Concept drift mitigation through community and spectral graph analysis for the detection of cyberattacks in network traffic

• URL: http://arxiv.org/abs/2609.09442v2
• Date: Sat, 12 Sep 2026 05:05:10 GMT
• Title: Concept drift mitigation through community and spectral graph analysis for the detection of cyberattacks in network traffic
• Abstract summary: We introduce t-robustness, a stability score defined for each feature independently of any detection model.<n>It combines the step-by-step distance between successive statistical states of a feature, and its cumulative divergence from its initial state, so that a slow monotonic drift cannot pass for stability.<n>The evaluation is performed on the UGR16 dataset, across three learning scenarios and a control scenario, as well as without model update.
• Score: 1.3999481573773072
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: In network traffic, legitimate behaviours and attack techniques evolve jointly - the phenomenon known as 'concept drift' [1]. Every detector is thereby left obsolete between two updates, and always one step behind adversaries. In this work, we propose to move the point of intervention from the model, repaired after the drift, to the feature space, selected before learning. We therefore introduce t-robustness, a stability score defined for each feature independently of any detection model, comparable across an entire feature space. It combines the step-by-step distance between successive statistical states of a feature, and its cumulative divergence from its initial state, so that a slow monotonic drift cannot pass for stability. The candidates are drawn from abnormal network connectivity patterns left by scans, DoS and communications between endpoints, read through graph community metrics and spectral metrics. The evaluation is performed on the UGR16 dataset, across three learning scenarios and a control scenario, as well as without model update, and demonstrate that t-robust feature spaces sustain detection where the baselines collapse: retained expectancy at the last test interval reaches 0.6025, against 0.5230 for graph community features and 0.3831 for the base NetFlow features.

Related papers

• Solution for UCF UrbanTwin V2X-Real Track: Sim-to-Real Urban LiDAR 3D Object Detection [54.03436243843709]
  This report presents a multi-source collaborative training and class-aware fusion framework for Sim2Real 3D detection.<n>The method organizes digital-twin scans, diffusion-redrawn scans, density-stabilized scans, and pedestrian morphology-aligned samples into a unified training pool with complementary roles.
  arXiv  Detail & Related papers  (2026-09-07T15:16:15Z)
• Behavioral Grammar: Detecting Adaptive Malware via Tiny Language Model Priors and Second-Order Temporal Analysis [1.560152792366037]
  This paper presents Behavioral Grammar, a detection architecture that treats host runtime behavior as a structured language.<n>Each system event is discretized into an 8-token representation spanning event type, process, argument skeleton, path category, parent process, user, destination, and inter-event timing.<n>We frame these findings within a coevolutionary economics model, arguing that behavior-grammar detection shifts the evasion cost from rule circumvention to distribution matching.
  arXiv  Detail & Related papers  (2026-08-01T16:28:38Z)
• Scalable Policy Optimization for Networked Multi-Agent Reinforcement Learning with Continuous State-Action Spaces [16.43184149906767]
  We develop an algorithm for cooperative reinforcement learning in networked decision processes with continuous state and action spaces.<n>Each agent maintains a local actor over a graph neighborhood, and a localized temporal-difference critic evaluates a truncated actionvalue function.
  arXiv  Detail & Related papers  (2026-07-20T22:41:43Z)
• Self-Adaptive Anomaly Detection with Reinforcement Learning and Human Feedback in Connected Vehicles [0.3324986723090369]
  This paper presents an online anomaly detection framework for autonomous CPS.<n>A factorized deep Q-network with self-attention selects the most suitable detector from a candidate pool for each monitored service.<n>A human-in-the-loop retraining mechanism, built around a pending transition buffer and a 60/40 prioritized replay strategy, allows the operator to incorporate expert knowledge.
  arXiv  Detail & Related papers  (2026-07-09T11:48:52Z)
• LCPNet: Latent Consistent Proximal Unfolding Network for Infrared Small Target Detection [50.3892176822492]
  Infrared small target detection (IRSTD) aims to identify long distance small targets from complex infrared backgrounds.<n>Deep learning methods have improved IRSTD by learning discriminative image-to-mask mappings.<n>Deep unfolding methods partially address this issue by embedding model-driven iterations into neural networks.<n>We propose Latent Consistent Proximal unfolding network (LCPNet) to address these limitations.
  arXiv  Detail & Related papers  (2026-07-06T02:15:09Z)
• Registration is a Powerful Rotation-Invariance Learner for 3D Anomaly Detection [64.0168648353038]
  3D anomaly detection in point-cloud data is critical for industrial quality control, aiming to identify structural defects with high reliability.<n>Current memory bank-based methods often suffer from inconsistent feature transformations and limited discriminative capacity.<n>We propose a registration-induced, rotation-invariant feature extraction framework that integrates the objectives of point-cloud registration and memory-based anomaly detection.
  arXiv  Detail & Related papers  (2025-10-19T14:56:38Z)
• ResAD: Normalized Residual Trajectory Modeling for End-to-End Autonomous Driving [64.42138266293202]
  ResAD is a Normalized Residual Trajectory Modeling framework.<n>It reframes the learning task to predict the residual deviation from an inertial reference.<n>On the NAVSIM benchmark, ResAD achieves a state-of-the-art PDMS of 88.6 using a vanilla diffusion policy.
  arXiv  Detail & Related papers  (2025-10-09T17:59:36Z)
• Federated Spatiotemporal Graph Learning for Passive Attack Detection in Smart Grids [2.721477719641864]
  This paper introduces a graph-centric, multimodal detector that fuses physical-layer and behavioral indicators over temporal windows to detect passive attacks.<n>The model achieves a testing accuracy of 98.32% per-timestep and 93.35% per-sequence at 0.15% FPR.
  arXiv  Detail & Related papers  (2025-09-29T08:52:30Z)
• Spatial regularisation for improved accuracy and interpretability in keypoint-based registration [5.286949071316761]
  Recent approaches based on unsupervised keypoint detection stand out as very promising for interpretability.<n>Here, we propose a three-fold loss to regularise the spatial distribution of the features.<n>Our loss considerably improves the interpretability of the features, which now correspond to precise and anatomically meaningful landmarks.
  arXiv  Detail & Related papers  (2025-03-06T14:48:25Z)
• Variational Voxel Pseudo Image Tracking [127.46919555100543]
  Uncertainty estimation is an important task for critical problems, such as robotics and autonomous driving. We propose a Variational Neural Network-based version of a Voxel Pseudo Image Tracking (VPIT) method for 3D Single Object Tracking.
  arXiv  Detail & Related papers  (2023-02-12T13:34:50Z)
• Risk-Averse MPC via Visual-Inertial Input and Recurrent Networks for Online Collision Avoidance [95.86944752753564]
  We propose an online path planning architecture that extends the model predictive control (MPC) formulation to consider future location uncertainties. Our algorithm combines an object detection pipeline with a recurrent neural network (RNN) which infers the covariance of state estimates. The robustness of our methods is validated on complex quadruped robot dynamics and can be generally applied to most robotic platforms.
  arXiv  Detail & Related papers  (2020-07-28T07:34:30Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.