# A Quantitative Analysis of Graph Representation Strategies for Cyber Attack Detection

arXiv: https://arxiv.org/abs/2610.04019 · HTML: https://mlsanity.com/paper/2610.04019/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 7 of its 41 references that are in the map.
- First posted on arXiv 2 Oct 2026.

## Builds on (most cited first, 7 of 7)

- [E-GraphSAGE: A Graph Neural Network based Intrusion Detection System for IoT](https://mlsanity.com/paper/2103.16329/) (2021)
- [Anomal-E: A Self-Supervised Network Intrusion Detection System based on Graph Neural Networks](https://mlsanity.com/paper/2207.06819/) (2022)
- [Graph-based Solutions with Residuals for Intrusion Detection: the Modified E-GraphSAGE and E-ResGAT Algorithms](https://mlsanity.com/paper/2111.13597/) (2021)
- [A Graph-Based Machine Learning Approach for Bot Detection](https://mlsanity.com/paper/1902.08538/) (2019)
- [DeepCatra: Learning Flow- and Graph-based Behaviors for Android Malware Detection](https://mlsanity.com/paper/2201.12876/) (2022)
- [Tracking Temporal Evolution of Network Activity for Botnet Detection](https://mlsanity.com/paper/1908.03443/) (2019)
- [XG-NID: Dual-Modality Network Intrusion Detection using a Heterogeneous Graph Neural Network and Large Language Model](https://mlsanity.com/paper/2408.16021/) (2024)

## Abstract (arXiv)

Graph based cyber attack detection studies employ various graph construction and representation strategies across different cybersecurity application domains. This diversity motivates a quantitative examination of how representation strategies are distributed across these application domains. This study presents a quantitative analysis of 37 original studies published between 2019 and 2026. Each study was coded according to publication year, application domain, graph representation type, feature extraction strategy, learning paradigm, algorithm, and dataset. Frequency analysis, cross tabulation, and statistical association tests were applied. Automated representation learning was the most frequently employed strategy, accounting for 73.0% of the studies, while handcrafted representation strategies accounted for 27.0%. The Fisher Freeman Halton exact test revealed a statistically significant association between application domain and representation strategy (exact p = 0.008; Cramer's V = 0.540). The findings indicate that automated representation learning predominates within the analyzed corpus and that the distribution of representation strategies differs across cybersecurity application domains.