state k and state k + 1, and equiTk′ the t-equivalency reduced to an interval of t time windows from state k ′ with 1 ≤ k ′ < (n − t): t − robustness = min(

1 − |Stddk | 1 − |Sdk | + , 1 − equiTk′ ) 2 2

(11)

t-robustness estimates the extent to which the marginal distribution Dt (Xj ), pooled over both attack and benign classes, remains invariant across the observation windows used in our pipeline. It is a virtual-drift measure: it quantifies feature-wise stability of P (Xj ) over time, independent of any label information or downstream model. This places our metric in the same family as the feature-wise, marginal two-sample tests surveyed by Hinder et al. (e.g. window-wise Kolmogorov–Smirnov statistics) [23], rather than in the family of methods that test the conditional dependence Y ̸⊥⊥ T | X. Consequently, a feature selected as t-robust is guaranteed to have a stable marginal distribution, which makes no statement about the stability of relationship to the attack label. It is consequently possible, in principle, for a t-robust feature to carry real drift — a shift in P (Y | Xj ) that leaves P (Xj ) unchanged. We therefore adopt the working hypothesis, consistent with prior featuredrift literature [24], that feature-level marginal stability is a computationally tractable proxy for the robustness of the induced classification boundary. Two properties of this definition matter for what follows. The minimum is retained rather than the average, so that a feature is declared robust only if it is stable step by step, in dispersion as in distribution, and stable with respect to its initial state: a feature which drifts slowly but steadily is penalised by the second term even though the first would absolve it. The score is bounded in [0, 1], which makes features rankable against one another and admits a threshold, and is the property on which the selection procedure of Section 5 rests. Requirements to evaluation of robustness to concept drift. A quantification is only as conclusive as the protocol which exercises it. We therefore state the requirements which an evaluation of robustness to concept drift must satisfy, 18

and the conditions which the dataset must meet for the evaluation to carry any weight. Three requirements bear on the evaluation. Quantifying feature drift: a stability measure must be available for every feature of the dataset, so that features can be compared and not merely flagged. Performance of the feature space through concept drift: the behaviour of attack detection models using a given feature space must be observed while drift occurs, and not only before and after it. Feature quality relative to concept drift: for each feature, within a given detection environment, it must be decidable whether the feature belongs to the robust feature set. This third requirement does not reduce to the first. Stability is necessary but not sufficient: a feature whose value never changes is perfectly stable and contributes nothing to detection. Selection must therefore weigh the stability of a feature against its usefulness for the detection objective, which is what the methodology of Section 5 implements. Three conditions bear on the dataset. Continuity: the data must cover a sufficiently long period and contain enough records within it, the operational criterion being that the evaluation of a model displays decreasing performance over time. Time distance: the start and the end of the period must be far enough apart for significant changes of behaviour to appear. Feature drift: the original feature space must itself exhibit some degree of drift, if only partial, since a feature space which does not drift cannot distinguish a robust selection from an arbitrary one. These requirements and these conditions together define what a reproducible evaluation of concept drift mitigation measures demands. The protocol and the dataset which satisfy them are presented in the following section. 5. Methodology and implementation 5.1. Methodology The approaches reviewed in Section 2 identify the type and the severity of a drift and then retrain the learning model, at a recurring cost in time and computation. Our methodology replaces this loop by a selection performed once, upstream of learning, and must therefore establish two things at once: that a feature space selected on stability criteria degrades less over time than the space from which it is drawn, and that this gain is not obtained at the price of the detection performance itself. The protocol described below is organised around this double requirement, and is illustrated in Figure 4.

19

The pipeline comprises four stages. The base dataset is first enriched with the derived features which Section 3 designates as candidates, namely graph community metrics, extracted here with the Louvain algorithm [54], and spectral metrics, derived through the Laplacian Matrix of the graph. Feature states are then extracted from the enriched dataset at regular time intervals, and the drift of each feature is quantified by the state distance and t-equivalency measures of Section 4 between consecutive intervals. The trobustness of each feature is computed from these two measures, and features are ranked accordingly. Features whose t-robustness falls below a predefined threshold are finally discarded, which yields a reduced, time-robust feature set.

Figure 4: Methodology and interaction between the models and the data

Ranking on t-robustness alone would satisfy the stability requirement and fail the performance one, for the reason stated in Section 4: a feature which never varies is maximally stable and carries no information. Selection therefore combines two criteria — the magnitude of the drift of a feature, measured by its t-robustness, and its relevance to detection in the base scenario, measured by information gain. Only the features which satisfy both are retained as candidates for models whose performance is to be sustained over time. The experimental design isolates concept drift as the explanatory variable. Several scenarios are constructed, each subjecting detection models to a different degree of concept drift; within a scenario, learning and evaluation conditions are held identical and the learning model is held fixed, so that the feature space is the only object which varies between the models compared. Two readings follow from this design. Read across feature spaces at constant 20

scenario, the comparison identifies the features which contribute to temporal robustness. Read across scenarios at constant feature space, it validates the presence of drift in the data — a performance-driven verification which does not presuppose the distribution-driven measurement, and which is therefore independent of it. The selected features are then used to retrain models in all scenarios, and their behaviour is compared with that of the models built on the base feature set. The purpose of the methodology is thus to dispense with the detection of drift in real time and with the continual retraining of models in streaming environments. Features which are inherently more robust to temporal drift within given attack scenarios allow detection models to maintain a reliable performance over extended periods. The effectiveness of the approach is assessed with three quantities, all built on the Matthews Correlation Coefficient (MCC), which we retain because it accommodates the class imbalance of the dataset [55], which have less than 2% of attack data. Worst-case performance: for each detection model and each learning scenario, the MCC is computed over every time period and the worst case is reported, which characterises the floor of the model rather than its average. Retained expectancy: for each model, the ratio of the performance at each time interval to the initial performance is tracked, which expresses the capacity of the model to retain its detection capability over time. Detection rate difference: for each prediction, the difference with the initial detection rate is computed across the intervals. The last two quantities are given a definite form. The MCC rate difference, defined by analogy with the accuracy rate difference [21], measures learning stability in absolute terms: M CC1 − M CC2 (12) M CC1 The retained expectancy rate difference measures it in relative terms, over the whole sequence of intervals rather than between two of them: ∆M CC =

Pk

1 M CCk

∆Retained expectancy = 1 −

k

M CC1

(13)

Both quantify the degradation of detection performance under concept drift, and it is on this degradation, rather than on performance measured at a single point, that the long-term robustness of a feature set is judged. 21

5.2. Implementation The framework is evaluated over three learning scenarios and one control scenario (3+1). The three learning scenarios differ in the reference period used for the initial training, after which the detection algorithms are exposed to concept drift without any model update; they thus differ in how much of the past is known to the model when the drift begins. The control scenario removes the drift altogether: training and testing are performed over the whole time span of the dataset, which is partitioned into training and test sets. The two families of scenarios play distinct roles in the demonstration. The learning scenarios measure the resistance of a feature space to drift; the control scenario measures the performance that the same feature space attains in the absence of drift, and therefore establishes whether the robustness observed elsewhere has been paid for by a loss of discriminative power. Analysis scenarios. Detection performance is evaluated with an XGBoost model [56], applied in turn to the base dataset and to the enriched feature sets containing either graph community metrics or spectral metrics. Learning Scenario 1: the first two days of the UGR16 dataset are assumed to be known. The model is trained on these data, then applied to the remainder of the dataset without update. Learning Scenario 2: the first five days, corresponding to the fifth week of July in the dataset, are used for training. The model is then applied to the rest of the data as in Scenario 1. Scenarios 1 and 2 differ only in the volume of the initial training period, which isolates the contribution of that volume to temporal robustness. Learning Scenario 3: the model is tested on each segment of the UGR16 test dataset, the training data being always drawn from the immediately preceding time frame. This scenario assumes full knowledge of the preceding periods and therefore reproduces the continual retraining strategy of the state of the art. Control Learning Scenario: this scenario represents a setting free from concept drift. Each data segment, except the first, is split into 80% training and 20% test sets, with 5-fold cross-validation to consolidate the results. The 3+1 scenarios are exercised twice: first on the base and enriched feature sets, in order to establish the baseline behaviour and to verify that the data do drift, then on the time-robust feature set obtained by the selection procedure of Section 5.1, the control scenario being reported as Scenario 4. Comparing the two passes yields the evolution of detection performance 22

across scenarios and quantifies the gain attributable to the robustness-driven selection of features. Concept drift in UGR16 dataset. The UGR16 dataset [14] is used throughout the evaluation. It comprises network traffic collected between the fifth week of July 2016 and the fourth week of August 2016, and satisfies the three conditions stated in Section 4. It satisfies continuity, since it offers an uninterrupted time series over its period, with no missing interval, which allows detection performance to be compared across time segments; a dataset lacking such continuity, or covering too short a span, cannot expose the effects of concept drift at all. It satisfies time distance, its span of two months being sufficient for behaviours to change appreciably between the two ends of the period. It satisfies feature drift, since its background traffic is drawn from real network traces collected by an Internet security provider: the evolution of the environment is that of an operational network and not an artefact of the construction of the dataset, which is what makes the observed drift representative of the drift encountered in practice. For the purposes of the experiments, each weekly file of the UGR16 test dataset is split into two segments along the time axis. Every segment except the first in chronological order is used as a test frame in the evaluation. 6. Evaluation The evaluation establishes, in four steps, whether a feature space selected on t-robustness criteria sustains the detection of cyberattacks in network traffic under concept drift, in a classification task marked by pronounced class imbalance. The four steps answer four distinct questions. The baseline performance assessment determines what each feature space achieves when no drift occurs, by evaluating models trained under the control scenario. The robust feature selection applies the methodology of Section 5 to identify the features which are temporally robust. The robustness evaluation under concept drift measures the behaviour of the resulting feature space over the three learning scenarios of Section 5.2, the control scenario being retained as a reference. The analysis of feature space properties finally computes the statistical properties of the robust feature spaces obtained, so as to independently corroborate the performance measurements.

23

1 Base set 0.9 GC set 0.8 t-robust set 0.7 0.6 0.5 0.4 0.3 0.2 0.1 0 1-2 2-1 2-2 3-1 3-2 4-1 4-2 5-1 5-2 a. CART Decision Tree

MCC

MCC

6.1. Baseline The results reported in the remainder of this section are obtained with XGBoost. Before exploiting them, we verify that the phenomena observed are not an artefact of that choice of learning model. Figure 5 gives the evolution of the MCC of two further models, CART [57] and MLP [58], over the same learning scenario 1 and the same feature sets as the XGBoost model of Figure 6.a. The CART model behaves in the same way as the XGBoost model, with slightly lower initial performances and a marked drop at 3-1, where the t-robust model falls to an MCC of 0.2596; it nonetheless achieves the best MCC of all models of scenario 1 over the 3-1, 4-2, 5-1 and 5-2 periods. The MLP model performs poorly throughout, which reflects the high specificity of neural network based models rather than a property of the feature spaces being compared. Two further models could not be evaluated: KNN [59] could not be fitted on the graph features within a reasonable time given our computational resources, and E-GraphSAGE [60], although considered, proved unsuited to the scale of our graphs, having been designed for a high number of edges over a few dozen nodes whereas the graphs considered here are sparse. The comparison therefore supports the transposition of our results to CART, the remaining families of models being out of reach under our constraints. 1 Base set 0.9 GC set 0.8 t-robust set 0.7 0.6 0.5 0.4 0.3 0.2 0.1 0 1-2 2-1 2-2 3-1 3-2 4-1 4-2 5-1 5-2 b. Multi-Layer Perceptron

Figure 5: MCC evolution over learning scenario 1 for base, graph community, and t-robust sets with CART and MLP models. The x-axis denotes the capture period (week-segment notation N-M) according to scenarios with N the capture week and M ∈ {1, 2} the week period.

24

6.2. Graph structural metrics We evaluate our models, which we build over different feature sets, on four different scenarios. The Base set is comprised of the P ackets, Bytes, Duration, DestinationP ort, SourceP ort and T oS features. The Base set evaluations are represented by the blue curves of Figure 6. Likewise, the green curves represent the Graph set which include the features of the Base set, enriched with two graph structural metrics: the Average_node_degree and the Density of the whole graph. This two metrics translate to eight new features over, the two type of graphs and the two time windows of 5 and 20 minutes. On the control scenario, which is a static 5-fold cross-validation evaluation, the Graph set model exhibits an higher MCC than the Base set model over all the capture period. Whereas, on the scenario 3, which display multiple models behaviors on short-term drift, the Graph set models are consistently underperforming compared to the Base set. Nevertheless, on the long-term drift scenarios 1 and 2, while the initial performance at 1-2 of the Graph set models are outperformed by the Base set, they show better average performances over time, which raises interest over graph structural metrics resilience to concept drift. 6.3. Graph community metrics Baseline evaluation on control learning scenario. The control learning scenario of Figure 6 evaluates the capability of the learning model in the absence of concept drift: detection is evaluated by 5-fold cross-validation applied independently to each time segment. What it measures is therefore a performance ceiling, the detection capability attainable by each feature space under stable conditions. It answers the question which the robustness measurements cannot answer on their own, namely whether robustness has been obtained at the expense of discriminative power. The enriched feature set, referred to as the GC set, attains the highest ceiling, with an average MCC of approximately 0.989 over the dataset, against 0.9336 for the base feature set, and 0.987 for the Graph set. The time-robust set, or t-robust set, reaches 0.9750. Selection on temporal robustness thus costs less than one point of MCC with respect to the full enriched set and remains more than four points above the base set: reducing the feature space does not degrade classification quality under stable conditions. Selection of robust features. A robust dataset requires a restricted set of features. The selection, set out in Table 1, rests on two criteria — the 25

Features ToS Source Port Nb_of_nodes_c_ipport5 Nb_of_edges_c_ipport5 delta_Node_ipport20 Duration delta_expansion_ipport5 delta_Node_ipport5 edges_dist_ipport5 stability_ipport5

1-1 Coverage 1157 10544 70 167 102 458 0 17017 290 203

t-robustness 0.99984 0.96945 0.93705 0.93680 0.92512 0.90899 0.89568 0.89492 0.88725 0.88429

Selected Yes Yes Too low coverage Too correlated Yes Yes Too low coverage Yes Yes Yes

Table 1: Highest t-robustness features in UGR16 dataset, with coverage from XGBoost training on the 1-1 time interval, and rule for dropping columns: a feature is dropped if its coverage in training is below 100, or if it is too strongly correlated with a feature of higher coverage or with a feature already dropped

t-robustness of a feature and its coverage in the XGBoost model trained over the 1-1 time interval — which are the operational counterparts of the two conditions stated in Section 4: stability over time, and usefulness for detection. The procedure comprises three steps: 1) pre-selection, features whose t-robustness exceeds 0.75 are retained; 2) coverage filtering, among these, features whose coverage exceeds 100 are retained; 3) correlation check, a feature is discarded when it is correlated above 90% with another feature of higher coverage, or with a feature already discarded. Two observations follow. Features of the original set and features derived from graph communities alike reach a t-robustness sufficient for selection while retaining high coverage, so that the robust space is not obtained by substituting derived features for original ones, but by combining them. Among the graph community metrics, those computed on graphs whose nodes are pairs of IP addresses and ports attain higher t-robustness than the others, which corroborates, at the level of the metrics, the granularity effect established at the level of the motifs in Section 3.1. Robustness to concept drift with graphs and robust features. Detection performance is now compared over Scenarios 1 to 3, between the original dataset and the dataset enriched with derived features, here graph community metrics. Figure 6 gives the MCC of the XGBoost model for each scenario. Sce26

narios 1 and 2 share the same structure and differ only in the volume of labelled data available at the outset: the first two days, that is the 1-1 interval, in Scenario 1; the whole fifth week of July, that is 1-1 and 1-2, in Scenario 2. For the base feature set, performance is almost identical in the two scenarios. For the graph community set it diverges considerably, with an average MCC difference of 0.2227 in favour of Scenario 1 — that is, in favour of the scenario trained on less data. This inversion contradicts the expectation that a longer training period can only help, and it is what motivates the introduction of the t-robust set; we return to it in Section 7. Learning Scenario 3, in which each model is trained on the time interval immediately preceding detection, exposes short-term drift and thereby localises the periods where the behaviour of the data changes appreciably: a sharp drop affects both models between the 3-1 and 3-2 intervals. The two models follow similar trends in this scenario, with a marked drop of the GC set model at 4-2 which the base set model does not exhibit. The decisive observation concerns the 3-2 interval. Detection degrades severely there for every model of Scenarios 1 to 3, with two exceptions: the GC set model of Scenario 1 and the t-robust model, which retain MCC scores of 0.4165 and 0.3164 respectively, where the base set model collapses to 0.0297. At the point where the environment changes most, the two feature spaces built on graph community metrics and on temporal robustness therefore retain an order of magnitude more detection capability than the base space. This is one central experimental result of this study for graph community metrics. 6.4. Spectral metrics This subsection evaluates spectral metrics under the same protocol. The evaluation is conducted on a random sample of 150 000 entries drawn from the UGR16 test dataset, a restriction imposed by the time complexity of the extraction of spectral metrics. The sample is thus a constraint of the method rather than a design choice, and its effect on the results is assessed below. The evaluation process and the experimental setup are those of Section 6.3. Detection performance is compared over Scenarios 1 to 4 between the original dataset, the dataset enriched with derived spectral metrics and the robust selection, referred to respectively as the base set, the spectral set and the trobust set. Figure 8 gives the MCC of the XGBoost model in each scenario. The t-robust set is derived by the procedure of Section 6.3, and comprises the following features: rate, ts2_wiriness_bytes, ts2_wiriness_rate, ts1_wiriness_bytes, 27

1 0.9 0.8 0.7 0.6 0.5 0.4 Base set 0.3 Graph set 0.2 GC set 0.1 t-robust set 0 1-2 2-1 2-2 3-1 3-2 4-1 4-2 5-1 5-2 c. Learning scenario 3: Training on previous period labeled

MCC

1 Base set 0.9 Graph set 0.8 GC set 0.7 t-robust set 0.6 0.5 0.4 0.3 0.2 0.1 0 1-2 2-1 2-2 3-1 3-2 4-1 4-2 5-1 5-2 b. Learning scenario 2: 2 first days and 1-2 are labeled 1

MCC

MCC MCC

1 0.9 0.8 0.7 0.6 0.5 0.4 Base set 0.3 Graph set 0.2 GC set 0.1 t-robust set 0 1-2 2-1 2-2 3-1 3-2 4-1 4-2 5-1 5-2 a. Learning scenario 1: 2 first days labeled

0.9

0.8

Base set Graph set GC set t-robust set

1-2 2-1 2-2 3-1 3-2 4-1 4-2 5-1 5-2 d. Control learning scenario : classification 5-folds on same period

Figure 6: MCC evolution over the different scenarios for base, graph, graph community, and t-robust sets on the XGboost model used. The x-axis denotes the capture period (week-segment notation N-M) according to scenarios with N the capture week and M ∈ {1, 2} the week period. Dashed lines are retained expectancies

ts1_wiriness_rate, P ackets, Bytes, Duration, DestinationP ort, SourceP ort, T oS. Some base features whose t-robustness exceeded the threshold during the extraction of graph community metrics are not selected here. The cause lies in the size of the sample drawn from the original dataset, which is insufficient to establish their stability. The selection threshold was consequently lowered and aligned on the t-robustness of the last feature retained for the GC set, 28

1 0.9 0.8 0.7 0.6 0.5 0.4 0.3 Base set 0.2 GC set 0.1 t-robust set 0 1-2 2-1 2-2 3-1 3-2 4-1 4-2 5-1 5-2 b. Learning scenario 2

MCC rate difference

MCC rate difference

MCC rate difference

1 Base set 0.9 GC set 0.8 t-robust set 0.7 0.6 0.5 0.4 0.3 0.2 0.1 0 1-2 2-1 2-2 3-1 3-2 4-1 4-2 5-1 5-2 a. Learning scenario 1

1 Base set 0.9 GC set 0.8 t-robust set 0.7 0.6 0.5 0.4 0.3 0.2 0.1 0 1-2 2-1 2-2 3-1 3-2 4-1 4-2 5-1 5-2 c. Learning scenario 3

Figure 7: MCC rate difference (plain lines) and retained expectancy rate difference (dashed lines) over learning scenario 1-3 for base, graph community, and t-robust sets. Lower value indicate performance closer to initial detection.

so that the two families are selected at a comparable level of stability. In the control learning case, the three models reach ceiling performance at the 2-2 and 3-1 intervals, as shown in Figure 8.d. The base set here outperforms the spectral and t-robust sets, with an average MCC of 0.9336. The contrast with the control scenario of the graph community evaluation, where the enriched sets exceeded the base set, isolates the sample size as the cause: the spectral and t-robust sets are computed on 150 000 entries, and their lower ceiling measures the cost of that restriction. Scenarios 1 and 2 follow the evaluation process used for graph community metrics. The model trained on the base feature set again performs almost identically in the two scenarios, whereas the spectral set again yields a higher average MCC in Scenario 1 than in Scenario 2, as shown in Figure 8. The inversion observed for graph community metrics is thus reproduced on a different family of derived features, and is therefore not specific to one metric. At the 4-1 interval, the spectral and t-robust sets outperform the base set, as Figure 8.a,b shows. The MCC of all three sets drops significantly between the 3-1 and 3-2 intervals, as shown in Figure 8.c, which once more localises a period of significant change in the data. Between the 4-1 and 5-2 intervals, the MCC of the t-robust and spectral sets is slightly below that of the base set. 6.5. Properties of robust feature spaces The properties of the robust feature spaces are examined through the three quantities defined in Section 5, which characterise performance-driven robustness to concept drift. 29

MCC

1 0.9 0.8 0.7 0.6 0.5 0.4 0.3 Base set 0.2 Spectral set 0.1 t-robust set 0 1-2 2-1 2-2 3-1 3-2 4-1 4-2 5-1 5-2 c. Learning scenario 3: Training on previous period labeled

MCC

1 Base set 0.9 Spectral set 0.8 t-robust set 0.7 0.6 0.5 0.4 0.3 0.2 0.1 0 1-2 2-1 2-2 3-1 3-2 4-1 4-2 5-1 5-2 b. Learning scenario 2: 2 first days and 1-2 are labeled 1 0.9 0.8 0.7 0.6 0.5 0.4 0.3 Base set 0.2 Spectral set 0.1 t-robust set 0 1-2 2-1 2-2 3-1 3-2 4-1 4-2 5-1 5-2 d. Control learning scenario : classification 5-folds on same period MCC

MCC

1 0.9 0.8 0.7 0.6 0.5 0.4 0.3 Base set 0.2 Spectral set 0.1 t-robust set 0 1-2 2-1 2-2 3-1 3-2 4-1 4-2 5-1 5-2 a. Learning scenario 1: 2 first days labeled

Figure 8: MCC evolution over the different scenarios for base, graph spectral, and t-robust sets on the XGboost model used. The abscissas denotes the capture period, written as N-M according to scenarios with N the capture week and M ∈ {1, 2} the week period. Dashed lines are retained expectancies

Worst-case performance: for each model and each learning scenario, Figures 6 and 8 give the worst-case performance. In Scenario 1 (Figure 6.a) the base set model falls to an MCC of 0.0267 at 5-1, whereas the t-robust feature set model reaches 0.0682 at the same interval, which is also its worst performance in this scenario. The same pattern holds in Scenario 3 at the 3-2 period (Figure 6.c), where the base set model falls to an MCC of 0.0464 while the t-robust set model holds at 0.0875. In both cases the floor of the t-robust model lies markedly above that of the base set model, which is the property sought: what a robust feature space improves is not the peak of detection but its lower bound. Figure 8 exhibits no such separation, the trobust set performing close to the base set in all 3+1 scenarios, which follows from the t-robust set selected in the spectral case containing very few base 30

1 0.9 0.8 0.7 0.6 0.5 0.4 0.3 Base set 0.2 Spectral set 0.1 t-robust set 0 1-2 2-1 2-2 3-1 3-2 4-1 4-2 5-1 5-2 b. Learning scenario 2

MCC rate difference

MCC rate difference

MCC rate difference

1 Base set 0.9 Spectral set 0.8 t-robust set 0.7 0.6 0.5 0.4 0.3 0.2 0.1 0 1-2 2-1 2-2 3-1 3-2 4-1 4-2 5-1 5-2 a. Learning scenario 1

1 Base set 0.9 Spectral set 0.8 t-robust set 0.7 0.6 0.5 0.4 0.3 0.2 0.1 0 1-2 2-1 2-2 3-1 3-2 4-1 4-2 5-1 5-2 c. Learning scenario 3

Figure 9: MCC rate difference (plain lines) and retained expectancy rate difference (dashed lines) over learning scenario 1-3 for base, graph spectral, and t-robust sets. Lower value indicate performance closer to initial detection.

features. Sample quality and sample size therefore affect the t-robustness of the features themselves, and not only the performance derived from them. Retained Expectancy: for each model of Learning Scenarios 1 to 3, we evaluate the proportion of the current performance relative to the initial performance, taken at 1-2, or at 2-1 for Scenario 2. It is represented by the dashed lines of Figures 6 and 8. In Scenarios 1 and 2 the tendency is a gradual decline of retained expectancy over time, which is the expected signature of an environment subject to drift and confirms that the scenarios do expose the models to it. Detection Rate Difference: we assess the MCC rate difference and the retained expectancy rate difference with the formulas of Equations 12 and 13, for each model over Scenarios 1 to 3. As Figures 7 and 9 show, the MCC rate difference of the t-robust feature set is consistently lower than that of the other models, and increasingly so in the later time intervals — the degradation of the t-robust models is not merely smaller, it grows more slowly. Three conclusions follow from these measurements. The proposed methodology yields feature spaces which sustain detection performance in the presence of concept drift, and it does so without any update of the learning model. The enrichment of the feature space with graph metrics, whether community or spectral, improves detection, which we ascribe to their capacity to expose anomalous connectivity patterns such as those produced by scans, denials of service or endpoint-to-endpoint communications, in accordance with the motifs established in Section 3.1. The benefit of the two families is however

31

unequal under our experimental conditions, spectral metrics being penalised by the sample size which their computational cost imposes; this asymmetry is examined in Section 7. Graph metrics are therefore a promising approach for the design of robust feature spaces, and the proposed methodology is a practical means to select them. 7. Discussion This section assesses what the experiments establish. We consider in turn the instrument itself — the quantification of drift at the level of the individual feature — and the robustness which the feature spaces built with it exhibit. The evaluation of current experiments and results leads us to the elicitation of novel research challenges, which will pave the way to a still better understanding of these issues to build lasting security detectors. 7.1. Quantifying feature drift Feature drift does not exhaust concept drift, but it is a direct manifestation of it, and it has the property which concept drift lacks: it is observable feature by feature. State distance and t-equivalency measure it independently for each feature, and t-robustness aggregates the two into a single stability score. Being bounded in [0, 1], that score makes features comparable and rankable according to their drift behaviour, which Table 1 illustrates. The instrument therefore provides a principled way of quantifying concept drift in communication data, that supports a verdict per feature rather than per model or per dataset. The performance evaluations of Figures 6 and 8 first confirm that UGR16 is indeed an environment subject to concept drift. Across the learning scenarios, XGBoost models which start from comparable performance diverge over time on identical data subsets. Scenario 1 in Figure 6 shows this plainly: the base set and GC set models yield comparable MCC scores at time step 1–2 and differ significantly by time step 3–2, the GC set proving the more stable of the two. The divergence is not attributable to the models, which are identical, nor to the data, which are the same: it is attributable to the feature space, which is the only quantity that varies. Scenario 2 extends the training data of Scenario 1, and one would therefore expect the GC set model to behave at least as well; it produces notably different results over the same evaluation window. Since the enriched feature

32

space is sensitive to the period over which it is learnt, it is necessary to identify features which are stable over time, and which therefore contribute to the durability of detection performance. This is the objective of the t-robust set, which is built from the t-robustness scores of the individual features. The two criteria under which that set is evaluated, Worst-case performance and Detection Rate Difference, are chosen accordingly to evaluate feature space stability: both bear on the stability rather than on the peak performance of the feature space. The selection cannot rest on stability alone. Resistance to drift is necessary but not sufficient, as the limiting case shows: a feature whose value is constant over time is perfectly stable and contributes nothing to detection. Feature quality must therefore be assessed with respect to a defined detection objective, and selection must balance stability against predictive utility. We obtain the second term from the feature coverage of an XGBoost model during an initial training phase, applied to the complete feature space of the graph community-enriched or spectral metrics-enriched dataset. This dataset satisfies the initial conditions in all the learning scenarios evaluated, which makes it an admissible reference for the measurement. 7.2. Evaluation of concept drift robustness Characterising feature spaces through t-robustness provides a principled way of identifying and understanding concept drift, and of evaluating the capacity of detection algorithms to learn durably. We summarise below what the experiments answer to each of the three research questions of Section 1. RQ1: How can concept drift be quantified in communication data? The quantification proceeds along two independent approaches which corroborate each other. A performance-driven evaluation of the XGBoost model over a series of learning scenarios on the UGR16 dataset establishes the presence of drift. A distribution-driven measurement then computes the feature drift of each feature by combining state distance and t-equivalency, which assigns a drift value to every feature and provides a data-driven basis for evaluating temporal stability. The second route does not presuppose the first, which is what makes the resulting measurement independent of the detection model. RQ2: How can this quantification be used to build a feature space which remains robust over time? The state distance and t-equivalency values yield a t-robustness score for each feature. That score is combined with the information coverage of the XGBoost model in the initial training phase, which measures the relevance of the feature under the original detection conditions. 33

Considering robustness and relevance jointly produces the t-robust feature space, whose purpose is to sustain detection performance over time. The evaluation shows that this construction raises the lower bound of performance rather than its peak, which is the property a detection system in production requires. RQ3: Are graph community metrics and spectral metrics relevant candidates for building a long-lasting feature space for attack detection? For graph community metrics the answer is affirmative and specific. In internet traffic data, and network flow records in particular, features derived from communities built on combinations of IP addresses and port numbers as node identifiers obtain higher t-robustness scores than the analogous metrics derived from full-graph structures or from graphs whose nodes are IP addresses alone. The granularity which Section 3.1 showed to be necessary for the motifs to be visible is thus also the granularity at which the derived metrics are most stable. For spectral metrics the answer is affirmative but conditional: the results are promising despite the smaller sample size on which they were obtained, while the time complexity of their computation remains a practical obstacle. Dynamic graph community metrics and spectral metrics therefore both hold potential for improving the resilience and the longevity of detection models in evolving network environments, the former under our experimental conditions, the latter subject to the computational reservation stated above. Besides addressing the concept drift issue, such improved robustness thus provides a promising framework for detection in the presence in adversarial activity, in particular in the problem-space domain [41, 61] where the attack manipulates real-world objects such as malware or malicious network packets. 7.3. Challenges Our experiments bring out three open issues and three further challenges, which pave the way for an extension of graph metric analyses. Open issues. Three open issues are identified, which pave the way for further investigation on t-robust spaces. The results are heterogeneous across scenarios, which indicates that the parameters governing the selection are not yet sufficiently understood. The t-robust set built on graph community metrics does exhibit a better ceiling performance than the base set in the control scenario, but the spectral evaluation yielded limited results, its t-robustness being degraded on the smaller sample which the computational cost of spectral metrics imposes. The threshold on t-robustness is, finally, established 34

empirically. Further challenges. Quantification of concept drift in data: 1) How can a non-relative quantification of concept drift be obtained, going beyond the quantification of feature drift?; 2) How can the parametrisation of this approach be optimised by fine-tuning? Extraction of robust feature spaces: 1) How can the parametrisation of the learning approach be included in concept drift mitigation?; 2) How can additional derived features be incorporated into the feature space while maintaining robustness to concept drift? Identification of relevant derived features as candidates for robust feature spaces: How can the methodology be adapted to suit unsupervised approaches? 8. Conclusions and Perspectives We have proposed t-robust spaces, which restate the learning problem through a deliberate selection of features, combining base features with implicit features derived from the original traffic traces. t-robustness is a computable, bounded, per-feature stability score that can be evaluated without access to labels or to a downstream model. It goes beyond generic marginal two-sample tests and their single yes/no dependence statistics, and yields a bounded score in [0, 1] that (i) is rankable across features, (ii) is cheap to compute at scale, and (iii) explicitly combines a local and a cumulative notion of stability. By using drift-robustness as a feature-selection criterion rather than as a detection/alarm signal, the proposed approach supports a concrete domain instantiation on NetFlow and cybersecurity use cases with engineered, structurally-motivated features from graph community and spectral metrics, rather than generic synthetic 2-D benchmarks. The proposal has been applied to access network data affected by concept drift, on the example of UGR16. We produce datasets enriched with graph community metrics and with spectral metrics, then extract a t-robust space from the resulting feature set by means of the t-robustness value, which expresses the stability of a feature in the dataset. The feature engineering approach which supports these spaces proceeds in four steps: extraction of the derived features which complement the base features of the target dataset; extraction of the feature states; computation of t-robustness from the intermediate metrics state distance and t-equivalency; and finally detection 35

of the target property, here cyberattacks against access network traffic. The validation compares, over the several learning scenarios, the feature spaces associated with an XGBoost model: the base set, the graph community set, the spectral set, and the corresponding t-robust sets. Two results follow from this comparison with a baseline detection pipeline. The robustness of detection performance over time is strongly improved; and dynamic graph metrics contribute to that stability under evolving network conditions, by comparison with base NetFlow features. Quantitatively, the models built on the t-robust set are on average more stable through time. In learning scenario 1 in particular, the retained expectancy at the last test interval remains at 0.6025 on the UGR16 dataset, against 0.5230 for the GC set and 0.3831 for the base set. The property matters beyond the figures: a detection system whose performance is predictable over time is a system which can be trusted between two retrainings. These observations set the agenda of our future work. The criteria governing the selection parameters and the distances between features require finer tuning, which presupposes more controlled experimental environments in which the relations between concept drift, feature drift and detection model can be characterised more strictly. The influence of sampling, which our experiments show to be considerable, calls for an investigation of its own — and suggests a reversal worth exploring, in which t-robustness would serve as a control metric for the quality of a sample rather than being subject to it. Aknowledgements The research work in this paper has been founded by French DGA RAPID under Damiage project grant, as well as by French Région Grand-Est in XDGMed Contrat doctoral. References [1] J. Gama, I. Žliobaitė, A. Bifet, M. Pechenizkiy, A. Bouchachia, A survey on concept drift adaptation, ACM computing surveys (CSUR) 46 (4) (2014) 1–37. [2] M. Komarchesqui, V. G. D. S. Ruffo, D. M. B. Lent, V. F. Schiavon, M. R. Nakanishi, G. H. K. Nishikawa, L. F. Carvalho, M. L. Proença, 36

A comprehensive survey on concept-drift-resilient network intrusion detection systems, IEEE Access (2026). [3] G. I. Webb, R. Hyde, H. Cao, H. L. Nguyen, F. Petitjean, Characterizing concept drift, Data Mining and Knowledge Discovery 30 (4) (2016) 964– 994. [4] S. Agrahari, A. K. Singh, Concept drift detection in data stream mining: A literature review, Journal of King Saud University-Computer and Information Sciences 34 (10) (2022) 9523–9540. [5] M. A. Shyaa, N. F. Ibrahim, Z. Zainol, R. Abdullah, M. Anbar, L. Alzubaidi, Evolving cybersecurity frontiers: A comprehensive survey on concept drift and feature dynamics aware machine and deep learning in intrusion detection systems, Engineering Applications of Artificial Intelligence 137 (2024) 109143. [6] J. E. van Timmeren, R. T. Leijenaar, W. van Elmpt, J. Wang, Z. Zhang, A. Dekker, P. Lambin, Test–retest data for radiomics feature stability analysis: generalizable or study-specific?, Tomography 2 (4) (2016) 361. [7] J. Yang, J. Leskovec, Defining and evaluating network communities based on ground-truth, in: Proceedings of the ACM SIGKDD workshop on mining data semantics, 2012, pp. 1–8. [8] M. Jaber, J. Michel, N. Boutry, P. Parrend, Cyberattack detection through gpml: Graph processing for machine learning, SoftwareX (2025) 19doi:10.1016/j.softx.2025.102308. URL https://www.sciencedirect.com/science/article/pii/ S2352711025002742 [9] T. Bilot, N. El Madhoun, K. Al Agha, A. Zouaoui, Graph neural networks for intrusion detection: A survey, IEEe Access 11 (2023) 49114– 49139. [10] E. Caville, W. W. Lo, S. Layeghy, M. Portmann, Anomal-e: A selfsupervised network intrusion detection system based on graph neural networks, Knowledge-based systems 258 (2022) 110030. [11] T. Bilot, B. Jiang, Z. Li, N. El Madhoun, K. Al Agha, A. Zouaoui, T. Pasquier, Sometimes simpler is better: A comprehensive analysis of 37

{State-of-the-Art}{Provenance-Based} intrusion detection systems, in: 34th USENIX Security Symposium (USENIX Security 25), 2025, pp. 7193–7212. [12] E. Navruzov, A. Kabulov, Detection and analysis types of ddos attack, in: 2022 IEEE International IOT, Electronics and Mechatronics Conference (IEMTRONICS), IEEE, 2022, pp. 1–7. [13] G. Maciá-Fernández, J. Camacho, R. Magán-Carrión, P. GarcíaTeodoro, R. Therón, Ugr ‘16: A new dataset for the evaluation of cyclostationarity-based network idss, Computers & Security 73 (2018) 411–424. [14] G. Maciá-Fernández, J. Camacho, R. Magán-Carrión, P. GarcíaTeodoro, R. Therón, Ugr’16 dataset (2016). URL https://nesg.ugr.es/nesg-ugr16/ [15] N. A. Ali Abdu, K. O. Basulaim, Machine learning in concept drift detection using statistical measures, International Journal of Computers and Applications 46 (5) (2024) 281–291. [16] H. Gâlmeanu, R. Andonie, Concept drift visualization of svm with shifting window, in: 2024 28th International Conference Information Visualisation (IV), IEEE, 2024, pp. 1–7. [17] P. Wang, H. Yu, N. Jin, D. Davies, W. L. Woo, Quadcdd: A quadruplebased approach for understanding concept drift in data streams, Expert Systems with Applications 238 (2024) 122114. [18] Y. T. P. Nunes, L. A. Guedes, Concept drift detection based on typicality and eccentricity, IEEE Access 12 (2024) 13795–13808. [19] R. Gupta, S. Liu, R. Zhang, X. Hu, X. Wang, H. Benkraouda, P. Kommaraju, P. Cao, N. Feamster, K. Nahrstedt, Generative active adaptation for drifting and imbalanced network intrusion detection, arXiv preprint arXiv:2503.03022 (2025). [20] A. Guerra-Manzanares, M. Luckner, H. Bahsi, Android malware concept drift using system calls: detection, characterization and challenges, Expert Systems with Applications 206 (2022) 117200.

38

[21] J. Lu, A. Liu, F. Dong, F. Gu, J. Gama, G. Zhang, Learning under concept drift: A review, IEEE transactions on knowledge and data engineering 31 (12) (2018) 2346–2363. [22] E. Yu, J. Lu, B. Zhang, G. Zhang, Online boosting adaptive learning under concept drift for multistream classification, in: Proceedings of the AAAI Conference on Artificial Intelligence, Vol. 38, 2024, pp. 16522– 16530. [23] F. Hinder, V. Vaquet, B. Hammer, Feature-based analyses of concept drift, Neurocomputing 600 (2024) 127968. [24] J. P. Barddal, H. M. Gomes, F. Enembreck, B. Pfahringer, A survey on feature drift adaptation: Definition, benchmark, challenges and future directions, Journal of Systems and Software 127 (2017) 278–294. [25] A. Kalousis, J. Prados, M. Hilario, Stability of feature selection algorithms: a study on high-dimensional spaces, Knowledge and information systems 12 (1) (2007) 95–116. [26] S. Nogueira, K. Sechidis, G. Brown, On the stability of feature selection algorithms, Journal of Machine Learning Research 18 (174) (2018) 1–54. URL http://jmlr.org/papers/v18/17-514.html [27] M. Arjovsky, L. Bottou, I. Gulrajani, D. Lopez-Paz, Invariant risk minimization, arXiv preprint arXiv:1907.02893 (2019). [28] N. Liao, J. Wang, J. Guan, H. Fan, A multi-step attack identification and correlation method based on multi-information fusion, Computers and Electrical Engineering 117 (2024) 109249. [29] D. Sgandurra, E. Lupu, Evolution of attacks, threat models, and solutions for virtualized systems, ACM Computing Surveys (CSUR) 48 (3) (2016) 1–38. [30] S. Adepu, A. Mathur, Generalized attacker and attack models for cyber physical systems, in: 2016 IEEE 40th annual computer software and applications conference (COMPSAC), Vol. 1, IEEE, 2016, pp. 283–292. [31] K. J. Mwiga, M. A. Dida, A. Mohsin, I. H. Sarker, A generative ai method for minority class handling in anomaly detection with drift and explainability analysis, New Generation Computing 44 (2) (2026) 13. 39

[32] F. Pendlebury, F. Pierazzi, R. Jordaney, J. Kinder, L. Cavallaro, {TESSERACT}: Eliminating experimental bias in malware classification across space and time, in: 28th USENIX security symposium (USENIX Security 19), 2019, pp. 729–746. [33] F. Barbero, F. Pendlebury, F. Pierazzi, L. Cavallaro, Transcending transcend: Revisiting malware classification in the presence of concept drift, in: 2022 IEEE Symposium on Security and Privacy (SP), IEEE, 2022, pp. 805–823. [34] R. Jordaney, K. Sharad, S. K. Dash, Z. Wang, D. Papini, I. Nouretdinov, L. Cavallaro, Transcend: Detecting concept drift in malware classification models, in: 26th USENIX security symposium (USENIX security 17), 2017, pp. 625–642. [35] Z. Chen, Z. Zhang, Z. Kan, L. Yang, J. Cortellazzi, F. Pendlebury, F. Pierazzi, L. Cavallaro, G. Wang, Is it overkill? analyzing featurespace concept drift in malware detectors, in: 2023 IEEE Security and Privacy Workshops (SPW), IEEE, 2023, pp. 21–28. [36] S. Layeghy, M. Baktashmotlagh, M. Portmann, Di-nids: Domain invariant network intrusion detection system, Knowledge-Based Systems 273 (2023) 110626. [37] D. W. Fernando, N. Komninos, Fesad ransomware detection framework with machine learning using adaption to concept drift, Computers & Security 137 (2024) 103629. [38] D. Fernando, Fesad: Ransomware detection with machine learning using adaption to concept drift, Ph.D. thesis, City, University of London (2024). [39] D. W. Fernando, N. Komninos, Fesa: Feature selection architecture for ransomware detection under concept drift, Computers & Security 116 (2022) 102659. [40] S. Yang, X. Zheng, J. Li, J. Xu, X. Wang, E. C. Ngai, Recda: Concept drift adaptation with representation enhancement for network intrusion detection, in: Proceedings of the 30th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, 2024, pp. 3818–3828. 40

[41] F. Pierazzi, F. Pendlebury, J. Cortellazzi, L. Cavallaro, Intriguing properties of adversarial ml attacks in the problem space, in: 2020 IEEE symposium on security and privacy (SP), IEEE, 2020, pp. 1332–1349. [42] G. Apruzzese, M. Andreolini, L. Ferretti, M. Marchetti, M. Colajanni, Modeling realistic adversarial attacks against network intrusion detection systems, Digital Threats: Research and Practice (DTRAP) 3 (3) (2022) 1–19. [43] E. M. Hutchins, M. J. Cloppert, R. M. Amin, et al., Intelligence-driven computer network defense informed by analysis of adversary campaigns and intrusion kill chains, Leading Issues in Information Warfare & Security Research 1 (1) (2011) 80. [44] S. Samonas, D. Coss, The cia strikes back: Redefining confidentiality, integrity and availability in security., Journal of Information System Security 10 (3) (2014). [45] M. H. Bhuyan, D. K. Bhattacharyya, J. K. Kalita, Surveying port scans and their detection methodologies, The Computer Journal 54 (10) (2011) 1565–1581. [46] A. S. Asratian, T. M. Denley, R. Häggkvist, Bipartite graphs and their applications, Vol. 131, Cambridge university press, 1998. [47] R. M. Needham, Denial of service, in: Proceedings of the 1st ACM Conference on Computer and Communications Security, 1993, pp. 151– 153. [48] H. S. Sharma, M. M. Singh, A. Sarkar, Machine learning-based dos attack detection techniques in wireless sensor network: A review, in: Proceedings of the International Conference on Cognitive and Intelligent Computing: ICCIC 2021, Volume 2, Springer, 2023, pp. 583–591. [49] D. Han, Z. Wang, Y. Zhong, W. Chen, J. Yang, S. Lu, X. Shi, X. Yin, Evaluating and improving adversarial robustness of machine learningbased network intrusion detectors, IEEE Journal on Selected Areas in Communications 39 (8) (2021) 2632–2647. [50] G. Rossetti, R. Cazabet, Community discovery in dynamic networks: a survey, ACM computing surveys (CSUR) 51 (2) (2018) 1–37. 41

[51] M. K. Rahman, Nedindex: A new metric for community structure in networks, in: 2015 18th International Conference on Computer and Information Technology (ICCIT), IEEE, 2015, pp. 76–81. [52] N. E. Martiny, A. S. Veluswamy, Time-evolving graph laplacian spectral analysis for intrusion detection by random forest classifier with community localization and automated llm-based reporting (Jul. 2026). [53] M. Jaber, N. Boutry, P. Parrend, Graph-based spectral analysis for detecting cyber attacks, in: Proceedings of the 19th International Conference on Availability, Reliability and Security, 2024, pp. 1–14. [54] V. D. Blondel, J.-L. Guillaume, R. Lambiotte, E. Lefebvre, Fast unfolding of communities in large networks, Journal of Statistical Mechanics: Theory and Experiment 2008 (10) (2008) P10008. doi: 10.1088/1742-5468/2008/10/P10008. [55] B. W. Matthews, Comparison of the predicted and observed secondary structure of t4 phage lysozyme, Biochimica et Biophysica Acta (BBA)Protein Structure 405 (2) (1975) 442–451. [56] T. Chen, C. Guestrin, Xgboost: A scalable tree boosting system, in: Proceedings of the 22nd acm sigkdd international conference on knowledge discovery and data mining, 2016, pp. 785–794. [57] L. Rutkowski, M. Jaworski, L. Pietruczuk, P. Duda, The cart decision tree for mining data streams, Information Sciences 266 (2014) 1–15. [58] H. Taud, J.-F. Mas, Multilayer perceptron (mlp), in: Geomatic approaches for modeling land change scenarios, Springer, 2017, pp. 451– 455. [59] M. Steinbach, P.-N. Tan, knn: k-nearest neighbors, The top ten algorithms in data mining (2009) 165–176. [60] W. W. Lo, S. Layeghy, M. Sarhan, M. Gallagher, M. Portmann, Egraphsage: A graph neural network based intrusion detection system for iot, in: NOMS 2022-2022 IEEE/iFIP network operations and management symposium, IEEE, 2022, pp. 1–9.

42

[61] J. Cortellazzi, E. Quiring, D. Arp, F. Pendlebury, F. Pierazzi, L. Cavallaro, Intriguing properties of adversarial ml attacks in the problem space [extended version], ACM Transactions on Privacy and Security 28 (4) (2025) 1–37.

43