Abstract:The task of identifying anomalous users on attributed social networks requires the detection of users whose profile attributes and network structure significantly differ from those of the majority of the reference profiles. GNN-based models are well-suited for addressing the challenge of integrating network structure and node attributes into the learning process because they can efficiently incorporate demographic data, activity patterns, and other relevant information. Aggregate operations, such as sum or mean pooling, are utilized by Graph Neural Networks (GNNs) to combine the representations of neighboring nodes within a graph. However, these aggregate operations can cause problems in detecting anomalous nodes. There are two main issues to consider when utilizing aggregate operations in GNNs. Firstly, the presence of anomalous neighboring nodes may affect the representation of normal nodes, leading to false positives. Secondly, anomalous nodes may be overlooked as their representation is flattened during the aggregate operation, leading to false negatives. The proposed approach, AnomEn, is a robust graph neural network developed for anomaly detection. It addresses the challenges of false positives and false negatives using a weighted aggregate mechanism. This mechanism is designed to differentiate between a node's own features and the features of its neighbors by placing greater emphasis on a node's own features and less emphasis on its neighbors' features. The system can preserve the node's original characteristics, whether the node is normal or anomalous. This work proposes not only a robust graph neural network, namely, AnomEn, but also specific anomaly detection structures for nodes and edges. The proposed AnomEn method serves as the encoder in the node and edge anomaly detection architectures and was tested on multiple datasets. Experiments were conducted to validate the effectiveness of the proposed method as a graph neural network encoder. The findings demonstrated the robustness of the proposed method in detecting anomalies. The proposed method outperforms other existing methods in node anomaly detection tasks by 5.63% and edge anomaly detection tasks by 7.87%.

Relative Frequency-Rank Encoding for Unsupervised Network Anomaly Detection

Feature Encoding with AutoEncoders for Weakly-supervised Anomaly Detection

ENCODE: Encoding NetFlows for Network Anomaly Detection

A Hierarchically Feature Reconstructed Autoencoder for Unsupervised Anomaly Detection

Characterizing Network Anomaly Traffic with Euclidean Distance-Based Multiscale Fuzzy Entropy.

Unsupervised Anomaly Detection Based on Deep Autoencoding and Clustering

Clustering-Based Deep Autoencoders for Network Anomaly Detection

Autoencoder-based Unsupervised Intrusion Detection using Multi-Scale Convolutional Recurrent Networks

GNN-based Anomaly Detection for Encoded Network Traffic

Practical autoencoder based anomaly detection by using vector reconstruction error

A network anomaly detection algorithm based on semi-supervised learning and adaptive multiclass balancing

Anomaly detection system for network transport with machine learning approach

An informative dual ForkNet for video anomaly detection

Two-stream Decoder Feature Normality Estimating Network for Industrial Anomaly Detection

A Novel Self-Supervised Learning-Based Anomalous Node Detection Method Based on an Autoencoder for Wireless Sensor Networks

Omni-frequency Channel-selection Representations for Unsupervised Anomaly Detection

Unsupervised Network Traffic Anomaly Detection Method Based on Attribute Graph in Power Internet of Things

DUdetector: A Dual-Granularity Unsupervised Model for Network Anomaly Detection

Robust Graph Neural-Network-Based Encoder for Node and Edge Deep Anomaly Detection on Attributed Networks

Unsupervised Anomaly Detection by Autoencoder with Feature Decomposition.

Recurrent auto-encoder with multi-resolution ensemble and predictive coding for multivariate time-series anomaly detection