Drift-Aware Graph Aggregation and Explanation under Controlled Attack Shifts in IoT Traffic
Keywords:
Controlled distribution shift, Delayed labels, Feature occlusion, Graph aggregation, IoT securityAbstract
Fixed nearest neighbour aggregation is a feature transformation, while the loss monitor is a supervised update trigger rather than a drift detector. This study evaluates the fixed feature transformation under a deliberately ordered sequence of capture-associated attack subpopulations. Initial training uses benign and acknowledgement-fragmentation captures, while the stream introduces SYN flooding, port scanning, and TCP denial-of-service. Capture separation, training-only feature scaling, duplicate exclusion, and a one-batch label delay restrict several information paths. The experiment contains 7,998 training records, 8,000 validation records, and 7,960 stream records. Five optimiser seeds compare fixed and continually updated tabular and graph classifiers, alongside an alarm-triggered graph variant. Continual tabular learning obtains average precision of 0.9834, compared with 0.9805 for continual graph aggregation and 0.9739 for alarm-triggered graph adaptation. Fixed graph average precision is 0.7374 overall, with especially weak ranking in the port scan and TCP denial-of-service phases. A supplemental reproduction of the fixed graph head yielded phase average precision of 0.4472 for port scan and 0.4067 for TCP denial-of-service across five seeds. Grouped feature occlusion is a retrospective sensitivity analysis and does not test explanation stability. These results describe controlled shifts in selected attack subpopulations and capture associated distributions. They do not establish strict concept drift, early attack detection, or general benefits from graph aggregation.
References
E. C. P. Neto, S. Dadkhah, R. Ferreira, A. Zohourian, R. Lu, and A. A. Ghorbani, “CICIoT2023: A real-time dataset and benchmark for large-scale attacks in IoT environment,” Sensors, vol. 23, no. 13, Jun. 2023.
J. Gama, I. Žliobaitė, A. Bifet, M. Pechenizkiy, and A. Bouchachia, “A survey on concept drift adaptation,” ACM Computing Surveys, vol. 46, no. 4, pp. 1–37, Mar. 2014.
T. N. Kipf and M. Welling, “Semi-supervised classification with graph convolutional networks,” arXiv, Sept. 2016.
W. L. Hamilton, R. Ying, and J. Leskovec, “Inductive representation learning on large graphs,” Proceedings of the 31st International Conference on Neural Information Processing Systems, Dec. 2017, pp. 1025–1035.
P. Veličković, G. Cucurull, A. Casanova, A. Romero, P. Liò, and Y. Bengio, “Graph attention networks,” arXiv, Oct. 2017.
R. Ying, D. Bourgeois, J. You, M. Zitnik, and J. Leskovec, “GNNExplainer: Generating explanations for graph neural networks,” Proceedings of the 33rd International Conference on Neural Information Processing Systems, Dec. 2019, pp. 9244–9255.
D. Luo et al., “Parameterized explainer for graph neural network,” Proceedings of the 34th International Conference on Neural Information Processing Systems, Dec. 2020, pp. 19620–19631.
S. Lundberg and S. I. Lee, “A unified approach to interpreting model predictions,” Proceedings of the 31st International Conference on Neural Information Processing Systems, Dec. 2017, pp. 4768–4777.
M. T. Ribeiro, S. Singh, and C. Guestrin. ““Why should I trust you?”: Explaining the Predictions of Any Classifier,” Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, Aug. 2016, pp. 1135–1144.
D. Arp et al., “Dos and don'ts of machine learning in computer security,” Proceedings of the 31st USENIX Security Symposium, 2022, pp. 3971–3988.
S. Kapoor and A. Narayanan, “Leakage and the reproducibility crisis in ML-based science,” Pattern, vol. 4, no. 9, Sept. 2023.
M. Cantone, C. Marrocco, and A. Bria, “On the cross-dataset generalization of machine learning for network intrusion detection,” arXiv, Feb. 2024.
A. Bifet and R. Gavaldà, “Learning from time-changing data with adaptive windowing,” Proceedings of the 2007 SIAM International Conference on Data Mining, 2007, pp. 443–448.
J. Montiel et al., “River: machine learning for streaming data in Python,” Journal of Machine Learning Research, vol. 22, no. 1, pp. 4945–4952, Jan. 2020.
G. I. Parisi, R. Kemker, J. L. Part, C. Kanan, and S. Wermter, “Continual lifelong learning with neural networks: A review,” Neural Network, vol. 113, pp. 54–71, May 2019.
J. Kirkpatrick et al., “Overcoming catastrophic forgetting in neural networks,” arXiv, Dec. 2016.
Z. Wu, S. Pan, F. Chen, G. Long, C. Zhang and P. S. Yu, “A comprehensive survey on graph neural networks,” in IEEE Transactions on Neural Networks and Learning Systems, vol. 32, no. 1, pp. 4–24, Jan. 2021.
S. Brody, U. Alon, and E. Yahav, “How attentive are graph attention networks?,” arXiv, May 2021.
T. Chen and C. Guestrin, “XGBoost: A scalable tree boosting system,” Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, Aug. 2016, pp. 785–794.
C. Guo, G. Pleiss, Y. Sun, and K. Q. Weinberger, “On calibration of modern neural networks,” Proceedings of the 34th International Conference on Machine Learning, 2017, pp. 1321–1330.
T. Saito and M. Rehmsmeier, “The Precision-Recall Plot is more informative than the ROC plot when evaluating binary classifiers on imbalanced datasets,” PLoS ONE, vol. 10, no. 3, 2015.
P. W. Koh et al., “WILDS: A benchmark of in-the-Wild Distribution Shifts,” Proceedings of the 38th International Conference on Machine Learning, 2020, pp. 5637-5664.
R. Geirhos et al., “Shortcut learning in deep neural networks,” Nature Machine Intelligence, vol. 2, pp. 665–673, Nov. 2020.
T. Gebru et al., “Datasheets for Datasets,” arXiv, Mar. 2018.
M. Mitchell et al., “Model cards for model reporting,” Proceedings of the Conference on Fairness, Accountability, and Transparency, Jan. 2019, pp. 220–229.
A. N. Angelopoulos and S. Bates, “A gentle introduction to conformal prediction and distribution-free uncertainty quantification,” arXiv, Jul. 2021.
Y. Ganin et al., “Domain-adversarial training of neural networks,” Domain Adaptation in Computer Vision Applications, 2017, pp. 189–209.
B. Sun and K. Saenko, “Deep CORAL: Correlation alignment for deep domain adaptation,” Computer Vision, 2016, pp. 443–450.
Bencorn, “CIC-IoT-2023,” Hugging Face Datasets.
S. Jain and B. C. Wallace, “Attention is not explanation,” arXiv, Feb. 2019.
M. Sundararajan, A. Taly, and Q. Yan, “Axiomatic attribution for deep networks,” Proceedings of the 34th International Conference on Machine Learning, Aug. 2017, pp. 3319–3328.
