Scholarlink

<p>MSG-VA is a hierarchical graph pipeline with analyst-in-the-loop visual analytics for real-time network threat detection. Under a defined threat model, adversaries manipulating host–to–host communication patterns—assumptions include flow-level telemetry and a sub-second latency budget. Entities are aggregated by subnet/role and time to form multi-scale graphs. A lightweight GNN computes embeddings and flags anomalies using adaptive thresholding. Alerts and provenance paths are surfaced in an interactive dashboard. On CICIDS2017 and UNSW-NB15, MSG-VA attains F1 94.8%, Accuracy 95.0%, and FPR 5.6%, outperforming tuned RF and DNN baselines under identical, leakage-free splits. An ablation study isolating the multi-scale design shows a 2–3× reduction in compute, with ≤ 0.5 pp F1 loss, and a 10-task analyst study indicates a 34% faster triage. A reproducible end-to-end benchmark reports a median alert latency of 95.7 ms (including graph construction, inference, and visualization push) and a model-inference throughput of ~ 250,000 nodes/s. Code, exact splits, and configurations are released to enable replication. Contributions: (i) a concrete multi-scale coarsening policy tied to network roles and time; (ii) a compact GNN with adaptive thresholding that improves detection at low FPR; (iii) a real-time visual analytics workflow validated by ablations, zero-day/cross-dataset tests, and a small user study.</p>

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

MSG-VA: multi-scale graph visual analytics for real-time network threat detection

  • 期刊论文

  • 出版模式：

    开放获取

  • 发表日期：

    2026年1月13日

查看全文
  • Donia Y. Badawood

摘要

MSG-VA is a hierarchical graph pipeline with analyst-in-the-loop visual analytics for real-time network threat detection. Under a defined threat model, adversaries manipulating host–to–host communication patterns—assumptions include flow-level telemetry and a sub-second latency budget. Entities are aggregated by subnet/role and time to form multi-scale graphs. A lightweight GNN computes embeddings and flags anomalies using adaptive thresholding. Alerts and provenance paths are surfaced in an interactive dashboard. On CICIDS2017 and UNSW-NB15, MSG-VA attains F1 94.8%, Accuracy 95.0%, and FPR 5.6%, outperforming tuned RF and DNN baselines under identical, leakage-free splits. An ablation study isolating the multi-scale design shows a 2–3× reduction in compute, with ≤ 0.5 pp F1 loss, and a 10-task analyst study indicates a 34% faster triage. A reproducible end-to-end benchmark reports a median alert latency of 95.7 ms (including graph construction, inference, and visualization push) and a model-inference throughput of ~ 250,000 nodes/s. Code, exact splits, and configurations are released to enable replication. Contributions: (i) a concrete multi-scale coarsening policy tied to network roles and time; (ii) a compact GNN with adaptive thresholding that improves detection at low FPR; (iii) a real-time visual analytics workflow validated by ablations, zero-day/cross-dataset tests, and a small user study.