FACTORIAL DIAGNOSTICS OF THE DISCRIMINATIVE POWER OF LOCAL GRAPH FEATURES IN ANOMALY DETECTION ON TEMPORAL MULTIGRAPHS

Abstract

Anomaly detection on temporal interaction graphs is a data-mining task in which flow-based methods capture only a limited structural context of interactions between nodes. The aim of this work is to assess the discriminative power of local interpretable graph features as a stand-alone detector of network anomalies under label-free feature construction. A composite anomaly score is proposed based on three graph components: deviation of betweenness centrality from a baseline profile, Louvain community change and Jaccard drift of the local neighbourhood. The experimental evaluation is carried out on the CICIDS2017 dataset using a controlled classifier × feature-space design and a comparison with flow-based baselines. The method is implemented on the Neo4j Graph Data Science and Java stack for the analysis of a temporal multigraph of network traffic. The results show that the studied graph features retain ranking ability (ROC-AUC up to 0.84) but do not provide operationally acceptable precision as a stand-alone detector: under the common evaluation protocol, F₁ = 0.0021 versus F₁ = 0.2000 for the flow-based baseline. Control experiments localise the source of degradation in the feature space rather than in the classifier, the number of features or the unsupervised nature of feature construction. The scientific novelty of the work lies in establishing the limits of the discriminative power of local graph features in the studied setting and in developing a diagnostic template for auditing graph-based anomaly detectors that combines ground-truth decomposition, controlled comparison of classifiers and feature spaces, and analysis of the structural and semantic causes of low performance. The results justify the use of flow-based features as the basis of anomaly detection in the studied class of enterprise networks; the generalisation of the conclusions to mesh topologies requires separate experimental verification.