Global Context Enhanced Anomaly Detection of Cyber Attacks via Decoupled Graph Neural Networks

Ahmad Hafez

2024-09-05

Abstract:Recently, there has been a substantial amount of interest in GNN-based anomaly detection. Existing efforts have focused on simultaneously mastering the node representations and the classifier necessary for identifying abnormalities with relatively shallow models to create an embedding. Therefore, the existing state-of-the-art models are incapable of capturing nonlinear network information and producing suboptimal outcomes. In this thesis, we deploy decoupled GNNs to overcome this issue. Specifically, we decouple the essential node representations and classifier for detecting anomalies. In addition, for node representation learning, we develop a GNN architecture with two modules for aggregating node feature information to produce the final node embedding. Finally, we conduct empirical experiments to verify the effectiveness of our proposed approach. The findings demonstrate that decoupled training along with the global context enhanced representation of the nodes is superior to the state-of-the-art models in terms of AUC and introduces a novel way of capturing the node information.

Cryptography and Security,Machine Learning

What problem does this paper attempt to address?

### What problem does this paper attempt to solve?

The main goal of this paper is to improve the performance of anomaly detection in network attacks by decoupling Graph Neural Networks (GNNs). Specifically, the paper attempts to address the following issues:

1. **Limitations of existing models**:
- Existing GNN-based anomaly detection methods typically use relatively shallow models for node representation and classification, which prevents them from capturing non-linear network information, resulting in suboptimal outcomes.

2. **Lack of labeled data**:
- Most available datasets are unlabeled, and existing research largely relies on unsupervised anomaly detection methods, which are less reliable on imbalanced datasets compared to supervised learning methods.

3. **Imbalanced datasets**:
- Datasets are highly imbalanced, with the number of normal data points far exceeding the number of anomalous data points, making it difficult for traditional unsupervised methods to accurately identify anomalous behavior.

### Solution proposed by the paper

To overcome the above issues, the authors propose a decoupled GNN approach, which includes the following key points:

1. **Decoupling representation learning and classification**:
- Separating node representation learning from the classification task allows for better capture of node features and improved classification accuracy.

2. **Combination of multiple encoders**:
- Using multiple GNN encoders and averaging their outputs to obtain richer node representations.

3. **Experimental validation**:
- Conducting empirical studies on 5 different datasets, including Wiki, Reddit, Bitcoin Alpha, Amazon, and CIC-IDS2017, showing that the decoupled training method outperforms existing methods in terms of the AUC metric.

Through these improvements, the paper aims to provide a more effective and reliable method for anomaly detection in network attacks.