Temporal Patterns Discovery of Evolving Graphs for
Graph Neural Network (GNN)-based Anomaly Detection in Heterogeneous Networks

Jongmo Kim1, Kunyoung Kimv, Gi-yoon Jeon2, and Mye Sohn1,+

 

1Department of Industrial Engineering, Sungkyunkwan University, Suwon, South Korea
{dignity, kimkun0, myesohn}@skku.edu


2R&D Institute, Agency for Defense Development, Seoul, South Korea 

gyjeon@add.re.kr

 

Abstract

This paper proposes a new method named evolving-graph generation framework to simultaneously solve the complexity and dynamic nature of the attribute networks that can occur in graph-based anomaly detection with Graph Neural Networks (GNN). The proposed framework consists of two components. The first component is a feature selection method that hybridizes filter-based and wrapper-based techniques to reduce the snapshots. The second component is an association method based on temporal patterns for the snapshots using the subgraph embedding technique and gaussian-base KL divergence. At the time, the association method finds intra-snapshots and inter-snapshots associations. As a result, we can obtain an evolving graph that is simplified and temporal patterns-enhanced from original networks. It is used an input graph for a GNN-based anomaly detection model. To show the superiority of the proposed framework, we conduct experiments and evaluations on 8 real-world datasets with anomaly labels with comparative state-of-the-art models of graph-based anomaly detection. We show that the proposed framework outperforms state-of-the-art methods in the accuracy and stability of training with the trend of decreasing train loss.

Keywords: Graph-based Anomaly Detection, Evolving Graphs, GNN, Attributed Networks,
Heterogeneous Networks

 

+: Corresponding authors: Mye Sohn
Department of Industrial Engineering, Sungkyunkwan University,
300 Cheoncheon-dong, Jangan-Gu, Suwon, South Korea, Tel: +82-(0)31-290-7605, Fax: +82-(0)31-290-7610

 

Journal of Internet Services and Information Security (JISIS), 12(1): 72-82, February 2022
Received: July 31, 2021; Accepted: December 29, 2021; Published: February 28, 2022

DOI: 10.22667/JISIS.2022.02.28.072 [pdf]