Anomaly Detection In Sequential Networks Using Graph Neural Networks

Anomaly detection in sequential networks is widely used in various fields,such as medicine,network security,and social networks.Anomaly detection in sequential networks aims to detect nodes or edges that significantly deviate from most "normal" patterns in the network or do not conform to the expected behavior at a certain time in sequential networks,which can find potential unsafe factors or interesting phenomena.This article focuses the research on two aspects: anomalous user behavior and anomalous user interaction.For anomalous user behavior,existing work ignores the features of the behavior and cannot effectively capture the structure and temporal features of sequential networks.Considering these two shortcomings,a behavior sequential network based locally anomalous change detection problem is proposed.In terms of user anomalous interaction,existing work cannot be aware of the negative effects of anomalous data and noisy data,so interaction sequential network based anomalous edge detection algorithm is proposed.The main contributions are as follows:(1)This paper researches anomaly detection in sequential networks on two aspects:anomalous user behavior and user interaction,and proposes behavior sequential network based locally anomalous change detection problem and interaction sequential network based anomalous edge detection problem.For the data features and anomalous pattern features of the two problems,corresponding sequential network anomaly detection algorithms LOCATE(Behavior Sequential Network based Locally Anomalous Change Detection)and SONDE(Interaction Sequential Network based Anomalous Edge Detection)are designed respectively.(2)In the behavior sequential network based locally anomalous change detection algorithm LOCATE,to effectively model behavior features,a novel structure,behavior sequential network constructed from behavior data,is proposed.It systematically presents users,their behaviors evolving over time,and the connections caused by their behaviors.Considering the features of behavior sequential networks,a graph neural network autoencoder framework is designed to learn user latent low-dimensional representations.Based on user lowdimensional representations,the locally anomalous score function is proposed,which detects locally anomalous changes in sequential networks through k-nearest neighbor-based method.By carrying out experiments on real data sets,the effectiveness of the LOCATE algorithm is verified.(3)In the interaction sequential network based anomalous edge detection based on algorithm SONDE,in order to solve the problem that anomalous edges cannot be identified since anomalous edges will have a negative impact on feature extraction when detecting target edges,this paper proposes a novel attention mechanism,which alleviates the information propagation between users whose features are completely unrelated.Besides,considering the noise in data,this paper calculates the incidence weight matrix and sample neighbors to reduce the occurrence frequency of noisy data and enhance the robustness of the SONDE.Finally,through two real data sets,this paper conducts detailed experiments to verify the effectiveness and stability of the SONDE algorithm.