Semantic Compatibility Auditing and Provenance Graph Construction for Heterogeneous Cybersecurity Features
Keywords:
Cross-dataset generalization, Plant disease detection, Intrusion detection, Knowledge graph, Semantic provenanceAbstract
Cross-dataset cybersecurity analysis can fail when similarly named variables represent different measurement procedures. This study performs a semantic compatibility audit using public mirrors of CICIoT2023 and CICIDS2017. The inspected IoT capture files contain 39 numerical fields, while the selected intrusion-flow derivative contains 78 numerical fields and two label columns. A compatibility ledger records 10 plausible feature correspondences, and a typed provenance graph separates dataset membership, capture provenance, and unresolved candidate matches. The resulting graph contains 132 nodes and 140 edges, with no asserted cross-source equivalence edge. A diagnostic classifier then attempts to identify the source dataset using seven superficially aligned numerical variables from benign records. With 8,000 training and 8,000 test observations, logistic regression achieves an ROC AUC of 0.9999995 and boosted trees achieve 1.0000. These values demonstrate strong source separability in the selected samples, but do not prove that any particular mapping is invalid. A first-principles aggregation counterexample explains why unit conversion alone cannot establish semantic equivalence. The completed study contributes an inspectable audit and provenance representation, while neither measuring improved attack transfer nor claiming discovery of a new cyber threat.
References
I. Sharafaldin, A. H. Lashkari, and A. A. Ghorbani, “Toward generating a new intrusion detection dataset and intrusion traffic characterization,” in Proceedings of the 4th International Conference on Information Systems Security and Privacy, Funchal, Madeira, Portugal, vol. 1, 2018, pp. 108–116.
E. C. P. Neto, S. Dadkhah, R. Ferreira, A. Zohourian, R. Lu, and A. A. Ghorbani, “CICIoT2023: A real-time dataset and benchmark for large-scale attacks in IoT environment,” Sensors, vol. 23, no. 13, Jun. 2023.
M. Cantone, C. Marrocco, and A. Bria, “On the cross-dataset generalization of machine learning for network intrusion detection,” arXiv, Feb. 2024.
A. Hogan et al., “Knowledge Graphs,” arXiv, Sept. 2020.
M. Nickel, K. Murphy, V. Tresp, and E. Gabrilovich, “A review of relational machine learning for knowledge graphs,” arXiv, Sept. 2015.
M. Schlichtkrull, T. N. Kipf, P. Bloem, R. van den Berg, I. Titov, and M. Welling, “Modeling relational data with graph convolutional networks,” The Semantic Web, 2017, pp. 593–607.
Y. Ganin et al., “Domain-adversarial training of neural networks,” Domain Adaptation in Computer Vision Applications, 2015, pp. 189–209.
B. Sun and K. Saenko, “Deep CORAL: Correlation alignment for deep domain adaptation,” Computer Vision, 2016, pp. 443–450.
D. Arp et al., “Dos and don'ts of machine learning in computer security,” Proceedings of the 31st USENIX Security Symposium, 2022, pp. 3971–3988.
S. Kapoor and A. Narayanan, “Leakage and the reproducibility crisis in ML-based Science,” Patterns, vol. 4, no. 9, Sept. 2023.
R. Geirhos et al., “Shortcut learning in deep neural networks,” Perspective, vol. 2, pp. 665–673, Nov. 2020.
A. Bordes, N. Usunier, A. Garcia-Duran, J. Weston, and O. Yakhnenko, “Translating embeddings for modeling multi-relational data,” Proceedings of the 27th International Conference on Neural Information Processing Systems, Dec. 2013, pp. 2787–2795.
B. Yang, W.-T. Yih, X. He, J. Gao, L. Deng, “Embedding entities and relations for learning and inference in knowledge bases,” International Conference on Learning Representations, 2015.
T. Trouillon, J. Welbl, S. Riedel, É. Gaussier, G. Bouchard, “Complex embeddings for simple link prediction,” arXiv, 2016.
Z. Sun, Z. H. Deng, J.-Y. Nie, and J. Tang, “RotatE: Knowledge graph embedding by relational rotation in complex space,” International Conference on Learning Representations, 2019.
T. N. Kipf and M. Welling, “Semi-supervised classification with graph convolutional networks,” International Conference on Learning Representations, 2016.
W. L. Hamilton, R. Ying, and J. Leskovec, “Inductive representation learning on large graphs,” Proceedings of the 31st International Conference on Neural Information Processing Systems, 2017, pp. 1025–1035.
P. Veličković, G. Cucurull, A. Casanova, A. Romero, P. Liò, and Y. Bengio, “Graph attention networks,” arXiv, Oct. 2017.
S. Brody, U. Alon, and E. Yahav, “How attentive are graph attention networks?,” International Conference on Learning Representations, 2022.
J. Devlin, M.-W. Chang, K. Lee, and K. Toutanova, “BERT: Pre-training of deep bidirectional transformers for language understanding,” Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, Jun. 2019, pp. 4171–4186.
N. Reimers and I. Gurevych, “Sentence-BERT: Sentence embeddings using Siamese BERT-Networks,” Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natural Language Processing, Nov. 2019, pp. 3982–3992.
T. Chen and C. Guestrin, “XGBoost: A scalable tree boosting system,” Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, Aug. 2016, pp. 785–794.
R. Ying, D. Bourgeois, J. You, M. Zitnik, and J. Leskovec, “GNNExplainer: Generating explanations for graph neural networks,” arXiv, Mar. 2019.
D. Luo et al., “Parameterized explainer for graph neural network,” Proceedings of the 34th International Conference on Neural Information Processing Systems, Dec. 2020, pp. 19620–19631.
T. Gebru et al., “Datasheets for datasets,” Communications of the ACM, vol. 64, no. 12, pp. 86–92, Nov. 2021.
M. Mitchell et al., “Model cards for model reporting,” Proceedings of the Conference on Fairness, Accountability, and Transparency, Jan. 2019, pp. 220–229.
Bencorn, “CIC-IoT-2023,” Hugging Face, dataset mirror.
Lacg030175, “CICIDS2017,” Hugging Face, processed dataset mirror, temporal_3way configuration.
T. Saito and M. Rehmsmeier, “The Precision-Recall Plot Is more informative than the ROC plot when evaluating binary classifiers on imbalanced datasets,” PLOS ONE, vol. 10, no. 3, 2015.
C. Guo, G. Pleiss, Y. Sun, and K. Q. Weinberger, “On calibration of modern neural networks,” Proceedings of the 34th International Conference on Machine Learning, vol. 70, Aug. 2017, pp. 1321–1330.
P. W. Koh et al., “WILDS: A benchmark of in-the-wild distribution shifts,” Proceedings of the 38th International Conference on Machine Learning, 2020, pp. 5637–5664.
M. Sundararajan, A. Taly, and Q. Yan, “Axiomatic attribution for deep networks,” Proceedings of the 34th International Conference on Machine Learning, vol. 70, Aug. 2017, pp. 3319–3328.
