Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Global Context Enhanced Anomaly Detection of Cyber Attacks via Decoupled Graph Neural Networks

Ahmad Hafez

TL;DR

The findings demonstrate that decoupled training along with the global context enhanced representation of the nodes is superior to the state-of-the-art models in terms of AUC and introduces a novel way of capturing the node information.

Abstract

Recently, there has been a substantial amount of interest in GNN-based anomaly detection. Existing efforts have focused on simultaneously mastering the node representations and the classifier necessary for identifying abnormalities with relatively shallow models to create an embedding. Therefore, the existing state-of-the-art models are incapable of capturing nonlinear network information and producing suboptimal outcomes. In this thesis, we deploy decoupled GNNs to overcome this issue. Specifically, we decouple the essential node representations and classifier for detecting anomalies. In addition, for node representation learning, we develop a GNN architecture with two modules for aggregating node feature information to produce the final node embedding. Finally, we conduct empirical experiments to verify the effectiveness of our proposed approach. The findings demonstrate that decoupled training along with the global context enhanced representation of the nodes is superior to the state-of-the-art models in terms of AUC and introduces a novel way of capturing the node information.

Global Context Enhanced Anomaly Detection of Cyber Attacks via Decoupled Graph Neural Networks

TL;DR

The findings demonstrate that decoupled training along with the global context enhanced representation of the nodes is superior to the state-of-the-art models in terms of AUC and introduces a novel way of capturing the node information.

Abstract

Recently, there has been a substantial amount of interest in GNN-based anomaly detection. Existing efforts have focused on simultaneously mastering the node representations and the classifier necessary for identifying abnormalities with relatively shallow models to create an embedding. Therefore, the existing state-of-the-art models are incapable of capturing nonlinear network information and producing suboptimal outcomes. In this thesis, we deploy decoupled GNNs to overcome this issue. Specifically, we decouple the essential node representations and classifier for detecting anomalies. In addition, for node representation learning, we develop a GNN architecture with two modules for aggregating node feature information to produce the final node embedding. Finally, we conduct empirical experiments to verify the effectiveness of our proposed approach. The findings demonstrate that decoupled training along with the global context enhanced representation of the nodes is superior to the state-of-the-art models in terms of AUC and introduces a novel way of capturing the node information.
Paper Structure (106 sections, 30 equations, 13 figures, 4 tables)

This paper contains 106 sections, 30 equations, 13 figures, 4 tables.

Table of Contents

  1. Introduction
  2. Motivation
  3. Problem Statement
  4. Research Procedure
  5. Contributions
  6. Outline
  7. Theory
  8. Machine Learning
  9. Supervised Learning
  10. Classification
  11. Regression
  12. Unsupervised Learning
  13. Reinforcement Learning
  14. Semi-supervised Learning
  15. Deep Learning
  16. ...and 91 more sections

Figures (13)

  • Figure 2: Nonlinear model of a neuron k.
  • Figure 3: Basic CNN architecture to recognise a hand-written decimal number
  • Figure 4: A pipeline for a GNN model
  • Figure 5: A ConvGNN for node classification.
  • Figure 6: A ConvGNN for graph classification.
  • ...and 8 more figures

Theorems & Definitions (12)

  • Definition 1
  • Definition 2
  • Definition 3
  • Definition 4
  • Definition 5
  • Definition 6
  • Definition 7
  • Definition 8
  • Definition 9
  • Definition 10
  • ...and 2 more