Walk Carefully: Hyperparameter Sensitivity of Node2Vec for Security Event Graph Clustering

Abstract

Graph embeddings offer a principled way to discover coordinated attack patterns in security telemetry, but their hyperparameters are typically inherited from social-network benchmarks without validation. We conduct a systematic sensitivity analysis of Node2Vec on a heterogeneous security event graph derived from production AWS cloud telemetry (237 entities, 500+ relationships), varying six hyperparameters across 81 experimental configurations. Our central finding: the number of random walks dominates all other parameters (composite importance 1.00) through a non-monotonic relationship: clustering quality peaks sharply at r=100 (silhouette ≈0.56) then degrades to 0.27 at r=300. We attribute this to over-smoothing: in sparse, heterogeneous graphs, excessive walks cause node representations to collapse toward a mean, destroying the discriminative structure that separates attack phases. By contrast, the biased-walk parameters p and q, which receive the most practitioner attention, rank last in importance. Four recovered clusters map cleanly to MITRE ATT&CK kill chain phases. These results challenge the "more sampling is better" assumption and provide actionable, empirically-grounded configuration guidance for practitioners deploying graph-based threat detection on investigation-scale security graphs.