发表机构
Karabuk University（卡拉比克大学）
机构由 AI 辅助整理，请以论文原文为准。AI 中文总结
本研究通过共识排序整合四种重要性分析方法，评估21个NVG拓扑度量，发现Top3子集在CICIDS2018上以97.148%准确率超越全量，并减少96.06%运行时间，证明重要性引导的度量缩减可提升效率与性能。
AI 中文摘要
基于自然可见图（NVG）的分析通过反映不同结构属性的拓扑描述符来刻画网络流量特征。然而，并非所有描述符对网络攻击分类的贡献相同，且提取大量度量集可能增加计算成本。本研究评估了21个NVG派生的拓扑度量，并探究紧凑子集能否在提升计算效率的同时保持分类能力。通过共识排序策略整合了四种重要性分析方法：SHAP、分组置换重要性、Boruta和递归特征消除（RFE）。基于该排序，使用CICIDS2018数据集、CNN分类器和分层5折交叉验证评估了Full21、Top15、Top10、Top7、Top5和Top3配置。排名最高的三个度量是avg_clustering_coeff_median、avg_clustering_coeff_std和avg_clustering_coeff_mean。Top3实现了最高的观测平均性能，准确率为97.148%，加权F1分数为97.055%，MCC为0.9675，而Full21分别为95.999%、95.521%和0.9549。同时，总运行时间从14,961.39秒减少至589.22秒（减少96.06%）。这些结果表明，在评估设置下，重要性引导的度量缩减能够提供紧凑的NVG表示，具有更高的观测平均预测性能和显著更低的计算成本。
英文摘要
Natural Visibility Graph (NVG) based analysis characterizes network traffic through topological descriptors reflecting different structural properties. However, not all descriptors contribute equally to cyber-attack classification, and extracting a large metric set can increase computational cost. This study evaluates 21 NVG derived topological metrics and investigates whether a compact subset can preserve classification capability while improving computational efficiency. Four importance analysis methods SHAP, grouped Permutation Importance, Boruta, and Recursive Feature Elimination (RFE) are integrated through a Consensus Ranking strategy. Based on this ranking, Full21, Top15, Top10, Top7, Top5, and Top3 configurations are evaluated using the CICIDS2018 dataset, a CNN classifier, and stratified 5 fold cross validation. The three highest ranked metrics are avg_clustering_coeff_median, avg_clustering_coeff_std, and avg_clustering_coeff_mean. Top3 achieved the highest observed mean performance, with 97.148% accuracy, 97.055% weighted F1 score, and an MCC of 0.9675, compared with 95.999%, 95.521%, and 0.9549 for Full21, respectively. It also reduced total runtime from 14,961.39 s to 589.22 s (96.06%). These results indicate that importance guided metric reduction can provide a compact NVG representation with higher observed mean predictive performance and substantially lower computational cost under the evaluated setting.
