Natural Visibility Graphs (NVG) map time series into graph structures, capturing spatio‑temporal patterns of network traffic. This work investigates whether distinct cyber‑attack classes exhibit discriminative topological signatures in NVG representations.
The CSE‑CIC‑IDS2018 dataset provides 76 numerical traffic features. Each feature is transformed into an NVG within overlapping windows of 40 observations. Ten graph‑theoretic metrics—connectivity, average degree, degree‑distribution entropy, clustering coefficient, average path length, betweenness centrality, eigenvector centrality, local efficiency, global efficiency and spectral radius—are extracted, yielding 760 topological descriptors per frame.
A multi‑branch convolutional neural network (CNN) processes these descriptors under stratified five‑fold cross‑validation. The model achieves an average accuracy of 96.20% and a Matthews correlation coefficient of 0.9566, demonstrating strong discriminative power.
To uncover class‑specific differences, Kruskal‑Wallis and Mann‑Whitney U tests are combined with Benjamini‑Hochberg false discovery rate correction and Cliff’s delta effect‑size measurement. Among 10,640 attack‑versus‑benign comparisons, 7,777 (73.1%) remain significant after FDR correction, with 4,844 showing large effects.
The most pronounced global differences are linked to backward‑traffic and packet‑length features together with connectivity, clustering and centrality measures, indicating that these topological attributes reflect the structural characteristics of particular attacks.
In summary, NVG‑derived representations provide high discriminative capability while revealing class‑dependent topological patterns, offering potential for real‑time intrusion detection and attack attribution.
Review