Node-level anomaly detection on CTU-13 (chronological split)
0.9804ROC AUCGESR
Evaluation results
| Method | Links | ||||
|---|---|---|---|---|---|
| GESRattribution=source-weighted edge-to-node, alpha=1.0, aggregation=q90 node aggregation2026.05 | 0.9804 | 0.1618 | 0.0302 | 0.9647 | |
| Kitsunemaximum autoencoder size=102026.05 | 0.9508 | 0.1713 | 0.0147 | 0.7566 | |
| Autoencoderhidden size=128, latent size=32, epochs=30, optimizer=Adam2026.05 | 0.9443 | 0.1126 | 0.0234 | 0.6419 | |
| Isolation Foresttrees=2002026.05 | 0.875 | 0.0473 | 0.0216 | 0.055 | |
| Anomal-Ehidden size=64, output size=64, trees=2002026.05 | 0.7661 | 0.03 | 0.0403 | 0.1032 | |
| GraphSAGE + IFhidden size=64, output size=64, epochs=20, trees=2002026.05 | 0.7636 | 0.0254 | 0.0017 | 0.03 |