Research On Dynamic Network Anomaly Detection Technology Based On Network Representation Learning

Dynamic network refers to the network that changes with time.Such as social networks,communication networks,and topological networks are common dynamic networks,which widely exist in real life.The characteristic of dynamic network is that its structure will change with the evolution of network,there changes may exist abnormal changes.Dynamic network anomaly detection can help us to detect network anomalies in time and prevent further losses.In this paper,dynamic network is taken as the research object,and network representation learning is the main way to detect anomalies in dynamic network and locate anomalous vertices.The main work of this paper is as follows:(1)Aiming at the problem that the existing graph representation learning methods are not strong enough to learn the original graph structure,a graph representation learning method based on N-edge subgraph mining is proposed in combination with the related technology of frequent subgraph mining.Firstly,N-edge subgraphs are extracted from each graph in the graph dataset,and the subgraphs are uniquely identified by DFSCode coding.Then,the corresponding N-edge subgraphs of each graph are input into the doc2 vec model to obtain the vector representation of each graph.Experiments on real datasets show that our method improves the classification accuracy by almost 5% on most datasets by using machine learning methods to classify the vector representations of the learned graphs.(2)Considering the advantages of network representation learning in capturing network structure,a dynamic network anomaly event detection method based on network representation learning is proposed.This method consists of two parts.The first part is dynamic network representation learning based on node based egonet,and the second part is dynamic network anomaly detection strategy.This method combines the popular neural network document vector representation model,generates the network sequence after the dynamic network is sliced by time,synthesizes the vector representation of learning nodes and networks based on the neighborhood characteristics of nodes,and measures the network recognition based on the corresponding vector representation of each time slice network.After identifying the anomalous events,the anomalous vertices under the anomalous events are located by the similarity measure of the nodes.Experiments are carried out on Enron email dataset and AS-level Internet network datasets.The experimental results demonstrate the effectiveness of the proposed method.(3)In view of the fact that the existing network representation learning methods can not effectively identify weighted anomalies in anomaly-link detection task,we propose a network representation learning method for weighted dynamic networks.This method regards weights as special nodes and uses deep Auto-encoding neural network to obtain the vector representations of nodes.This method can learn network structure information and edge weight information at the same time.Compared with traditional network representation learning method,the accuracy of anomaly-link detection is improved by about 10%.(4)In view of the fact that Anomalous events spread in a varity of modes and durations when spread or propagate over the network,it cannot be captured by a single subgraph.We combine anomalous links with the original dynamic network anomaly detection method based on Hopefield neural network,which overcomes the shortcomings of the original method that can not detect the structural anomaly of vertices,and extend the application scope of the original method.Finally,the experimental verification on the real datasets proves the wide applicability of the method,which can not only effectively identify the sudden increase of nodes traffic,but also effectively identify the link structure change anomalies.