GIDS-Eval Exposes How Graph IDS Benchmarks Mislead SOC Teams
Two crafted edges. That is all it takes for an attacker to slip past several graph-based intrusion detectors surveyed in GIDS-Eval, forthcoming at ACM CCS 2026.
GIDS-Eval Exposes How Graph IDS Benchmarks Mislead SOC Teams
Two crafted edges. That is all it takes for an attacker to slip past several graph-based intrusion detectors surveyed in GIDS-Eval, forthcoming at ACM CCS 2026. The paper is not another leaderboard; it is a demolition of the leaderboard idea itself, and it lands squarely on anyone shipping graph neural networks into a SOC.
The authors decompose graph-based network intrusion detection systems into six interchangeable stages — ingest, graph construction, windowing, preprocessing, encoder, decision — then swap components across nine surveyed and five reimplemented detectors on four datasets. What they find should reset expectations for anyone benchmarking network intrusion detection with graph learning.
The nine gaps that break comparability
Preprocessing alignment alone moves average precision by up to 61.8 percentage points on the same detector, same dataset. Snapshot windowing swings AP by 38.3%. Eighteen detector-dataset pairs in the survey never emit an alert in real time — they score offline batches and call it detection. That gap matters when NIS2 obliges essential entities to notify significant incidents within 24 hours, a clock that starts at detection, not at post-hoc replay.
gids-eval report — cic-ids2017, detector=EulerNet
window=60s preprocess=std AP=0.812
window=60s preprocess=minmax AP=0.194 delta=-61.8pp
window=300s preprocess=std AP=0.429 delta=-38.3pp
alert_latency_p95=offline_batch (no streaming path)Evasion is the punchline. A red-team payload of two additional edges — cheap, low-signal, easy to script — flips the classifier’s decision on several detectors that publish state-of-the-art numbers. This is not adversarial magic; it is a supply-chain problem in the benchmark pipeline.
GIDS-Lite: encoder-free, up to 575× faster
The authors then propose GIDS-Lite, an encoder-free baseline built from the same six-stage skeleton without a learned graph encoder. It ties or beats the complex detectors at up to 575× lower runtime. The lesson: the encoder is often carrying the credit for gains actually produced by preprocessing and windowing choices, an insight the ACM CCS 2026 program will make hard to ignore.
What we take from this at CAI Technology
We already argued in detection-first designs that avoid deep packet inspection that a lean decision layer beats a heavy encoder when telemetry is honest. GIDS-Eval quantifies the intuition. Our position for graph-based defensive tooling is now sharper: publish the six-stage manifest with every model, treat encoder-free baselines as the minimum viable comparator, and refuse any benchmark that omits streaming alert latency. ENISA’s Threat Landscape 2024 keeps network-borne attacks among the leading threat categories for EU critical sectors — the SOC cannot afford to lose 38 AP points to a preprocessing tweak nobody documented.
If you are shortlisting a graph IDS for a NIS2-scoped estate, come talk to the AEGIS team before signing the PoC.