I noticed a possible issue in Chapter 16’s host–flow bipartite graph construction.
The code creates host node indices from unique source and destination IPs:
ip_map = {ip: index for index, ip in enumerate(np.unique(np.append(src_ip, dst_ip)))}
host_to_flow, flow_to_host = get_connections(ip_map, src_ip, dst_ip)So the host node IDs in edge_index correspond to unique IP addresses.
However, the host feature matrix is assigned directly from the subgraph dataframe rows:
batch['host'].x = torch.Tensor(subgraph[features_host].to_numpy()).float()
where:
features_host = [f'ipsrc_{i}' for i in range(1, 17)] + [f'ipdst_{i}' for i in range(1, 17)]This means batch['host'].x has one row per flow record, and each row contains:
source_ip_features || destination_ip_features
But the edge indices treat host rows as unique-IP nodes.
As a result, the graph can be valid tensor-wise, because the number of unique IPs is usually less than or equal to the number of flow rows, but the feature semantics may be misaligned:
edge_index host IDs: unique IP indices
batch['host'].x rows: flow-row endpoint-pair features
For example, host.x[3] may not actually contain the features for the unique IP mapped to host node 3; it may instead contain the source/destination IP features from dataframe row 3.
Would it be more consistent to build batch['host'].x with one row per unique IP in ip_map, e.g., by extracting features for each unique host individually, rather than assigning subgraph[features_host] directly?
Thanks again for the helpful notebook.
I noticed a possible issue in Chapter 16’s host–flow bipartite graph construction.
The code creates host node indices from unique source and destination IPs:
So the
hostnode IDs inedge_indexcorrespond to unique IP addresses.However, the host feature matrix is assigned directly from the subgraph dataframe rows:
where:
This means
batch['host'].xhas one row per flow record, and each row contains:But the edge indices treat host rows as unique-IP nodes.
As a result, the graph can be valid tensor-wise, because the number of unique IPs is usually less than or equal to the number of flow rows, but the feature semantics may be misaligned:
For example,
host.x[3]may not actually contain the features for the unique IP mapped to host node3; it may instead contain the source/destination IP features from dataframe row3.Would it be more consistent to build
batch['host'].xwith one row per unique IP inip_map, e.g., by extracting features for each unique host individually, rather than assigningsubgraph[features_host]directly?Thanks again for the helpful notebook.