RETHINKING GRAPH-BASED APPROACHES: AN EMPIRICAL STUDY OF FEATURE ENGINEERING IN NETWORK INTRUSION DETECTION

Abstract

Although graph-based feature engineering has become widely used in network intrusion detection systems (NIDS), there is a severe lack of empirical research on determining whether the addition of network topology features results in a real positive improvement over the operation of the system or it simply adds complexity to the system. Our paper gets into this gap by critically assessing the performance of graph-based methods as compared to conventional statistical features via systematic comparative analysis across several machine learning paradigms. Using the UNSW-NB15 dataset, we employed a graph-theoretic characteristics that included measures of centrality, the community structure identification and the topological analysis, which were compared to traditional traffic-based characteristics. Results revealed a counterintuitive finding where incorporating graph features consistently degraded detection performance across all algorithms, with statistically significant accuracy reductions observed in multiple classifiers. Random Forest experienced modest performance decline, while Support Vector Machines and RBF Networks showed more substantial degradation. Computational analysis also demonstrated that graph feature extraction imposed substantial overhead compared to traditional feature computation, representing approximately nineteen-fold increase in processing time.