Network Anomaly Detection Based On Graph Representation Learning

With the vigorous development of information technology,various applications data of communication network,multimedia network,social network,Internet of things network and cloud computing network contain rich information.To better utilize complex graph data,highly abstracting multidimensional data into a graph form can help extract information from networks.Graph representation learning transforms dynamical graph data into a lowdimensional,dense,vectorized representation that can make graph data mining easy to serve subsequent clustering,link prediction,topology capture,dynamic traffic monitoring and sensitive data discovery.However,due to the presence of noise interference in graph data,it is inevitably plagued by anomalous data when learning about graphical representation,which may lead to privacy leakage.It is worthwhile to study how to protect information security while overcoming the challenges brought by the massive growth and complexity of graph data.Mining the relationships between different types of graph data counts a great deal.Deep learning has become a significant tool for graph representation learning because it has the advantages of efficient modeling and flexible structure for graph data features deep mining.Extracting potentially useful information from the data will become more efficient while the internal and interactive characteristics of the graph network are fine-grained processed.This makes graph representation learning more capable of obtaining fused implicit representations and complex mapping mechanisms,discovering hidden anomaly details.It is therefore widely used in anomaly detection.In view of the challenges faced by the static analysis method of graph representation learning nodes,poor topology association mining,the imbalance of data distribution,this dissertation accurately describes the anomaly by extracting the node similarity and exploring the connection structure association of the graph to accurately depict the anomaly in fine granularity.This dissertation uses the diversified personalized interaction in the graph to learn high-quality graph representation to realize anomaly detection.It conducts in-depth analysis of complex changes to adapt to the diversity of abnormal environments.This dissertation focuses on the core tasks of anomaly detection,such as abnormal user early warning,abnormal path analysis,abnormal behavior characterization and abnormal mode exploration,by designing feature learning and neural network algorithms optimized on specific indicators.The main research work and related achievements of this dissertation include:Aiming at the problem that the graph representation learning embedding only captures the local similarity of nodes,which weakens the richness of node similarity.It makes the graph characteristics difficult to fully participate in the subsequent calculation.So,this dissertation proposes a user node anomaly detection algorithm based on feature integration and adversarial training.This method uses graph coding to encode corresponding types of node features and studies explicit and implicit preferences reflected by abnormal user characteristics.In the meantime,this method selects key features to reduce the dimensions of the data while enhancing interpretability.This method uses ensemble integrated learning to explore the influence of multiple factors.It overcomes the problems caused by the heterogeneity and complexity of data and model more comprehensive node similarity.Using adversarial training for deep learning architecture becomes more robust to different input disturbances.Experiments on datasets show that the proposed method achieves in-depth mining of interactions between nodes and can effectively capture the diversity distribution of the data in the graph below under different node relationship modes.Moreover,the antiinterference performance is greatly improved and the modeling of node similarity is more comprehensive.In order to effectively use the properties and labels of the local neighborhood of the edge and the edge association,better figure out the complex and rich topological association in the network,this dissertation propose the edge anomaly detection using relational content joint embedding graph neural networks.This method extracts structured representations from unstructured data and generates dynamic and structured edge maps.This method performs correlation edge discovery and representation aggregation at different levels of content and connectivity,effectively characterizing the interdependencies between edges.Through multiple rounds of training of an improved long-term and long-term memory graph network model,this method achieves the effect of obtaining long-term trend information,alternately decomposing and refining the results during the anomaly detection process.The experimental results of a large number show this method can flexibly interact with the scene environment and achieve high-quality graph representation.Capturing key interactive information in different types of graph data through a long and short term memory graph network for highly accurate edge anomaly detection improves the collaborative learning high-quality graph ability.For the sake of integrating diversified personalized anomaly patterns in different levels and quantify the nonlinear characteristics of graph neural network,this dissertation designs a graph wavelet neural network for context anomaly detection.In this method,considering the accurate environmental characteristics and the accurate influence of context on the prediction results,the historical context attention mechanism is introduced to give finegrained historical context level evaluation,so as to alleviate the over smoothing phenomenon.This method uses graph wavelet neural networks for efficient nonlinear characterization to solve the problem of high computational complexity of high-dimensional data.A large number of results show that the proposed methods can better find potential and useful contexts from a large amount of complex data.This method utilizes graph wavelet neural networks to accurately grasp the impact of network adjacency and periodic characteristics,which realizes the early warning of network anomalies.Due to the high complexity of spatiotemporal graph and real-time interaction in dynamic environment,this dissertation proposes an interactive event anomaly detection based on graph spatiotemporal networks.The data availability is improved by aggregating the node representation of spatiotemporal graph.In this method,the attention structure of spatial graphs extracts spatial topological features.The temporal self-attention mechanism is developed to capture the multi-level temporal relationship.Subsequently,it combines complex data into a spatiotemporal center interaction graph.The spatiotemporal central interaction graph is mined by using the spatiotemporal interactive attention network to obtain the highly complex spatiotemporal dependence among multiple factors.Furthermore,considering that the anomaly detection strategy is a complex function that cannot be expressed by simple rules,a relational aggregation network is proposed to allocate appropriate weights to measure and then a learning sorting network is used to obtain the anomaly detection results.Experiments on network datasets demonstrate that this method models personalized attributes in complex topological structures and time points,considering the spatiotemporal interaction of its own attributes and environmental attributes.The main innovative work of this dissertation is that graph representation can discover significant differences in feature preference patterns between normal and abnormal network data in the face of the large volume,variety,and dynamic characteristics of network data.In addition,in view of the large number of uncertain associations and interaction factors in complex networks that can evolve with information dissemination,graph representation learning can capture the dependencies between nonlinear feature preferences,allowing networks to learn to higher levels of representation using more sparse representations.Moreover,in the face of the need for dynamic modeling,graph neural networks apply appropriate models to capture accurate,fine-grained information for anomaly detection.It not only ensures the accuracy of anomaly detection,but also enhances the differentiation of different types of anomalies and interpretability.