MeshGraph GCN
MeshGraph is a graph convolutional node classifier for detecting compromised assets inside a simulated enterprise network. Nodes carry host telemetry, while edges encode observed communication. Compromise begins at sparse seeds and propagates stochastically through the network.
The GCN is compared with a logistic-regression baseline that sees identical host features but cannot use graph structure.
This is a transductive benchmark: the graph and all node features are visible during training, while validation and test labels remain hidden.
Reproduce
uv run python projects/meshgraph-gcn/generate_data.py
uv run python projects/meshgraph-gcn/train.py
Verified results
The generated graph contains 600 nodes, 1,689 undirected communication edges, six subnets, and a 23.33% compromise rate. The final test contains 120 nodes:
| Model | Parameters | Accuracy | ROC-AUC | Average precision | F1 |
|---|---|---|---|---|---|
| Feature-only logistic regression | 9 fitted coefficients | 78.33% | 0.8362 | 0.6274 | 0.5938 |
| Two-layer GCN | 802 | 81.67% | 0.8564 | 0.6976 | 0.6333 |
Both thresholds were selected independently on the same 120-node validation split. The GCN improved F1 by 3.96 points and average precision by 7.02 points.