Edge Weight Concentration Overcomes Node Degree Blindness in Graph Based Network Intrusion Detection
This paper demonstrates that in graph-based network intrusion detection, edge-weight concentration features outperform traditional node-degree metrics when network address translation (NAT) collapses multiple hosts into few identities, revealing that these two feature families are complementary along the identity-collapse axis and that a compact, leakage-free graph-context feature set can achieve near-baseline performance with significantly reduced training costs.