残余图卷积网络在入侵检测中的无泄漏评估
Leakage-free evaluation of residual graph convolutional networks for network intrusion detection
这篇论文把图神经网络做入侵检测的水分挤干了：去掉评测泄漏后，图模型精度和不带图的 MLP 打平，树模型反而更强，唯一赢在抗噪声。做安全检测选型的值得看看对比细节。
一项研究针对网络入侵检测中图神经网络常见的评测泄漏问题，在 CICIDS2017 和 NF-UNSW-NB15-v2 上做了无泄漏协议下的对比。清洗精确重复流后，NF-UNSW-NB15-v2 有 69% 的流被移除，图仅用训练流构建。两层残余图卷积网络在 CICIDS2017 上二分类 F1 为 98.11%，与不使用图的 MLP 及其他图网络无显著差异。梯度提升树等树模型在 CICIDS2017 的多分类 macro-F1 达 93.08%，远高于图网络的 64.51%。图模型的唯一优势是对特征噪声的鲁棒性：在高斯噪声 SD 0.5 下残余网络 F1 仍保持 96.16%，XGBoost 则降至 0.67%。
Leakage-free evaluation of residual graph convolutional networks for network intrusion detection
Graph neural networks are increasingly proposed for network intrusion detection, yet many reported results come from protocols in which test flows shape the graph used for training, duplicated flows sit on both sides of the split, or a single split is reported. This study measures what a residual graph convolutional network gains over simpler models once these sources of optimism are removed. CICIDS2017 and NF-UNSW-NB15-v2 were cleaned with label-aware removal of exact duplicates, removing 69% of NF-UNSW-NB15-v2 flows. Flows were linked in a nearest-neighbour graph built from training flows only, and validation and test flows were attached to their nearest training flows at prediction time. A two-layer residual network was compared with eight models under the same settings, including a nearest-neighbour vote over the same graph, gradient-boosted trees and a random forest, over three seeds that each draw a new split, with ablations, leave-one-family-out and feature-noise tests. On CICIDS2017 the residual network reached a binary F1 of 98.11% (SD 0.18) and on NF-UNSW-NB15-v2 90.57% (0.38), indistinguishable from a multilayer perceptron without the graph and from other graph networks. Tree ensembles were 1.48 to 1.57 F1 points higher on CICIDS2017 and led on the area under the precision-recall curve on both datasets; their CICIDS2017 multiclass macro-F1 reached 93.08% against 64.51%, a gap mainly from benign flows the residual network assigned to small attack classes. No ablation, including transductive graph construction, changed F1 beyond seed variation. Under Gaussian feature noise (SD 0.5), the residual network kept an F1 of 96.16%, while XGBoost fell to 0.67%. Under a leakage-controlled protocol, message passing over flow graphs adds no measurable accuracy over a perceptron, and tree ensembles remain stronger on both; the advantage of graph models lies in robustness to feature noise.