Node-level anomaly detection on CICIDS 2017 (chronological)
0.9753ROC AUCGESR
Evaluation Results
| Method | Links | ||||
|---|---|---|---|---|---|
| GESRattribution=source-weighted edge-to-node, alpha=1.0, aggregation=q90 node aggregation2026.05 | 0.9753 | 0.3175 | 44.63 | 85.69 | |
| Autoencoderhidden size=128, latent size=32, epochs=30, optimizer=Adam2026.05 | 0.9285 | 0.2983 | 38.69 | 59.6 | |
| Isolation Foresttrees=2002026.05 | 0.889 | 0.1511 | 14.71 | 52.52 | |
| Anomal-Ehidden size=64, output size=64, trees=2002026.05 | 0.8728 | 0.082 | 13.15 | 39.51 | |
| Kitsunemaximum autoencoder size=102026.05 | 0.7493 | 0.1427 | 15.19 | 48.02 | |
| GraphSAGE + IFhidden size=64, output size=64, epochs=20, trees=2002026.05 | 0.535 | 0.0141 | 1.5 | 9.74 |