英文标题：A First-Principles Evaluation of Graph-Based Network Intrusion Detection Systems
作者：Rui Zhao, Wajih Ul Hassan
arXiv ID：2609.12263 | 分类：cs.CR | 发表：2026-09-10
许可：CC-BY
摘要。 基于图的网络入侵检测系统（GIDS）报告了强劲的基准检测指标，但这些指标几乎无法说明其可部署性。我们从第一性原理出发处理该问题：不是继承每个已发表系统各自的预处理、窗口化和阈值化惯例，而是追问受控比较需要什么，并统一施加这些要求。其结果便是 GIDS-Eval，一个评估框架，它将 GIDS 分解为六个可互换阶段，并将这些惯例转化为显式的实验变量，从而使所报告的性能可归因于各个阶段，而非整个流水线。我们调查了九个代表性 GIDS，在 GIDS-Eval 中重新实现了其中五个，并在一个匹配协议下于四个数据集上对它们进行评估。我们识别出九个反复出现的评估缺口，并量化了每个缺口的影响：两条精心
Graph-based network intrusion detection systems (GIDS) report strong benchmark detection metrics, but those metrics establish little about deployability. We approach the problem from first principles: rather than inheriting the preprocessing, windowing, and thresholding conventions of each published system, we ask what a controlled comparison requires and impose it uniformly. The result is GIDS-Eval, an evaluation framework that decomposes a GIDS into six interchangeable stages and turns those conventions into explicit experimental variables, so reported performance can be attributed to individual stages instead of whole pipelines. We survey nine representative GIDS, reimplement five of them within GIDS-Eval, and evaluate them on four datasets under one matched protocol. We identify nine recurring evaluation gaps and quantify the impact of each: two crafted edges achieve full evasion against three of the eight detector-dataset pairs with anything to hide; the snapshot window alone accounts for a mean 38.3% relative swing in average precision (AP); aligning preprocessing across systems moves AP by up to 61.8 percentage points for a single detector; and none of the 18 detector-dataset pairs we replay can alert as events arrive. We introduce GIDS-Lite, an encoder-free control built in the same framework, which ranks first by AP on two of the four datasets at up to 575$\times$ lower runtime. Architectural complexity is therefore not a consistent driver of detection quality under our matched protocol on current benchmarks, but it does enlarge the runtime, calibration, and attack surfaces operators must defend.
查看完整双语翻译 →
正在跳转到翻译阅读页… 如果没有自动跳转，请点击这里。