# Multi-centrality Graph Spectral Decompositions and their Application to Cyber Intrusion Detection

arXiv: https://arxiv.org/abs/1512.07372 · HTML: https://mlsanity.com/paper/1512.07372/

## Key facts

- Cited by 3 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 23 Dec 2015.

## Built on by (most cited first, 3 of 3)

- [Zero Day Threat Detection Using Graph and Flow Based Security Telemetry](https://mlsanity.com/paper/2205.02298/) (2022)
- [Unsupervised Abnormal Traffic Detection through Topological Flow Analysis](https://mlsanity.com/paper/2205.07109/) (2022)
- [Using Graph Theory for Improving Machine Learning-based Detection of Cyber Attacks](https://mlsanity.com/paper/2402.07878/) (2024)

## Abstract (arXiv)

Many modern datasets can be represented as graphs and hence spectral decompositions such as graph principal component analysis (PCA) can be useful. Distinct from previous graph decomposition approaches based on subspace projection of a single topological feature, e.g., the Fiedler vector of centered graph adjacency matrix (graph Laplacian), we propose spectral decomposition approaches to graph PCA and graph dictionary learning that integrate multiple features, including graph walk statistics, centrality measures and graph distances to reference nodes. In this paper we propose a new PCA method for single graph analysis, called multi-centrality graph PCA (MC-GPCA), and a new dictionary learning method for ensembles of graphs, called multi-centrality graph dictionary learning (MC-GDL), both based on spectral decomposition of multi-centrality matrices. As an application to cyber intrusion detection, MC-GPCA can be an effective indicator of anomalous connectivity pattern and MC-GDL can provide discriminative basis for attack classification.