Prediction and Anomaly Detection Framework Using Graph Density Time Series for Cyber Network Data

Security of data systems and monitoring is an important challenge because of the increasing threats that face data security nowadays. As network data grows in complexity, cyberattacks have developed into advanced, changing threats with time. Anomaly network traffic modeling as dynamic graphs has grown as an effective research model to capture these dynamics [1]. The temporal fluctuations of network features serve as an essential indicator of system status, where anomalies often manifest as sudden structural shifts or statistical outliers. The balanced approach between mathematical rigor and computational efficiency is required to detect these anomalies. In cybersecurity data research, machine learning and deep learning have been commonly used in several recent research studies in the intrusion detection field and have undergone critical research these days. This section overviews some of the modern research, including the deep learning frameworks, the statistical time-series frameworks, and the dynamic networks research.

The recent research has placed much focus on neural network structures for intrusion detection. Hussien and Dhannoon [2] have suggested an anomaly detector based on deep neural networks (DNNs) and dropout to avoid overfitting. Their framework which was tested on the NSL-KDD data shows that the application of the concept of Bernoulli noise is effective in increasing the classification accuracy in attacks of more than two classes, such as the denial of service (DoS) and the Probe. Subhi et al. [3] have suggested a complicated hybrid method consisting of Ribonucleic Acid (RNA) encoding with a ResNet50 model due to the need to enhance the detection of high-dimensional data by emphasizing the feature representation of network packets. Manaa et al. [4] created a distributed denial of service (DDoS) mitigation optimization algorithm in the fog layer, which is part of the Internet of Things (IoT). They show the need to minimize latency in dynamic settings, with Support Vector Machine (SVM) to be used in classification. Moreover, Abdulrahman and Ibrahem [5] responded to the fact that the traffic of a network is dynamic, and it is necessary to implement data stream classification, and they focus on the low computation time and real-time processing. Beyond deep learning approaches, several studies have explored statistical and network-based perspectives for anomaly detection. Peel and Clauset [6] analyzed structural change points in evolving networks, demonstrating the importance of topological dynamics for identifying fundamental shifts in interaction patterns. Furthermore, Soule et al. [7] showed that time-series modeling of traffic measurements can effectively reveal anomalies without heavy computational overhead, utilizing filtering techniques to distinguish normal behavior from deviations. Finally, Ranshous et al. [8] introduced a survey categorizing dynamic network anomaly detection methods, where these methods the graph-level event and change detection, which focuses on detecting structural shifts in global network features.

The superiority of sequential hybridization has been further validated by Purwanto et al. [9], who demonstrated that a hybrid model combining autoregressive integrated moving average (ARIMA) with linear trend components significantly outperforms standalone versions by effectively capturing multi-layered volatility. Furthermore, the efficacy of two-step composite modeling, modeling variance and mean sequentially, was validated by Muhammad [10]. By implementing a mixed autoregressive moving average-exponential generalized autoregressive conditional \sloppy heteroscedasticity (ARMA-EGARCH) strategy to address heteroscedasticity, Muhammad established that partitioning signals into distinct modeling phases is a scientifically sound approach for enhancing predictive fidelity in complex datasets.

According to the surveyed literature, it is found that the research on intrusion detection typically takes two different streams. While one stream concerns itself with graph-based analysis for capturing the evolution of the network structure, another stream uses statistical forecasting techniques for studying the temporal dynamics and volatility of the network. The relatively less emphasis has been placed upon developing a unified approach of incorporating dynamic graphs along with volatility-oriented statistical forecasting for monitoring cyber networks. This is because conventional studies based on graphs seldom consider the possibility of mapping graph-based indicators to time-series and then modeling them through hybrid ARMA–EGARCH modeling.

However, a crucial challenge in using a hybrid ARMA-EGARCH model is the selection of the optimal model and its employment in cybersecurity data. Proposes an automated approach that uses the Akaike Information Criterion (AIC) and Bayesian Information Criterion (BIC) [11] to select the best model, and the main aim of this research is to present a hybrid statistical framework that can enhance predictive capabilities and monitor significant volatilities in network dynamic data and classify them as anomalies.

The previous research efforts on the detection of intrusion focus on machine learning methods and deep neural models, this study proposes a statistical graph model that considers both the dynamics and behavior of variance exhibited by cyber networks.

The main contributions of this research are summarized as follows:

• The dynamic network representation is generated by converting the UNSW-NB15 dataset into temporal network snapshots and extracting the graph density.

• The graph density time series framework is proposed, which is making the high dimensionality of the adjacency matrices to be represented as a univariate time series suitable for prediction and anomaly analysis.

• The hybrid ARMA–EGARCH model strategy is presented to capture temporal dependencies and asymmetric volatility clustering in time series, which allows in predicting values and detecting behavioral anomalies in the dynamic network structures.

• The dynamic statistical envelope is constructed, enabling adaptive anomaly detection instead of fixed threshold monitoring.

This research after this section, organized as follows: Section 2 presents the problem formulation; Section 3, details the hybrid methodology; Section 4 presents the describes and represents the datasets; Section 5 presents the experimental results; and finally, Section 6 is the conclusion.

The current security dynamic networks such as communication networks represent one of the most challenging nowadays. Securing these networks through structural analysis of a specific behavior for prediction and high sensitivity anomaly detection. The time series of the network traffic for each snapshot of the network such as a graph density time series ($G_\rho$) represents the essential connectivity patterns. The creation of a monitoring method is complicated because of the volatility clustering and non-stationarity established in the UNSW-NB15 dataset. By Using MATLAB R2024a, our initial diagnostic tests of the squared log-returns series $r_t^2$ of the data refers a relative stability in variance that is unacceptable to has a conditional heteroscedasticity as appears in Table 1 of the Ljung-Box $Q$-test results demonstrated ($h$ = false, $p$ $>$ 0.05).

Although, the diagnostic test on the squared log-returns series first showed that there was relative stability in variance ($h$ = false), it turned out that finding it was still misleading since it failed to capture the localized, high intensity fluctuations when it was further diagnosed using Advanced Distributional Analysis (Table 2 and Figure 1), which showed that the excess kurtosis was very high (7.3312) and the Jarque-Bera null hypothesis was significantly rejected ($p$ $<$ 0.001).

These results are conclusive statistical data of the existence of fat tails, showing that the network snapshots are experiencing extreme non-Gaussian structural shocks. The conventional predictive theories tend to use the homoscedasticity hypothesis, which does not reflect the non-linear nature of series with great fluctuations [10]. It means that any successful security model should address the prediction problem first, i.e., by modeling the time varying mean over time and the asymmetric volatility of the network structure correctly. Traditional linear models fail in this predictive task since they cannot explain the shocks in network stability. Consequently, they produce large prediction errors that directly affect the subsequent anomaly detection phase. In security context, large fluctuations reflect structural conflict between normal traffic and attack patterns. Such asymmetric shocks are appropriately modeled by a modeling framework such as EGARCH which is statistically justified and necessary in this context to hold these fat-tailed behavior and security-driven fluctuations. The predictive accuracy of any anomaly detection system is the key to its effectiveness. In the UNSW-NB15 dynamic network dataset, the detection threshold will not be reliable when the prediction model is not capable of producing a low error rate. This requires a resilient security boundary, implemented as a dynamic statistical envelope that adapts to the changing state of the network. The proposed framework provides precise prediction of the future density as a baseline, and detects outliers using a dynamic statistical envelope. An observation is flagged only when it falls outside the K-sigma confidence interval, which dynamically widens and narrows according to the anticipated volatility.

The proposed framework is based on a multi-step statistical pipeline that is meant to capture the non-linear, multi-stage dynamics of network stability. This methodology is a combination of an ARMA model to predict the mean and an EGARCH model for asymmetric volatility in order to result in an enhancement model for prediction and anomaly detection, as described in the Figure 2.

A dynamic network can be represented as separable networks of discrete-time, ordered sequences of graph snapshots $G_t=\left\{G_1, G_2, \ldots, G_T\right\}$, $t=1,2, \ldots, T$. Each $G_t=\left(V, E_t, A_t\right)$ represents the network at time $t$, with $V$ as the set of nodes (vertices), $E_t$ as the set of active edges (interaction) during the interval time $t$, and $A_t$ as the adjacency matrix. Depending on the nature of the interactions, the network can be represented as either an undirected or a directed graph, which is the adjacency matrix $A_t$ is symmetric $\left(A_{i j}=A_{j i}\right)$, where $A_{(i j, t)}=1$ indicating a link (edge) between nodes $i$ and $j$, while $A_{(i j, t)}=0$ otherwise, and the other type is the directed graph, $A_t$ represents non-symmetric $\left(A_{i j} \neq A_{j i}\right)$ which is considered better suited for most cybersecurity contexts (e.g., packet flows or financial transfers, etc.), where the network is modeled as a directed graph [12]. These snapshots are translated into graph density time series to quantify the structural connectivity over time using the following computation [13]:

To stabilize the series for heteroscedasticity analysis, and to be able to capture the dynamic change rate of connectivity, $G_{\rho, t}$ is converted into a log-returns series $\left(r_t\right)$ :

The transformation quantifies the relative change in structural connectivity between successive time steps, which is critical in the modeling of the volatility of the network environment. Figure 3 illustrates the $r_t$ series of $G_{\rho, t}$ whereas Figure 4 presents both the original graph density series and the corresponding log-returns series.

In this research, graph density was chosen as the main structural descriptor for generating the time series; however, dynamic networks may also exhibit other localized variations in structure. In this regard, the possibilities of incorporating complementary graph features, including the average degree and clustering coefficient, to describe topological dynamics, which are left open for future expansions of the methods.

Dynamic network analysis is based on a series of network snapshots defined by summary statistics or features, which change over time. A high-dimensional network is converted into a univariate time series using a scalar measure to capture its global structure properties. This transformation allows the stochastic process modeling to analyze, forecast network behavior while identify anomalies. To capture the linear dependencies and non-linear asymmetric volatility inherent in network traffic, the hybrid ARMA ($p$, $q$)-EGARCH ($u$, $v$) model is used and is described by the following equations [10]:

The Mean Equation is considered the conditional mean of $r_t$ is modeled using ARMA ($p$, $q$) to capture linear temporal dependencies:

Eq. (3) can be written by using lag operator as follows:

$ \phi(L) r_t=c+\theta(L) \varepsilon_t $

Such that

$ \begin{aligned} \phi(L) & =1-\phi_1 L-\phi_2 L^2-\cdots-\phi_p L^p \\ \theta(L) & =1+\theta_1 L+\theta_2 L^2+\cdots+\theta_q L^q \end{aligned} $

In order to make the ARMA process stationary and invertible, all roots of the polynomials $\phi(L)$ and $\theta(L)$ should lie outside the unit circle. Although $\varepsilon_t$ is typically assumed to be distributed as a Gaussian, our empirical diagnostics (Table 2) show that the Excess Kurtosis (7.33) is large and the Jarque-Bera test ($p$ $<$ 0.001) rejects the null hypothesis of normality. This proves that network shocks are characterized by fat tails, behavior commonly observed in security-related anomalies. The model therefore employs the Quasi-Maximum likelihood (QML) model, which remains consistent under non-Gaussian disturbances and mild regularity conditions, as reported in the Quasi-Maximum likelihood estimator (QMLE) literature [14], [15].

The EGARCH model, developed by Nelson [16], was used to model the non-linear shocks and volatility clustering observed in the network snapshots by estimating the conditional variance $\sigma_t^2$. The EGARCH ($u$, $v$) model, in contrast to the usual generalized autoregressive conditional heteroscedasticity (GARCH), takes into account the asymmetry in network stability, and is defined by the following variance equation [10], [17].

where, $w$ is the constant and $\alpha_j$ denotes the magnitude effect, which is measuring the response of volatility to the size of the shock (autoregressive conditional heteroscedasticity (ARCH) effect), $\beta_i$ denotes volatility persistence of GARCH effect, indicating how long the impact of a network shock lasts, and $\gamma_j$ asymmetry (leverage effect). The stationary requirement of the EGARCH model is expressed as $\sum_{i=1}^u \beta_i<1$.

This hybrid structure enables the model to estimate the expected future network density while simultaneously predicting the conditional volatility necessary to build the dynamic statistical envelope for anomaly detection.

The mathematical framework of the model depends on applying Box-Jenkins modeling. Specifically, after converting the dynamic network into a univariate time series, next step is to determine the best order of ARMA ($p$, $q$)-EGARCH ($u$, $v$) by employing AIC and BIC. The model achieving the minimum value of AIC and BIC is selected as the optimal model, defined as:

where, $\hat{\mathcal{L}}$ represents the value of likelihood estimation, $N$ is the sample size, and $k$ is the number of the model’s parameters in the hybrid ARMA ($p$, $q$)-EGARCH ($u$, $v$). The AIC tends to put more importance on predictive accuracy, BIC puts a heavier burden on model complexity, thus, making parsimonious specifications and minimizing the risk of over-parameterization. Using the systematic selection process and the grid search findings (refer to Table 3), the ARMA ($p^*$, $q^*$)-EGARCH ($u^*$, $v^*$) model is revealed as the best specification. This model attains a good balance among the fit of the model and model complexity to give a strong background on which it is possible to capture the dynamics of the network and that of the dynamic statistical envelope for anomaly detection.

After the optimal ARMA ($p^*$, $q^*$)-EGARCH ($u^*$, $v^*$) model is identified and its parameters are estimated, the framework proceeds to the forecasting phase. Unlike traditional models that predict only the conditional mean, The proposed approach provides a two-fold forecast by predicting both the network density and its conditional volatility (conditional variance). The conditional mean equation is then used to obtain the $h$-step-ahead forecast of the log-returns $\hat{r}_{t+h}$. To reconstruct the original network density scale, the predicted values are recursively transformed.

This transformation guarantees the predicted traffic patterns maintain the network density metrics. At the same time, EGARCH model predicts the conditional variance $\hat{\sigma}_{t+h}^2$. This represents the “uncertainty” or “instability” expected in the network at time $t$. When there is a security event or a traffic burst, $\hat{\sigma}_t$ rises, indicating the asymmetric shocks of the leverage effect $\left(\gamma_j\right)$. Importantly, asymmetric reaction to shocks on networks is naturally included in the volatility forecasts with the EGARCH leverage term $\left(\gamma_j\right)$. This enables the model to respond to positive and negative structural changes differently; this increases the sensitivity of the dynamic envelope to abnormal network behaviors. The dynamic statistical envelope is built on the original scale of the network density by a volatility-adjusted exponential transformation:

where, $\hat{G}_{\rho, t}$ denotes the forecast value of the network density obtained from ARMA ($p^*$, $q^*$)-EGARCH ($u^*$, $v^*$) model and $\hat{\sigma}_t$ is the forecasted conditional standard deviation. This process is consequence of the log-return representation, which has the network density changing multiplicatively as $G_{\rho, t}=G_{\rho, t-1} e^{r_t}$. Therefore, the volatility in the exponent guarantee’s consistency between the forecasting model and the creation of the dynamic envelope, with preserving the multiplicative structure of network evolution.

Although the Gaussian assumption is violated (as confirmed by the Jarque-Bera test), the scaling factor, $K=3$, has been chosen to be employed as a heuristic threshold that is strong and empirically reflects the empirical distribution of standardized residuals.

The process of the anomaly detection $\left(A D_t\right)$ is unsupervised, meaning the flagged is raised at time $t$ when measured network density $G_{\rho, t}$ observes a density not within the dynamic range:

where, $G_{\rho, t}$ represents the observed value of network density. This reasoning finds Structural Anomalies, which are major violations of the learnt temporal and heteroscedastic dependencies of the network.

All experiments in this research were performed using MATLAB R2024a. This research uses the UNSW-NB15 dataset [18], one of the most common intrusion detection benchmarks, which includes normal and malicious network traffic. The data consists of both numerical and categorical values, and binary and multi-class. The original training and testing subsets are combined to create a single dataset to provide consistency. Categorical attributes are converts into numerical representations employing label encoding. A two-step normalization approach is employed, i.e. min-max scaling of all features is performed, followed by an 80/20 train-test split. The training data are then normalized using Z-score standardization with the same parameters applied to normalize the testing data to avoid data leakage; this preprocessing was adapted to MATLAB based on the framework developed by Rahman [19].

The normalized training data are divided into fixed-size snapshots (2048 flows each). In each snapshot, a line graph is created in which each flow is considered a node and edges will be created between flows with a common source or destination IP address. This model is inspired by dynamic graph-based models like DIGNN-A [20]. This graph representation was selected as it is more flow-centric, rather than the static host level connectivity and allows for a focus on behavioral dynamics at the interaction level. Typically, a time of events relationship can be observed between network flows rather than the scanning of individual IPs, communication with other IPs, moving laterally, and the launching of a distributed attack in the context of malicious activity in a cybersecurity environment. It flows as nodes allowing the method to maintain the fine-grained pattern of communication and temporal correlation among traffic events. The edges created based on common source or destination IP addresses enable the graph to model coordinated or repeated communication patterns that are typically considered intrusion propagation or unusual traffic changes.

This approach is consistent with recent graph intrusion detection dynamic frameworks [20] that also models the temporal dependency in cybersecurity networks, based on interaction-driven graph-based structures. This interaction-based graph formulation enables to represent temporal dynamics in coordinated communications and structural connectivity patterns in cybersecurity traffic by generating the graph density series.

It is applied with an incidence matrix $S_t$ and the adjacency matrix is calculated as $A_t=S_t S_t^{\top}$. Subsequently, self-loop is removed from $A_t$ to ensure a valid and simple graph structure for each snapshot. Each snapshot is denoted by its adjacency matrix, after finishing this process, the UNSW_NB15 dataset’s each snapshot is denoted by its adjacency matrix, containing 100 undirected network snapshots with 2048 nodes and a total of 201,857,695 edges across all snapshots. A sliding window is used to group sequences of 10 consecutive snapshots into dynamic samples in order to capture temporal dependencies, where the labels are assigned with respect to the final snapshot. Subsequently, each snapshot is then extracted to produce structural graph measures, such as graph density, to create a time-series description of network evolution.

This section presents the experimental results of the ARMA ($p^*$, $q^*$)-EGARCH ($u^*$, $v^*$) model and discusses their statistical and practical consequences for dynamic network security analysis. As discussed in Section 3, the initial problem statement, especially, is the existence of non-stationarity, heavy-tailed behavior, and the clustering of volatility in the UNSW-NB15 dataset. This section, discusses the results of the model selection, diagnostic validation, and the appropriateness of the proposed methodology. The model is evaluated in terms of its effectiveness in terms of forecasting accuracy and supporting a dynamic statistical envelope to detect anomalies.

By searching across the different orders, the ARMA ($p^*$, $q^*$)-EGARCH ($u^*$, $v^*$) model was found as the best fitting, with the lowest values AIC of BIC as shown in Table 4 which presents the most 15 best models in this project.

Based on sensitivity analysis, the chosen ARMA (4, 3)-EGARCH (2, 2) model was still the best overall model. It provided the lowest AIC/BIC values as shown in Table 4 and the minimum Root Mean Squared Error (RMSE) (0.0309), whereas the marginally smaller Mean Absolute Error (MAE) difference of the model from the alternative best model as shown in Table 5. It follows that the model choice is reliable and robust to small changes in parameters.

As shown in Table 4, the best model with minimum values of AIC/BIC was ARMA (4, 3)-EGARCH (2, 2) model and its formula will be as follows:

Mean Equation:

$ \begin{gathered} r_t=-0.0005+0.9477 r_{t-1}-1.2850 r_{t-2}+0.7855 r_{t-3}-0.4487 r_{t-4} \\ +\varepsilon_t-1.0326 \varepsilon_{t-1}+1.0385 \varepsilon_{t-2}-0.6437 \varepsilon_{t-3} \end{gathered} $

Variance Equation:

$ \begin{gathered} \ln \sigma_t^2=-1.7981+1.0114 \ln \sigma_{t-1}^2-0.1913 \ln \sigma_{t-2}^2-0.2459\left(\frac{\varepsilon_{t-1}}{\sigma_{t-1}}\right)+\left(\frac{\varepsilon_{t-2}}{\sigma_{t-2}}\right) \\ +0.5308\left(\left|\frac{\varepsilon_{t-1}}{\sigma_{t-1}}\right|-E\left|\frac{\varepsilon_{t-1}}{\sigma_{t-1}}\right|\right)+\left(\left|\frac{\varepsilon_{t-2}}{\sigma_{t-2}}\right|-E\left|\frac{\varepsilon_{t-2}}{\sigma_{t-2}}\right|\right) \end{gathered} $

Such that the mean equation defined as the ARMA (4, 3) model and it is the stationary requirement has been verified by the following:

The roots of the polynomial for Autoregressive model Autoregressive (AR) (4), which is:

$ 1-0.9477 L+1.2850 L^2-0.7855 L^3+0.4487 L^4=0 $

Then, the value of the roots is:

$ \begin{aligned} & a_1=0.9227+0.9749 i, \text { then }\left|a_1\right|=1.3423>1 \\ & a_2=0.9227-0.9749 i, \text { then }\left|a_2\right|=1.3423>1 \\ & a_3=-0.0473+1.1112 i, \text { then }\left|a_3\right|=1.1122>1 \\ & a_4=-0.0473-1.1112 i, \text { then }\left|a_4\right|=1.1122>1 \end{aligned} $

Hence, all roots lie outside the unit circle. While, the roots of the polynomial for Moving Average model Moving average (MA) (3), which is:

$ 1+1.0326 L+1.0385 L^2+0.6437 L^3=0 $

Then, the value of the roots is:

$ \begin{gathered} b_1=1.2990+0 i, \text { then }\left|b_1\right|=1.2990>1 \\ b_2=0.1571+1.0822 i, \text { then }\left|b_2\right|=1.0936>1 \\ b_3=0.1571-1.0822 i, \text { then }\left|b_3\right|=1.0936>1 \end{gathered} $

Hence, all of these roots lie outside the unit circle, which is mean its invertible.

The variance equation corresponds to the EGARCH (2, 2) model, and it is the stationary condition is verified as follows:

$ \sum_{i=1}^2 \beta_i=1.0114-0.1913=0.8201<1 $

For all these mathematical verifications above, we get that the ARMA (4, 3)-EGARCH (2, 2) model is strictly stationary and reliable for forecasting. Table 6 and Figure 5 show a significant improvement in distributional properties after model estimation. The kurtosis is decreased to 3.0782, which is near the usual standard benchmark, which means that the EGARCH model successfully captured and accommodated the fat-tails, and the residuals are now significantly closer to the normal distribution, while the Jarque-Bera test also shows that it is not rejected ($p$ = 0.2167). Following the validation that the standardized residuals behave as white noise and approximate normality. This change validates that the ARMA-EGARCH model is effective at capturing the conditional heteroskedasticity and purges the data into about white noise residuals. Consequently, the model is a good basis for prediction and anomaly detection.

To evaluate the forecasting accuracy, the standard statistical error metrics has been used including Mean Squared Error (MSE), RMSE, MAE, and Mean Absolute Percentage Error (MAPE), which are commonly adopted in time series forecasting research [21]. In addition, Theil’s U inequality coefficient was used to assess the relative predictive performance [22]. Although the ARMA–EGARCH model is estimated using the return series to ensure stationarity, the forecasting performance is evaluated on the reconstructed original series $G_{\rho, t}$ to reflect the model’s practical predictive capability. These metrics are defined as follows:

In the absence of labeled ground truth data labeled, this research used unsupervised metrics of evaluation of anomaly detection. In accordance with Aggarwal [23], calculate the outlier ratio, which is the ratio of detected anomalies to the total observations:

where, $N_{\text {anomaly}}$ represents the number of detected anomalies $A D_t$ and $N$ represents the total number of observations in the test set. Following established practices in robust statistics [24], we compute severity score as the average normalized deviation of detected anomalies, which confirms the statistical significance of the identified outliers.

where, $N_{\text {anomaly}}$ represents the number of detected anomalies $A D_t$ and $\sigma_t$ is the conditional standard deviation estimated by the EGARCH model.

Additionally, the performance of the detection method can be evaluated by adopted confusion matrix-based evaluation metrics, including the Accuracy, Precision, Recall, and F1-Score metrics. These metrics have been used widely to quantify classification and detection performance methods by converting the series into a binary decision task, where a label of 0 refers to the before-change interval and 1 to the after-change interval. The predicted Change point (CP) splits the timelines into two classes, resulting in a set of true positives (TP), true negatives (TN), false positives (FP), and false negatives (FN). These metrics are defined as follows [25]:

The forecasting and anomaly detection are essential steps in the proposed methodology. In this research, the data was partitioned into 80% for training and 20% for testing. The ARMA (4, 3)-EGARCH (2, 2) model trained on the $r_t$ to model both the conditional mean and time-varying volatility of the network time series. The estimated model was then used to forecast the future values of the network density using the by recovering the predicted returns back to the original data. The results indicate that the model is a good predictive with low error measures.

These results refer that the model is effective in capturing the temporal dependencies and nonlinear volatility structure of the data series while keeping high precision in reconstructing the network’s actual behavior. To further illustrate the model’s performance, Table 7 shows the actual and predicted values of the network density series comparison with ARMA model for the first 20 future steps starting in the test region, while, the Figure 6 and Figure 7 illustrate the forecasting data vs. observed data of ARMA (4, 3)-EGARCH (2, 2) and ARMA (4, 3) models, respectively.

The evaluation prediction performance results of the ARMA-EGARCH and ARMA are shown in the Table 8.

The model also introduces an unsupervised approach to anomaly detection through time-varying volatility. As mentioned in section 3, the dynamic statistical envelope was built using a threshold K = 3 (that is, a 99.7% confidence level). The top of Figure 8 clearly shows how the red marks are located outside the pink area; this is considered the visual realization of the model’s success in separating normal behavior from attacks, while the bottom figure shows deviation magnitude, which is a security severity index that measures the magnitude of each anomaly found. This dual representation not only detects an event of an attack but also offers a prioritized view of potential network threats in terms of their statistical significance.

The results in the Table 9 indicates that the proposed methodology was able to identify 6 anomalies with time spent of 0.0009985 seconds as opposed to the 2 anomalies identified by the median absolute deviation (MAD) represents the statistical approach and the single anomaly point identified by the one-class support vector machine (OCSVM) method, with time spent of 0.021857 seconds and 0.032116 seconds, respectively. This represents a great improvement in both sensitivity and running time, as the ARMA-EGARCH model is significantly faster than these baselines.

Furthermore, these measures demonstrate the model’s strength in detecting anomalies, while the MAD and OCSVM methods appeared the higher in precision, they are overly conservative, missing 50% to 75% of the actual threats as shown in their low Recall. In contract, the ARMA-EGARCH model achieved a perfect Recall and the highest F1-Score, indicating a superior balance between sensitivity and accuracy.

Based on these results and in spite of the fact that the baselines maintain high precision by only flagging extreme outliers, the hybrid ARMA-EGARCH model offers a more in-depth description of the data as it simultaneously models the conditional mean and conditional variance. More importantly, the hybrid model proves to be more sensitive in the structural anomaly detection process, with an ability to capture the structural deviations that are overlooked by non-temporal detectors. Thus, the hybrid model has not only the contribution of the accuracy of the prediction but also the ability to detect volatility changes.

The model was able to detect finer grained of structural transitions and connectivity patterns that define network evolution by converting raw network traffic into graph density time series, which considered an aggregate measure of the nodes’ degree. The use of the hybrid ARMA-EGARCH model is not only a preference but also a statistical necessity due to non-linear characteristics and asymmetric volatility shocks. This ability to model conditional variance made it possible to generate the dynamic statistical envelope that expands and contracts in response to real-time volatility. The results demonstrate that the ARMA-EGARCH provides a desirable trade-off between prediction rigor and detection efficiency, which makes it very appropriate in real-time monitoring and anomaly detection, and its high speed of execution in time processing compared to other methods. It is recommended that future studies should expand on these findings by including other structural graph measures, including centrality and clustering coefficients, to further enhance the prediction abilities in response to new and advanced cyber threats.