Research On Network Anomaly Detection Method With Knowledge Fusion

With the development of information technology,various information networks are becoming more and more common while often filled with all kinds of abnormal objects.They either appear as independent anomalous objects that are clearly different from others,or as an abnormal group composed of multiple anomalous objects colluding with each other.The goal of network anomaly detection is to find these abnormal objects hidden in the network.Traditional methods have poor performance due to the difficulty in capturing highly nonlinear relationships in the network,and deep learning-based methods have difficulty in modeling anomalies reliably due to ignoring the finiteness of the network’s own information.In the real world,in addition to the information of the network itself,the knowledge graph,as an extensive knowledge base,provides knowledge descriptions of objects in the network from a different perspective from the network,and provides an important basis for identifying and capturing abnormal patterns.In order to utilize these information effectively,this paper fuses the knowledge from the knowledge graph in network anomaly detection to enhance the reliability and stability of the model.The main research contents of this paper are as follows:(1)A multi-view outlier detection with knowledge fusion model(MOD-KF)is proposed to address the problems of limited prior information of anomalies,and difficulty in making reliable descriptions of anomalies by relying on network data alone.Firstly,a twin network is constructed based on the knowledge representation of the corresponding domain knowledge graph of the input network.Then the input network and the twin network are modeled in the way of multi-view learning,and the node representations of different views are aggregated and unified by an aggregator.Finally,the abnormal degree is evaluated from the perspective of feature reconstruction error and structural reconstruction error of nodes.In experiments such as comparison experiment with baseline methods with different characteristics,ablation experiment and other experiments on 3 real network datasets,the model obtains higher AUC scores and Precision@K and Recall@K values in most cases,which significantly improves the identification for abnormal nodes.(2)In order to solve the problems of camouflaging behavior of the abnormal group and missing or unavailable node attribute information in the network,a network abnormal group detection with knowledge fusion model(AGD-KF)is designed.The model first extracts the topological semantic knowledge of the source nodes based on the item knowledge graph and the items interacted by the source node objects.Next,the topological structure information of the source nodes is combined to learn their representations in the latent space,and the similarity information of the source nodes is used to guide the optimization of the model so that the nodes in the abnormal group are embedded close to each other.Finally,the abnormal group in the network is identified based on the distribution of nodes combined with clustering method.The model obtains high F1 scores in the abnormal group detection experiments with different densities and numbers and ablation experiment on 3 real datasets,indicating that the model achieves better performance in capturing the anomalous characteristics of the abnormal group by fusing semantic knowledge.