| --- |
| license: apache-2.0 |
| task_categories: |
| - tabular-classification |
| tags: |
| - graph-neural-network |
| - cybersecurity |
| - node-classification |
| - pytorch |
| --- |
| |
| # MeshGraph GCN |
|
|
| MeshGraph is a graph convolutional node classifier for detecting compromised assets |
| inside a simulated enterprise network. Nodes carry host telemetry, while edges encode |
| observed communication. Compromise begins at sparse seeds and propagates stochastically |
| through the network. |
|
|
| The GCN is compared with a logistic-regression baseline that sees identical host |
| features but cannot use graph structure. |
|
|
| This is a transductive benchmark: the graph and all node features are visible during |
| training, while validation and test labels remain hidden. |
|
|
| ## Reproduce |
|
|
| ```powershell |
| uv run python projects/meshgraph-gcn/generate_data.py |
| uv run python projects/meshgraph-gcn/train.py |
| ``` |
|
|
| ## Verified results |
|
|
| The generated graph contains 600 nodes, 1,689 undirected communication edges, six |
| subnets, and a 23.33% compromise rate. The final test contains 120 nodes: |
|
|
| | Model | Parameters | Accuracy | ROC-AUC | Average precision | F1 | |
| | --- | ---: | ---: | ---: | ---: | ---: | |
| | Feature-only logistic regression | 9 fitted coefficients | 78.33% | 0.8362 | 0.6274 | 0.5938 | |
| | Two-layer GCN | 802 | **81.67%** | **0.8564** | **0.6976** | **0.6333** | |
|
|
| Both thresholds were selected independently on the same 120-node validation split. |
| The GCN improved F1 by 3.96 points and average precision by 7.02 points. |
|
|
