A Multi Method Importance and Performance Efficiency Analysis of Topological Metrics for Natural Visibility Graph Based Cyber Attack Detection

基于自然可见性图的网络攻击检测中拓扑度量标准的多方法重要性与性能效率分析

Abstract: Natural Visibility Graph (NVG) based analysis characterizes network traffic through topological descriptors reflecting different structural properties. However, not all descriptors contribute equally to cyber-attack classification, and extracting a large metric set can increase computational cost.

摘要： 基于自然可见性图（NVG）的分析通过反映不同结构属性的拓扑描述符来表征网络流量。然而，并非所有描述符对网络攻击分类的贡献都相同，且提取大量的度量指标集会增加计算成本。

This study evaluates 21 NVG derived topological metrics and investigates whether a compact subset can preserve classification capability while improving computational efficiency. Four importance analysis methods SHAP, grouped Permutation Importance, Boruta, and Recursive Feature Elimination (RFE) are integrated through a Consensus Ranking strategy.

本研究评估了 21 种源自 NVG 的拓扑度量指标，并探讨了精简的子集是否能在保持分类能力的同时提高计算效率。研究通过共识排序策略整合了四种重要性分析方法：SHAP、分组排列重要性（Grouped Permutation Importance）、Boruta 和递归特征消除（RFE）。

Based on this ranking, Full21, Top15, Top10, Top7, Top5, and Top3 configurations are evaluated using the CICIDS2018 dataset, a CNN classifier, and stratified 5 fold cross validation. The three highest ranked metrics are avg_clustering_coeff_median, avg_clustering_coeff_std, and avg_clustering_coeff_mean.

基于此排序，研究使用 CICIDS2018 数据集、CNN 分类器和分层 5 折交叉验证，对 Full21、Top15、Top10、Top7、Top5 和 Top3 等配置进行了评估。排名最高的三个指标分别是：平均聚类系数中位数（avg_clustering_coeff_median）、平均聚类系数标准差（avg_clustering_coeff_std）和平均聚类系数均值（avg_clustering_coeff_mean）。

Top3 achieved the highest observed mean performance, with 97.148% accuracy, 97.055% weighted F1 score, and an MCC of 0.9675, compared with 95.999%, 95.521%, and 0.9549 for Full21, respectively. It also reduced total runtime from 14,961.39 s to 589.22 s (96.06%).

Top3 配置实现了观测到的最高平均性能，准确率为 97.148%，加权 F1 分数为 97.055%，MCC 为 0.9675；相比之下，Full21 的对应指标分别为 95.999%、95.521% 和 0.9549。此外，Top3 还将总运行时间从 14,961.39 秒缩短至 589.22 秒（降幅达 96.06%）。

These results indicate that importance guided metric reduction can provide a compact NVG representation with higher observed mean predictive performance and substantially lower computational cost under the evaluated setting.

这些结果表明，在所评估的设置下，基于重要性引导的度量指标精简可以提供一种紧凑的 NVG 表示，不仅具有更高的观测平均预测性能，还能显著降低计算成本。