Pikachu: Temporal Walk Based Dynamic Graph Embedding for Network Anomaly Detection

Paudel, Ramesh; Huang, H. Howie

doi:10.1109/noms54207.2022.9789921

Cited by 12 publications

(4 citation statements)

References 30 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…It labels a query as abnormal if it is not predicted well. PIKACHU [4] extracts temporal random walks from historical interactions to train an encoder for link prediction. It labels a query as abnormal if it is not predicted well.…”

Section: Related Workmentioning

confidence: 99%

“…The essential differences between the existing algorithms are: (i) the types of queries they accept; (ii) the definition given to the notion of anomaly; and (iii) how the context is exploited. For example, numerous algorithms accept time-stamped edges as queries, yet they differ in the criterion used to label a query as abnormal: some do it when the query implies a sudden change in edge counts [1], node embeddings [2], or walk statistics [3], while others do it when the query cannot be well predicted from the past [4,5]. Algorithms addressing coarser resolution A group of servers usually exchange between them and with some external users.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

MAD: Multi-Scale Anomaly Detection in Link Streams

Bautista,

Brisson,

Bothorel

et al. 2024

Proceedings of the 17th ACM International Conference on Web Search and Data Mining

View full text Add to dashboard Cite

HAL is a multi-disciplinary open access archive for the deposit and dissemination of scientific research documents, whether they are published or not. The documents may come from teaching and research institutions in France or abroad, or from public or private research centers. L'archive ouverte pluridisciplinaire HAL, est destinée au dépôt et à la diffusion de documents scientifiques de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

show abstract

Section: Related Workmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

MAD: Multi-Scale Anomaly Detection in Link Streams

Bautista,

Brisson,

Bothorel

et al. 2024

Proceedings of the 17th ACM International Conference on Web Search and Data Mining

View full text Add to dashboard Cite

show abstract

“…Random walks have been successfully applied to a large range of domains such as recommender systems and computer vision [18]. Despite the current success of recent GNNs, random walks are still used in recent graph-based intrusion detection works [19], [20], [21], [22]. Indeed, these algorithms demonstrate strong capabilities at capturing graph information and node co-occurrence relations while using self-supervised embedding techniques, namely the graph structure and features are used as the label for the predictive task.…”

Section: B Random Walk-based Learningmentioning

confidence: 99%

“…Paudel et al [19] also leverage the temporal dimension of graphs for network-based anomaly detection. They propose PIKACHU, an unsupervised dynamic graph embedding technique that considers both the dynamic edges and nodes.…”

Section: ) Network Intrusion Detection With Authentication Graphsmentioning

confidence: 99%

Graph Neural Networks for Intrusion Detection: A Survey

Bilot

Madhoun

Agha³

et al. 2023

IEEE Access

View full text Add to dashboard Cite

Cyberattacks represent an ever-growing threat that has become a real priority for most organizations. Attackers use sophisticated attack scenarios to deceive defense systems in order to access private data or cause harm. Machine Learning (ML) and Deep Learning (DL) have demonstrate impressive results for detecting cyberattacks due to their ability to learn generalizable patterns from flat data. However, flat data fail to capture the structural behavior of attacks, which is essential for effective detection. Contrarily, graph structures provide a more robust and abstract view of a system that is difficult for attackers to evade. Recently, Graph Neural Networks (GNNs) have become successful in learning useful representations from the semantic provided by graph-structured data. Intrusions have been detected for years using graphs such as network flow graphs or provenance graphs, and learning representations from these structures can help models understand the structural patterns of attacks, in addition to traditional features. In this survey, we focus on the applications of graph representation learning to the detection of network-based and hostbased intrusions, with special attention to GNN methods. For both network and host levels, we present the graph data structures that can be leveraged and we comprehensively review the state-of-the-art papers along with the used datasets. Our analysis reveals that GNNs are particularly efficient in cybersecurity, since they can learn effective representations without requiring any external domain knowledge. We also evaluate the robustness of these techniques based on adversarial attacks. Finally, we discuss the strengths and weaknesses of GNN-based intrusion detection and identify future research directions.INDEX TERMS Cyberattacks, cybersecurity, deep learning (DL), graph neural networks (GNNs), intrusion detection (IDS), machine learning (ML).

show abstract