Anomaly Detection using Graph Neural Networks

Chaudhary, Anshika; Mittal, Himangi; Arora, Anuja

doi:10.1109/comitcon.2019.8862186

Cited by 75 publications

(22 citation statements)

References 18 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Another dynamic graph anomaly detection system was proposed in [19], using deep auto-encoders in combination with clustering techniques on the network's nodes to detect anomalies in real time. In [20], another approach, that used a Graph Neural Network (GNN) to detect anomalies was proposed. The interconnections of the relevant nodes, as well as numerous topological properties of the graph, were taken into account in the computed adjacency matrix in this study.…”

Section: Previous Work In Anomaly Detection Techniquesmentioning

confidence: 99%

Time Series Network Data Enabling Distributed Intelligence—A Holistic IoT Security Platform Solution

et al. 2022

View full text Add to dashboard Cite

The Internet of Things (IoT) encompasses multiple fast-emerging technologies controlling and connecting millions of new devices every day in several application domains. The increased number of interconnected IoT devices, their limited computational power, and the evolving sophistication of cyber security threats, results in increased security challenges for the IoT ecosystem. The diversity of IoT devices, and the variety of QoS requirements among several domains of IoT application, impose considerable challenges in designing and implementing a robust IoT security solution. The aim of this paper is to present an efficient, robust, and easy-to-use system, for IoT cyber security operators. Following a by-design security approach, the proposed system is a platform comprising four distinct yet cooperating components; a distributed AI-enhanced detection of potential threats and anomalies mechanisms, an AI-based generation of effective mitigation strategies according to the severity of detected threats, a system for the verification of SDN routing decisions along with network- and resource-related policies, and a comprehensive and intuitive security status visualization and analysis. The distributed anomaly detection scheme implementing multiple AI-powered agents is deployed across the IoT network nodes aiming to efficiently monitor the entire network infrastructure. Network traffic data are fed to the AI agents, which process consecutive traffic samples from the network in a time series analysis manner, where consecutive time windows framing the traffic of the surrounding nodes are processed by a graph neural network algorithm. Any detected anomalies are handled by a mitigation engine employing a distributed neural network algorithm, which exploits the recorded anomalous events and deploys appropriate responses for optimal threat mitigation. The implemented platform also includes the hypothesis testing module, and a multi-objective optimization tool for the quick verification of routing decisions. The system incorporates visualization and analytics functionality and a customizable user interface.

show abstract

Section: Previous Work In Anomaly Detection Techniquesmentioning

confidence: 99%

Time Series Network Data Enabling Distributed Intelligence—A Holistic IoT Security Platform Solution

et al. 2022

View full text Add to dashboard Cite

show abstract

“…The deep learning algorithms have been used also in other IoT environments, such as in-vehicle IoT (Kang and Kang, 2016) or IoT at home (Brun et al , 2018). Most recently, the graph neural networks (GNN) are used for anomaly detection (Zheng et al , 2019; Chaudhary et al (2019), Protogerou et al (2020). For instance, Zheng et al (2019) proposed to use an attention-based temporal graph convolutional neural network (Kipf and Welling, 2016) to detect the anomalous edges.…”

Section: Related Workmentioning

confidence: 99%

Improving the performance of the intrusion detection systems by the machine learning explainability

Dang

2021

IJWIS

View full text Add to dashboard Cite

Purpose This study aims to explain the state-of-the-art machine learning models that are used in the intrusion detection problem for human-being understandable and study the relationship between the explainability and the performance of the models. Design/methodology/approach The authors study a recent intrusion data set collected from real-world scenarios and use state-of-the-art machine learning algorithms to detect the intrusion. The authors apply several novel techniques to explain the models, then evaluate manually the explanation. The authors then compare the performance of model post- and prior-explainability-based feature selection. Findings The authors confirm our hypothesis above and claim that by forcing the explainability, the model becomes more robust, requires less computational power but achieves a better predictive performance. Originality/value The authors draw our conclusions based on their own research and experimental works.

show abstract

“…Recursive quantitative analysis was used to explore the hidden dynamics and temporal correlation of statistical time series. A Chaudhary et al [7] used the ability to deeply learn the topological features of social networks to detect anomalies in email networks and Twitter networks, and proposed a model neural network model and applied it to social contact graphs. Considering the combination of various social network statistical measures, the structure and function of the abnormal nodes are studied by using deep neural networks on them, which found that the hidden layer of the neural network plays an important role in discovering the impact of statistical metric combinations in anomaly detection.…”

Section: Related Workmentioning

confidence: 99%

A Resource Consumption Attack Identification Method Based on Data Fusion

Jiao¹,

Huo²,

et al. 2021

Lecture Notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering

View full text Add to dashboard Cite

Data fusion can make use of information from different sources or different representations to describe the target more accurately, which has important research significance. Aiming at the network-running node may be attacked or there is measurement error, this paper comprehensively utilizes the information of each node, and proposes a resource consumption attack identification method based on node multi-dimensional data fusion. First, construct a correlation matrix between nodes, identify normal nodes and possible abnormal nodes, and assign different weights to each node. Then, calculating the support of the node's system attributes for the attack type, and adopting the D-S evidence theory to effectively identify the network attack. The simulations demonstrate the effectiveness and certain advantages of the proposed algorithm.

show abstract

Anomaly Detection using Graph Neural Networks

Cited by 75 publications

References 18 publications

Time Series Network Data Enabling Distributed Intelligence—A Holistic IoT Security Platform Solution

Time Series Network Data Enabling Distributed Intelligence—A Holistic IoT Security Platform Solution

Improving the performance of the intrusion detection systems by the machine learning explainability

A Resource Consumption Attack Identification Method Based on Data Fusion

Contact Info

Product

Resources

About