[Paper Review] Multi-centrality Graph Spectral Decompositions and their Application to Cyber Intrusion Detection

Pin‐Yu Chen, Sutanay Choudhury+1 more|arXiv (Cornell University)|Dec 23, 2015

Complex Network Analysis Techniques3 citations

TL;DR

This paper proposes multi-centrality graph PCA (MC-GPCA) and multi-centrality graph dictionary learning (MC-GDL), which integrate multiple graph centrality features—such as walk statistics, distances to reference nodes, and various centrality measures—into spectral decompositions for dimensionality reduction and anomaly detection. Applied to cyber intrusion detection, MC-GPCA identifies structural deviations via a Structural Difference Score (SDS), while MC-GDL learns discriminative structural atoms that classify attacks, outperforming degree-based metrics in detecting network anomalies.

ABSTRACT

Many modern datasets can be represented as graphs and hence spectral decompositions such as graph principal component analysis (PCA) can be useful. Distinct from previous graph decomposition approaches based on subspace projection of a single topological feature, e.g., the Fiedler vector of centered graph adjacency matrix (graph Laplacian), we propose spectral decomposition approaches to graph PCA and graph dictionary learning that integrate multiple features, including graph walk statistics, centrality measures and graph distances to reference nodes. In this paper we propose a new PCA method for single graph analysis, called multi-centrality graph PCA (MC-GPCA), and a new dictionary learning method for ensembles of graphs, called multi-centrality graph dictionary learning (MC-GDL), both based on spectral decomposition of multi-centrality matrices. As an application to cyber intrusion detection, MC-GPCA can be an effective indicator of anomalous connectivity pattern and MC-GDL can provide discriminative basis for attack classification.

Motivation & Objective

• To address the limitation of existing graph PCA and dictionary learning methods that rely on a single centrality measure and are sensitive to noise and graph structure variations.
• To develop a unified spectral decomposition framework that integrates multiple topological features—such as graph walk statistics, centrality measures, and inter-node distances—for improved robustness in graph analysis.
• To apply the proposed methods to cyber intrusion detection, enabling detection of anomalous connectivity patterns and classification of attack types in network traffic graphs.
• To demonstrate that multi-centrality features enhance sensitivity to structural changes such as edge removal, weight shifts, and direction changes in directed graphs.

Proposed method

• MC-GPCA performs spectral decomposition via SVD on a matrix composed of multiple graph centrality features (e.g., 1–20 hop walk statistics, distances to 10 high-degree nodes, and 10 centrality measures), enabling low-dimensional representation of a single graph.
• MC-GDL extends the framework to ensembles of graphs by applying K-SVD-based dictionary learning to the SDS features extracted from each graph, learning sparse coefficients and discriminative structural atoms.
• The method constructs a feature matrix X with p=56 columns, combining walk statistics (1–20 hops), 10 centrality measures (excluding edge direction for LFVC), and distances to 10 high-degree reference nodes.
• A Structural Difference Score (SDS) is computed using the first two principal components of MC-GPCA to quantify structural deviation from normal network behavior.
• For dictionary learning, the algorithm selects the z=300 highest SDS values per graph, applies K-SVD to learn K=2 structural atoms and corresponding sparse coefficients for attack classification.
• The framework supports weighted, directed, and disconnected graphs, unlike prior methods restricted to undirected, connected, or unweighted graphs.

Experimental results

Research questions

• RQ1 Can integrating multiple centrality features into a spectral decomposition improve detection of subtle structural changes in graphs?
• RQ2 How does MC-GPCA compare to degree-based metrics in identifying anomalous network connectivity patterns during cyber attacks?
• RQ3 Can MC-GDL learn discriminative structural atoms that effectively represent normal and attack behaviors in network graphs?
• RQ4 To what extent do multi-centrality features enhance robustness to noise and variations in graph topology, such as edge removal or direction changes?

Key findings

• MC-GPCA’s Structural Difference Score (SDS) effectively detects anomalies: SDS values are significantly higher on Days 3, 4, and 5 of the UNB dataset, corresponding to infiltration, DoS, and botnet DDoS attacks.
• The degree statistic fails to detect anomalies, particularly the SSH brute-force attack on Day 7, which is localized and does not alter global degree distribution.
• MC-GDL successfully learns two structural atoms: one representing normal activity with a single spike (main router), and one capturing attack patterns with higher variance in SDS features.
• The coefficient matrix from MC-GDL enables effective attack classification; K-means clustering with two clusters correctly identifies Days 3, 4, and 5 as anomalous.
• The integration of multiple centrality features—including walk statistics, distances to reference nodes, and 10 centrality measures—results in a more robust and discriminative representation than single-feature approaches.
• MC-GPCA explains most of the data variance with one or two principal components, indicating that the multi-centrality features capture dominant structural patterns effectively.