GPML: Graph Processing for Machine Learning

Julien Michel; Majed Jaber; Nicolas Boutry; Pierre Parrend

REVIEW 4 major objections 5 minor 1 cited by

GPML: Graph Processing for Machine Learning

T0 review · 4 major / 5 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Turning raw network traffic into evolving graphs, the GPML library reports attack detection at an MCC of 0.96 on UGR16 and near-perfect spectral detection on Botnet, beating graph-neural-network baselines.

desk verdict A real, open-source graph feature library whose headline detection gains hinge on an unstated cross-validation split; the code and docs are solid, but the evaluation is not yet convincing. read the letter →

arxiv 2505.08964 v1 pith:IE2VDHZB submitted 2025-05-13 cs.LG cs.AIcs.CR

Majed Jaber , Julien Michel , Nicolas Boutry , Pierre Parrend This is my paper · ORCID

classification cs.LGcs.AIcs.CR

keywords GraphprocessingMachinelearningSpectralanalysiscommunitiesAnomalydetectionNetworksecurityDynamicnetworksPythonlibrary

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper introduces GPML, a Python library that converts raw network traffic traces into time-windowed graphs and extracts two families of features: dynamic graph community metrics and spectral metrics from the graph Laplacian. The authors claim these graph-derived features, when added to tabular classifiers, substantially improve detection of cyber-attacks compared with baselines, including graph neural networks. The value of the claim is that network behaviour is inherently relational and temporal, so representing it as evolving graphs should reveal interaction anomalies and community shifts that flat feature sets miss. If the reported results hold, GPML gives security analysts a practical tool for both real-time detection and forensic analysis without requiring custom deep-learning infrastructure.

What carries the argument

The central mechanism is the construction of time-windowed graphs from network flows, with nodes as IP addresses and edges weighted by packet counts, byte sizes, or rates. From consecutive graph snapshots, the library computes dynamic community metrics—stability, density, conductance, and degree—across propagated communities, and spectral metrics—connectedness, flooding, and wiriness—from the ordered eigenvalues of the Laplacian of each subgraph. These metrics are appended as columns to the original dataframe, so a tabular model such as XGBoost can learn from temporal and structural graph evolution without needing a graph neural network.

What would settle it

Re-run the DGC and SM pipelines on a held-out later month of UGR16 and on fresh TonIoT captures, and give E-GraphSage and EN-GConv the same hyperparameter search budget as the XGBoost classifier; if the MCC gap between the graph-feature models and the tuned GNN baselines shrinks to near zero, or the features fail to transfer across time periods, the paper's central claim is weakened.

Watch

Extended reading notes

Core claim

The central claim is that dynamic graph community features and spectral graph features, extracted from short time windows of raw traffic, make standard classifiers dramatically better at detecting attacks in dynamic networks. On UGR16, the DGC method raises Matthews Correlation Coefficient from 0.52 (baseline) to 0.96 and True Positive Rate from 0.44 to 0.93 in binary prediction, with similar gains in multi-class F1-scores for attack categories such as anomaly-spam and scan. On the Botnet dataset, the SM spectral method reaches an MCC of 0.91 for binary detection and outperforms both E-GraphSage and EN-GConv in most multi-class settings on Botnet and TonIoT, achieving F1-scores near 1.0 for categories such as ScanService and DDoS. The paper positions the two approaches as complementary: community metrics capture cluster-level anomalies like insider threats, while spectral metrics expose structural anomalies like covert channels.

Load-bearing premise

The reported gains assume that the public datasets UGR16, Botnet, and TonIoT are representative of real network traffic and that the baseline models E-GraphSage and EN-GConv are configured fairly; the paper gives no hyperparameter details or statistical tests, so if the baselines are undertuned or the data is unrepresentative, the improvements are inflated.

Editorial extensions

If this is right

If DGC and SM generalize beyond the three evaluated datasets, security teams can enrich ordinary traffic logs with graph-derived features using a standard machine-learning stack, avoiding dedicated GNN training.
The near-perfect multi-class F1-scores reported for specific attack types suggest that graph evolution features may separate attack categories that flat features confuse, enabling more precise alert triage.
The reported prediction times (roughly 1 to 1.5 seconds) indicate that the feature pipeline could support near-real-time detection, with fitting time as the main computational bottleneck.
Because the features are extracted per time window, the same library can serve both live monitoring and historical forensics by replaying recorded traffic through the same graph-construction and metric-extraction steps.
The authors' comparison of graph-derived features against graph neural networks points to a testable general question: topological summaries can sometimes outperform learned embeddings for intrusion detection on small and noisy traffic data.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

A natural next experiment the authors do not run is combining DGC community features with SM spectral features in one feature set; the paper's own framing suggests complementary strengths, so a combined model might exceed either alone.
Because the library computes metrics from Laplacian eigenvalues, its spectral features could be interpreted as early-warning signals: rapid shifts in connectedness or flooding might precede the appearance of a labelled attack, a testable hypothesis on timestamped datasets.
The same time-windowed community and spectral machinery could be applied outside cybersecurity to dynamic social or financial networks, where community shifts and structural anomalies are also meaningful, though the paper does not claim this.
The paper's evaluation lacks hyperparameter details and statistical significance tests; a fair re-run with tuned baselines would clarify how much of the reported gain is due to the graph features rather than to under-configured competitors.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

GPML is worth a look as a software contribution: it turns raw network flows into graph-based features (community and spectral metrics), ships under an ISC license with a GitHub repo and a Kaggle reproducible capsule, and the example use cases are genuine. The DGC evaluation on UGR16 and the spectral comparison on Botnet/TonIoT are the first results from the library, so the empirical payload is fresh.

The library itself appears cleanly structured—data prep, metrics, visualization—and the metrics are anchored in prior literature, including the authors' own spectral method [3]. No red flags in the code structure; it comes with tests and documentation.

Now the soft spots. The biggest is the evaluation protocol. Figure 5 is described only as "5-folds evaluation using XGBoost." The dataset is a time series, attacks persist across adjacent windows, and the features are window aggregates. If the folds are random at the row level, temporal autocorrelation leaks into the test set, and that inflation hits the graph-enriched features harder than the raw baseline. That could easily explain the jump from 0.52 to 0.96 MCC. The paper must state whether the folds are blocked by time; if they are not, the central claim is unsupported. This is the load-bearing question.

Smaller issues: no standard deviations, no hyperparameters for the baselines (E-GraphSage, EN-GConv), no statistical tests. Tables 4 and 5 contain typos—"90.839" and "90.395" are clearly decimal-point slips. That is not fatal, but it makes you scrutinize the rest of the numbers.

The spectral metrics are drawn from the authors' prior work, so the real novelty here is the library itself plus the DGC experiments. That is fine; they cite [3] properly.

My recommendation: send this to peer review, but with a referee who checks the cross-validation protocol carefully. If the folds are temporal, the headline result falls. If they are blocked, this becomes a useful tool for the cybersecurity-ML community. I would not cite it myself until that question is answered, but it deserves serious refereeing.

Referee Report

4 major / 5 minor

Summary. The paper presents GPML, a Python library that transforms raw network traffic traces into graph representations and computes community and spectral metrics for cybersecurity detection. The library provides time-series extraction, community-metric insertion, spectral-metric extraction, and graph visualization. The authors illustrate the library on UGR16, Botnet, and TonIoT datasets, reporting that Dynamic Graph Community (DGC) metrics improve binary and multi-class detection over a raw-feature XGBoost baseline, and that their SPECTRA approach matches or beats E-GraphSage and EN-GConv baselines, often with near-perfect F1, MCC, and balanced accuracy. The paper also describes the software architecture, code listings, and a reproducible capsule.

Significance. If the evaluation is sound, GPML is a potentially useful open-source tool for building graph-derived features for network intrusion detection, and the reported gains over both raw baselines and GNN baselines would be substantial. The paper ships a public repository, a reproducible capsule, test cases, and clear code listings, which are strengths. However, the empirical evidence for the central claim is currently under-specified and may be inflated by temporal leakage and undertuned baselines, so the significance cannot yet be assessed reliably.

major comments (4)

[Section 4.2, Tables 2-3] The 5-fold evaluation is not specified as time-blocked. The data are timestamped network streams and the newly engineered features (Listings 1.2 and 1.3) are aggregated per time window. If folds are constructed by random row splits, the same time window, and often the same attack session, appears in both training and test sets, allowing the model to memorize window-level feature-label co-occurrence. This would inflate the graph-enriched methods more than the raw baseline, since only those methods carry window-level aggregation. The authors must state the splitting regime explicitly and, preferably, report a time-based split (e.g., training on earlier windows, testing on later ones) to rule out temporal leakage.
[Section 4.2, Tables 4-5] The baseline comparison is under-specified. No hyperparameters, training details, or tuning procedures are given for XGBoost, E-GraphSage, or EN-GConv, and no standard deviations or confidence intervals are reported. Several reported values are near the theoretical maximum (e.g., F1=1, MCC=1 in Tables 4 and 5), which is difficult to evaluate without variance estimates or a description of the data splits. The sentence claiming 'SPECTRA significantly outperforms GCN' also mislabels the baseline, which is EN-GConv, a node-edge graph convolutional network; the comparison should be stated accurately.
[Section 4.2, Tables 4-5] Some entries in Tables 4 and 5 are impossible values and appear to be typographical errors: in Table 4, Balanced Acc for E-GraphSage on DDoS is '90.839' and MCC for E-GraphSage on Ransomware is '90.395', both of which are outside the [0,1] range for these metrics. These errors undermine confidence in the numerical claims and must be corrected, with the underlying results reproduced.
[Section 3.1] The metric definitions are incomplete and in places unreadable. The Stability formula in the text is missing its denominator in the rendered version and uses undefined set notation (¯Vt), and the Flooding formula is presented as `((1/N sum) - 1)` without a clear statement of the summation bounds or whether the result is normalized. Since the library's advertised functionality is precisely the computation of these metrics, the authors should provide complete, formal mathematical definitions for Stability, Density, Conductance, Degree, Connectedness, Flooding, and Wiriness, or clearly point to a self-contained appendix containing them.

minor comments (5)

[Listing 1.9] The code snippet contains a missing opening quote before `src_port`, so it will not run as printed.
[Fig. 5 caption] The caption says 'dynamic graphe community metrics' instead of 'dynamic graph community metrics'.
[Table 5 header] The header row contains a stray '%' symbol before 'E-GraphSage'.
[Section 4.2, Fig. 6 text] The phrase '0.97 out of 0.61 for COD' and '0.99 out 0.01 for COD' is confusing; it should be rewritten to clearly compare SPECTRA with the COD baseline.
[Section 2] The sentence 'GPML library builds on established methods in network graph analysis and leverages widely used libraries like NetworkX [2] for graph operations and Pandas [8] for data handling' would benefit from a citation for the temporal-graph and dynamic-community methodology rather than only a reference to the authors' prior paper [3].

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: graph features are deterministic inputs to classifiers, not fitted or derived from predicted labels.

full rationale

The paper's central claims are that the GPML library computes community and spectral graph features that improve attack detection when fed to classifiers, and that these features outperform GNN baselines on public datasets. The features themselves are defined deterministically from network graphs: community metrics follow the external definitions cited from Yang and Leskovec [14], and spectral metrics follow formulas stated in Section 3.1, with their detailed derivation delegated to the authors' prior work [3]. No parameter of these feature definitions is fitted to the evaluation labels or to the performance metrics being predicted, so the reported DGC and SM results are not equivalent to the inputs by construction. The evaluation in Section 4.2 compares multiple fixed feature sets against XGBoost and against external GNN baselines using standard metrics, which is a falsifiable empirical comparison rather than a tautological derivation. The self-citations to [3] provide provenance for the spectral-metric formulas and experimental protocol; they do not alone establish the predictive superiority claim, which is supported by the tables and figures in this paper. Therefore no load-bearing step reduces a prediction to its input. Potential concerns about temporal leakage in the 5-fold splits or about baseline hyperparameter tuning are evaluation-validity risks, not circularity, and would require additional experiments rather than indicating that the derivation is circular.

Assumptions & free parameters 2 free parameters · 3 assumptions · 0 invented entities

The central claim rests on user-chosen parameters (time interval, N) and on domain assumptions about the validity of graph metrics and datasets. No new entities are postulated.

free parameters (2)

Time interval (t) = Varies (1s in example, 5min in community example)
The library requires users to specify time windows for graph construction and metric computation; the choice affects the resulting metrics and is not derived from theory.
N (number of network devices) = Not specified in paper
The spectral metrics Flooding and Wiriness require the number of devices N, which the user must supply; results depend on this choice.

assumptions (3)

domain assumption Laplacian spectrum of a graph captures meaningful network structure for attack detection
The spectral metrics are based on eigenvalues of the Laplacian; the paper cites prior work [3] but does not justify why these eigenvalue summaries are discriminative for cyber-attacks.
domain assumption Community metrics from [14] are appropriate for network security tasks
The community metrics (stability, density, conductance, degree) are adopted from Leskovec's community definitions without justification of their relevance to attack detection.
domain assumption The public datasets (UGR16, Botnet, TonIoT) are correctly labeled and representative of real network traffic
The evaluation relies on these datasets as ground truth; no analysis of label noise or domain shift is provided.

how reviews work

0 comments

Cite this review

Pith. "Pith review of GPML: Graph Processing for Machine Learning." pith.science (2026). https://pith.science/paper/IE2VDHZB

@misc{pith2026250508964,
  author       = {Pith},
  title        = {Pith review of: GPML: Graph Processing for Machine Learning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/IE2VDHZB}},
  note         = {Machine review of arXiv:2505.08964}
}

read the original abstract

The dramatic increase of complex, multi-step, and rapidly evolving attacks in dynamic networks involves advanced cyber-threat detectors. The GPML (Graph Processing for Machine Learning) library addresses this need by transforming raw network traffic traces into graph representations, enabling advanced insights into network behaviors. The library provides tools to detect anomalies in interaction and community shifts in dynamic networks. GPML supports community and spectral metrics extraction, enhancing both real-time detection and historical forensics analysis. This library supports modern cybersecurity challenges with a robust, graph-based approach.

Figures

Figures reproduced from arXiv: 2505.08964 by the authors.

**Figure 1.** UML diagram showing the structure of the GPML library – data - Includes various datasets in CSV format. – doc - Holds the library documentation, detailing the dataset functionalities and usage. – test - Contains test cases for regression, providing examples that can be adapted to similar datasets using the specified constraints and parameters [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗

**Figure 2.** UML workflow diagram community strategy 3.4 Software functionalities The library functionalities can be divided into three main parts: – Extracting community graph features, – Extracting spectral graph features, – Plotting connectivity graphs. Additionally, because the library requires correct inputs to function normally, you must make sure your dataset contains the following common features that exist in every traf… view at source ↗

**Figure 3.** UML workflow diagram for spectral graph strategy The library provides a set of functionalities that help to add new features for better predictions. The main functionalities are: 1 time_series_extractor ( df , stime , time_unit , features_list , sortby_list , groupby_list , aggregation_dict ) Listing 1.1. Extraction of time series In the time series extractor, a time interval of t = 1s is applied to the dataframe df… view at source ↗

Figures from the paper (3 more)

**Figure 4.** Figure 4: Ransomware attack in Ton-IoT dataset presented via HTML using graphviz function that exist in GPML library [PITH_FULL_IMAGE:figures/full_fig_p008_4.png]

**Figure 5.** Figure 5: Comparison of graph community approaches with baseline on UGR16 dataset with 5-folds evaluation using XGboost. Base set is original dataset feature space, the other one are the same dataset enriched with incrementally: graph metrics, graph community metrics and dynamic…

**Figure 6.** Figure 6: Comparison of spectral graph approaches with baseline on Botnet dataset COD CTS CTW SM 0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1 Binary prediction Score MCC Balanced Accuracy TPR TNR COD CTS CTW SM 0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1 multi-class Prediction F1 Score D…

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

SearchEyes: Towards Frontier Multimodal Deep Search Intelligence via Search World Simulation
cs.AI 2026-07 unverdicted novelty 6.0 of 10

SearchEyes unifies multimodal search-agent training via Perception-Knowledge Chains on Wikidata5M and Hop-Anchored Policy Optimization, claiming a 6.2-point average gain over the strongest open-source baseline on six ...

Reference graph

Works this paper leans on

14 extracted references · 13 canonical work pages · cited by 1 Pith paper

[3]

Graph-based spectral analysis for detecting cyber attacks

Majed Jaber, Nicolas Boutry, and Pierre Parrend. Graph-based spectral analysis for detecting cyber attacks. In Proceedings of the 19th International Conference on Availability, Reliability and Security , pages 1–14, 2024

work page 2024
[1]

Ne-gconv: A lightweight node edge graph convolutional network for intrusion detection

Tanzeela Altaf, Xu Wang, Wei Ni, Ren Ping Liu, and Robin Braun. Ne-gconv: A lightweight node edge graph convolutional network for intrusion detection. Com- puters & Security , 130, 2023

work page 2023
[2]

Networkx: Network analysis with python

Aric Hagberg and Drew Conway. Networkx: Network analysis with python. URL: https://networkx.github.io, 2020

work page 2020
[4]

Towards the development of realistic botnet dataset in the internet of things for network forensic analytics: Bot-iot dataset

Nickolaos Koroniotis, Nour Moustafa, Elena Sitnikova, and Benjamin Turnbull. Towards the development of realistic botnet dataset in the internet of things for network forensic analytics: Bot-iot dataset. Future Generation Computer Systems, 100:779–796, 2019

work page 2019
[5]

Limitations of signature-based threat detection

Parameshwar Reddy Kothamali and Subrata Banik. Limitations of signature-based threat detection. Revista de Inteligencia Artificial en Medicina , 13(1):381–391, 2022

work page 2022
[6]

Graphsage-based traffic speed fore- casting for segment network with sparse data

Jielun Liu, Ghim Ping Ong, and Xiqun Chen. Graphsage-based traffic speed fore- casting for segment network with sparse data. IEEE Transactions on Intelligent Transportation Systems, 23(3):1755–1766, 2020

work page 2020
[7]

E-graphsage: A graph neural network based intrusion detection system for iot

Wai Weng Lo, Siamak Layeghy, Mohanad Sarhan, Marcus Gallagher, and Marius Portmann. E-graphsage: A graph neural network based intrusion detection system for iot. In NOMS 2022-2022 IEEE/IFIP Network Operations and Management Symposium, pages 1–9. IEEE, 2022

work page 2022
[8]

pandas: a foundational python library for data analysis and statistics

Wes McKinney et al. pandas: a foundational python library for data analysis and statistics. Python for high performance and scientific computing , 14(9):1–9, 2011

2011

Show all 14 references

[9]

A new distributed architecture for evaluating ai-based security systems at the edge: Network ton iot datasets

Nour Moustafa. A new distributed architecture for evaluating ai-based security systems at the edge: Network ton iot datasets. Sustainable Cities and Society , 72, 2021

2021
[10]

Multi-aspect rule-based ai: Methods, taxonomy, challenges and directions toward automation, intelligence and transparent cybersecurity modeling for critical infras- tructures

Iqbal H Sarker, Helge Janicke, Mohamed Amine Ferrag, and Alsharif Abuadbba. Multi-aspect rule-based ai: Methods, taxonomy, challenges and directions toward automation, intelligence and transparent cybersecurity modeling for critical infras- tructures. Internet of Things , 2024

2024
[11]

Alert fatigue in security operations centres: Research challenges and opportunities.ACM Computing Surveys, 2025

Shahroz Tariq, Mohan Baruwal Chhetri, Surya Nepal, and Cecile Paris. Alert fatigue in security operations centres: Research challenges and opportunities.ACM Computing Surveys, 2025

2025
[12]

A survey on various cyber attacks and their classification

M Uma and Ganapathi Padmavathi. A survey on various cyber attacks and their classification. Int. J. Netw. Secur. , 15(5):390–396, 2013

2013
[13]

A comprehensive survey on graph neural networks.IEEE transactions on neural networks and learning systems , 32(1):4–24, 2020

Zonghan Wu, Shirui Pan, Fengwen Chen, Guodong Long, Chengqi Zhang, and Philip S Yu. A comprehensive survey on graph neural networks.IEEE transactions on neural networks and learning systems , 32(1):4–24, 2020

2020
[14]

Defining and evaluating network communities based on ground-truth

Jaewon Yang and Jure Leskovec. Defining and evaluating network communities based on ground-truth. In Proceedings of the ACM SIGKDD Workshop on Mining Data Semantics, MDS ’12, New York, NY, USA, 2012. Association for Computing Machinery. T able 3. Comparison study between E-Gra...

2012

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.

[1] [3]

Graph-based spectral analysis for detecting cyber attacks

Majed Jaber, Nicolas Boutry, and Pierre Parrend. Graph-based spectral analysis for detecting cyber attacks. In Proceedings of the 19th International Conference on Availability, Reliability and Security , pages 1–14, 2024

work page 2024

[2] [1]

Ne-gconv: A lightweight node edge graph convolutional network for intrusion detection

Tanzeela Altaf, Xu Wang, Wei Ni, Ren Ping Liu, and Robin Braun. Ne-gconv: A lightweight node edge graph convolutional network for intrusion detection. Com- puters & Security , 130, 2023

work page 2023

[3] [2]

Networkx: Network analysis with python

Aric Hagberg and Drew Conway. Networkx: Network analysis with python. URL: https://networkx.github.io, 2020

work page 2020

[4] [4]

Towards the development of realistic botnet dataset in the internet of things for network forensic analytics: Bot-iot dataset

Nickolaos Koroniotis, Nour Moustafa, Elena Sitnikova, and Benjamin Turnbull. Towards the development of realistic botnet dataset in the internet of things for network forensic analytics: Bot-iot dataset. Future Generation Computer Systems, 100:779–796, 2019

work page 2019

[5] [5]

Limitations of signature-based threat detection

Parameshwar Reddy Kothamali and Subrata Banik. Limitations of signature-based threat detection. Revista de Inteligencia Artificial en Medicina , 13(1):381–391, 2022

work page 2022

[6] [6]

Graphsage-based traffic speed fore- casting for segment network with sparse data

Jielun Liu, Ghim Ping Ong, and Xiqun Chen. Graphsage-based traffic speed fore- casting for segment network with sparse data. IEEE Transactions on Intelligent Transportation Systems, 23(3):1755–1766, 2020

work page 2020

[7] [7]

E-graphsage: A graph neural network based intrusion detection system for iot

Wai Weng Lo, Siamak Layeghy, Mohanad Sarhan, Marcus Gallagher, and Marius Portmann. E-graphsage: A graph neural network based intrusion detection system for iot. In NOMS 2022-2022 IEEE/IFIP Network Operations and Management Symposium, pages 1–9. IEEE, 2022

work page 2022

[8] [8]

pandas: a foundational python library for data analysis and statistics

Wes McKinney et al. pandas: a foundational python library for data analysis and statistics. Python for high performance and scientific computing , 14(9):1–9, 2011

2011