PaperlayerView exact revision on arXiv

Source-linked AI summary

A Quantitative Analysis of Graph Representation Strategies for Cyber Attack Detection

Ali Melih Kanca, Ilker Turker

arXiv:2610.04019v1cs.AI

TL;DR

Graph-based cyber-attack detection studies vary in their graph representations and strategies, motivating a quantitative examination of how representation choices relate to application domains. Across 37 studies, automated representation learning predominated, and representation strategy was significantly associated with domain.

  • Problem

    Graph-based cyber-attack detection studies vary in graph representations and learning strategies across domains, motivating quantitative examination of how representation strategies are distributed across those domains.

    Source: INTRODUCTION · p. 2

  • Method

    The study coded 37 original studies across methodological dimensions and used frequency analysis, cross-tabulation, and statistical tests to examine representation strategies and domains.

    Source: INTRODUCTION · p. 2, B. Quantitative and Statistical Analysis · p. 5

  • Results

    Automated representation learning predominated (27 studies, 73.0%; handcrafted, 10 studies, 27.0%), and strategy was associated with domain (exact p = 0.008; Cramér’s V = 0.540).

    Source: A. Distribution of Studies and… · p. 5, B. Feature Strategy Across Application… · p. 7

  • Takeaways & Limitations

    Within the analyzed corpus, automated representation learning predominated, and representation-strategy distributions differed across cybersecurity application domains.

    Source: CONCLUSION · p. 7

    The corpus is limited in size and methodologically heterogeneous, so dataset and performance values were not directly compared across studies.

    Source: CONCLUSION · p. 8

Abstract

from arXiv · show

Graph based cyber attack detection studies employ various graph construction and representation strategies across different cybersecurity application domains. This diversity motivates a quantitative examination of how representation strategies are distributed across these application domains. This study presents a quantitative analysis of 37 original studies published between 2019 and 2026. Each study was coded according to publication year, application domain, graph representation type, feature extraction strategy, learning paradigm, algorithm, and dataset. Frequency analysis, cross tabulation, and statistical association tests were applied. Automated representation learning was the most frequently employed strategy, accounting for 73.0% of the studies, while handcrafted representation strategies accounted for 27.0%. The Fisher Freeman Halton exact test revealed a statistically significant association between application domain and representation strategy (exact p = 0.008; Cramer's V = 0.540). The findings indicate that automated representation learning predominates within the analyzed corpus and that the distribution of representation strategies differs across cybersecurity application domains.

INTRODUCTION

Graph-based cyber-attack detection studies vary in their graph representations and learning strategies across application domains. This study quantifies representation strategies and their association with those domains, extending a prior qualitative review with recent studies and statistical analysis.

INTRODUCTION

  • Graph-based cyber-attack detection spans communication, visibility, function-call, and provenance graphs, analyzed with graph-theoretic features or automated representation learning.The application context shapes graph structures, while feature extraction may be handcrafted or learned.Source: INTRODUCTION · p. 1
  • The analysis codes 37 studies from 2019–2026 and examines handcrafted and automated strategies across application domains.It uses frequency distributions, cross-tabulation, and statistical association tests across the coded dimensions.Source: INTRODUCTION · p. 2
  • Unlike the qualitative synthesis and domain taxonomy in Kanca & Türker (2025), this study statistically tests the association between domain and representation strategy.It incorporates studies published in 2025–2026 and uses cross-tabulation, the Fisher–Freeman–Halton exact test, and Cramér’s V.Source: INTRODUCTION · p. 2

A. Study Corpus and Data Coding

The study assembles and codes a 37-study corpus of graph-based cyber-attack detection research, organizing methodological choices across four application domains for quantitative comparison.

A. Study Corpus and Data Coding

  • The corpus contains 37 original studies from 2019–2026, grouped into IDS/NIDS, Botnet/DDoS, IoT/DDoS, and Advanced Threats.Each study is treated as an individual observation for comparisons of application domain and representation strategy.Source: A. Study Corpus and Data Coding · p. 2
  • The literature search combined cybersecurity and graph-related terms across IEEE Xplore, SpringerLink, ScienceDirect, Scopus, and Web of Science.The search targeted graph-based representation and learning approaches for cyber-attack detection across application domains.Source: A. Study Corpus and Data Coding · p. 2
  • Studies were included for an original graph-based detection approach and sufficient methodological detail, while reviews and studies lacking those criteria were excluded.The final corpus was updated from the Kanca & Türker (2025) review framework with relevant 2025–2026 studies.Source: A. Study Corpus and Data Coding · p. 3
  • The coding scheme records publication year, domain, graph and feature strategy, learning paradigm, algorithm, dataset, and reported performance.Learning approaches are grouped separately as conventional machine learning, deep learning, GNN-based, or hybrid methods.Source: A. Study Corpus and Data Coding · p. 3
  • Handcrafted strategies explicitly extract predefined graph or structural descriptors, whereas automated strategies learn or derive representations from graph structures or attributes.Examples of automated methods include graph embedding, deep learning, and graph neural networks.Source: A. Study Corpus and Data Coding · p. 3

B. Quantitative and Statistical Analysis

The analysis uses descriptive distributions and cross-tabulation to examine representation strategies across application domains, then tests their association and strength.

B. Quantitative and Statistical Analysis

  • Frequency and percentage distributions describe studies by year, application domain, and feature extraction strategy, while cross-tabulation compares representation strategies across four domains.The strategies compared are handcrafted and automated.Source: B. Quantitative and Statistical Analysis · p. 5
  • Because several expected cell frequencies were below five, the study used the Fisher–Freeman–Halton exact test and calculated Cramér’s V to assess association and its strength.The test evaluates the association between application domain and representation strategy.Source: B. Quantitative and Statistical Analysis · p. 5

A. Distribution of Studies and Representation Strategies

Automated representation learning is the most frequent strategy in the analyzed corpus, with handcrafted representations accounting for the remainder.

A. Distribution of Studies and Representation Strategies

B. Feature Strategy Across Application Domains

Representation strategies differed across application domains: automated approaches predominated in IDS/NIDS and Advanced Threats, while handcrafted features were more common in Botnet/DDoS and equally represented in IoT/DDoS. The association was statistically significant in the analyzed corpus.

B. Feature Strategy Across Application Domains

CONCLUSION

Across 37 studies, automated representation learning was more frequent overall, but strategy distributions varied by application domain. The analysis found a significant association, while its corpus size and study heterogeneity constrain comparisons and causal conclusions.

CONCLUSION

  • Automated representation learning accounted for 73.0% of studies, compared with 27.0% for handcrafted approaches; domain patterns also differed.Automated approaches were more prevalent in IDS/NIDS and Advanced Threats, handcrafted representations in Botnet/DDoS, and the strategies were equally represented in IoT/DDoS.Source: CONCLUSION · p. 7
  • The Fisher–Freeman–Halton exact test found a significant domain–strategy association (exact p = 0.008; Cramér’s V = 0.540), not a causal relationship.Source: CONCLUSION · pp. 7–8
  • The analysis is limited by the 37-study corpus and methodological heterogeneity; differing datasets, preprocessing, tasks, and metrics prevented direct performance comparisons.Source: CONCLUSION · p. 8
Loading 2610.04019v1…