An anomaly detection framework for time-evolving attributed networks

Xue, Luguo; Chen, Yan; Luo, Minnan; Peng, Zhen; Liu, Jun

doi:10.1016/j.neucom.2020.04.047

Cited by 18 publications

(7 citation statements)

References 11 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…To take advantage of both graph structure features and sequential structure features, the dynamic graph sequence (also known as dynamic evolving graph sequence or time-evolving graphs) is used in anomaly detection scenarios, such as anomalous nodes detection 17 and anomalous edge detection. 18,19 But, above methods cannot capture sufficient features for more accurate results.…”

Section: Program Execution Behavioral Feature-based Malware Classific...mentioning

confidence: 99%

“…To the best of our knowledge, the existing techniques can solve a part of the aforementioned problems, respectively. For instance, the method proposed in 17 leveraged a small smooth disturbance between two consecutive time slots to characterize the evolution and detect the anomalous nodes. The method developed in [18] extended the Gate Recurrent Unit (GRU) with a contextual attention‐based model to detect anomalous edges by capturing temporal evolution information.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Malware detection with dynamic evolving graph convolutional networks

Zhang

Wang

et al. 2022

Int J of Intelligent Sys

View full text Add to dashboard Cite

Malware detection is a vital task for cybersecurity. For malware dynamic behavior, threats come from a small number of Application Programming Interfaces (APIs) embedded in the API sequences, which are easily ignored or obfuscated in the detection process.Prior works proposed graph-based learning methods to solve this problem using API-level behavior relations.However, the malware detection is still challenging, due to the ignore of the temporal correlation between malicious behaviors. In this study, we model the software behaviors with multiscaled API graph sequences to represent API-level behaviors as well as graph-level temporal behavior correlations. We then propose a novel Dynamic Evolving Graph Convolutional Network (DEGCN) model to capture dynamic evolving pattern of both local API-level and global graph-level software behaviors. In particular, we first extract the API-level (node) representations to capture the directed graph representations for each time slot. We then propose a Graph-encoding-based Gate Recurrent Unit (GGRU) network to capture the graph-level evolving features and their evolving status. The graph features of different time slots and different graph scales are concatenated to detect whether the software is benign or malicious. Our evaluation with two public

show abstract

Section: Program Execution Behavioral Feature-based Malware Classific...mentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Malware detection with dynamic evolving graph convolutional networks

Zhang

Wang

et al. 2022

Int J of Intelligent Sys

View full text Add to dashboard Cite

show abstract

“…Many anomaly detection methods fail to deal with timeevolved attribute networks because they consider all the attributes and snapshots equally without regard to the noise. LuguoXue et al 2020 [140] proposed a dynamic anomaly detection network on time-evolving attributed networks based on matrix decomposition and residual analysis. This method uses small smooth disturbances between consecutive time stamps to depict the evolution of networks.…”

Section: ) Anomalous Vertex Detectionmentioning

confidence: 99%

Recent Progress on Anomaly Detection in Social Networks using Graph Neural Networks

Daniel¹

2022

Preprint

View full text Add to dashboard Cite

show abstract

“…All mainstream methods for anomaly detection assume that the samples are distributed uniformly and independently. However, in several real situations, cases are frequently linked to one another, forming a complicated network [3]. In the past few years, the topic of attributed anomaly detection in complicated networks has grown in popularity as a research topic.…”

Section: Introductionmentioning

confidence: 99%

DVAEGMM: Dual Variational Autoencoder With Gaussian Mixture Model for Anomaly Detection on Attributed Networks

et al. 2022

View full text Add to dashboard Cite

A significant aspect of today's digital information is attributed networks, which combine multiple node attributes with the basic network topology in order to extract knowledge. Anomaly Detection on attributed networks has recently drawn significant attention from researchers and is widely used in a number of high-impact areas. The majority of current approaches focus on shallow learning methods such as community analysis, ego network or selection of subspace method. These approaches have network sparsity and data nonlinearity problems, and they do not even capture the intricate relationships between various information sources. Deep learning approaches like graph autoencoders are utilized to perform anomaly detection through obtaining node embeddings while dealing with the network nonlinearity and sparsity issues. However, they suffer from the problem of ignoring the latent codes' embedding distribution, which results in poor representation in many instances. In this paper, we propose a new framework called DVAEGMM to detect anomalies on attributed networks. First, our framework utilizes a dual variational autoencoder for capturing the complex cross-modality relationships between node attributes and network structure, similar to vanilla autoencoders, but it also considers the potential data distribution and makes use of a generative adversarial network (GAN) for an adversarial regularization approach. An adversarial mechanism makes the encoder make more accurate estimates of how potential features might be distributed. As a result, decoders can make graphs that are more like the original graph. Each input data point is represented by a low-dimensional representation and a probability of reconstruction by the algorithm. Lastly, the Gaussian Mixture Model, a distinct estimation network, is used to approximate the latent vector density, resulting in the detection of anomalies from measuring sample energy. They are trained jointly as an end-to-end framework. DVAEGMM helps in the simultaneous optimization of the mixture model, generative adversarial network, and variational autoencoder parameters. The joint optimization balances the reconstruction probability, the latent representation density approximation, and regularization. Extensive experiments on attributed networks prove that DVAEGMM significantly beats the existing methods, proving the efficiency of the presented approach. The AUC scores of our proposed framework for the BlogCatalog, Flickr, Enron, and Amazon datasets are 0.89380, 0.87130, 0.72480, and 0.75102, respectively.

show abstract

An anomaly detection framework for time-evolving attributed networks

Cited by 18 publications

References 11 publications

Malware detection with dynamic evolving graph convolutional networks

Malware detection with dynamic evolving graph convolutional networks

Recent Progress on Anomaly Detection in Social Networks using Graph Neural Networks

DVAEGMM: Dual Variational Autoencoder With Gaussian Mixture Model for Anomaly Detection on Attributed Networks

Contact Info

Product

Resources

About