qhjqhj00 cicids2017-eval
CAGN-GAT Fusion: A Hybrid Contrastive Attentive Graph Neural Network for Network Intrusion Detection — Md Abrar Jahin et al. (2025) (arXiv:2503.00961, 2025)
What this evaluates
Evaluates network intrusion detection capability by classifying network traffic flows as benign or malicious (or specific attack types) using graph-structured representations of network connections. It probes the model's ability to learn from adaptive graph construction and contrastive learning under resource-constrained conditions.
Datasets
- CICIDS2017 — total ?; splits: test (-1)
Metrics
accuracy(primary) — range: [0, 1]- Proportion of correctly classified instances out of the total number of instances.
Input / output format
Input: Graph-structured network traffic data where nodes represent hosts/flows and edges represent connections, with features derived from network packet headers and flow statistics.
Output: Class label indicating the type of network traffic (e.g., normal, probe, denial-of-service, user-to-root, etc.)
Scoring recipe
def compute_accuracy(y_true, y_pred):
correct = sum(1 for t, p in zip(y_true, y_pred) if t == p)
return correct / len(y_true)
Common pitfalls
- Severe class imbalance can skew accuracy; F1-score or macro-averaged metrics are often more informative.
- Graph sparsity and structural noise from augmentation can disproportionately degrade performance on imbalanced datasets.
- Fixed sample sizes (e.g., 5000) may not reflect full dataset distribution or real-world traffic volume.
Evidence (verbatim from paper)
Without augmentation, it achieved top-tier results on KDD CUP 99 (accuracy: 0.9921, F1: 0.9012), NSL-KDD (accuracy: 0.9870, F1: 0.9836), and tied for the highest score on CICIDS2017 (accuracy: 0.9850, F1: 0.9459).
Citation
@misc{jahin2025cagn_gat_fusion,
title={CAGN-GAT Fusion: A Hybrid Contrastive Attentive Graph Neural Network for Network Intrusion Detection},
author={Md Abrar Jahin et al. (2025)},
year={2025},
note={arXiv:2503.00961}
}
- arXiv: 2503.00961