MSG-VA: multi-scale graph visual analytics for real-time network threat detection

Abstract

MSG-VA is a hierarchical graph pipeline with analyst-in-the-loop visual analytics for real-time network threat detection. Under a defined threat model, adversaries manipulating host–to–host communication patterns—assumptions include flow-level telemetry and a sub-second latency budget. Entities are aggregated by subnet/role and time to form multi-scale graphs. A lightweight GNN computes embeddings and flags anomalies using adaptive thresholding. Alerts and provenance paths are surfaced in an interactive dashboard. On CICIDS2017 and UNSW-NB15, MSG-VA attains F1 94.8%, Accuracy 95.0%, and FPR 5.6%, outperforming tuned RF and DNN baselines under identical, leakage-free splits. An ablation study isolating the multi-scale design shows a 2–3× reduction in compute, with ≤ 0.5 pp F1 loss, and a 10-task analyst study indicates a 34% faster triage. A reproducible end-to-end benchmark reports a median alert latency of 95.7 ms (including graph construction, inference, and visualization push) and a model-inference throughput of ~ 250,000 nodes/s. Code, exact splits, and configurations are released to enable replication. Contributions: (i) a concrete multi-scale coarsening policy tied to network roles and time; (ii) a compact GNN with adaptive thresholding that improves detection at low FPR; (iii) a real-time visual analytics workflow validated by ablations, zero-day/cross-dataset tests, and a small user study.