关键词: 异常检测, 图挖掘, 时间序列, 长短时记忆（LSTM）

Abstract: Traditional anomaly detection method most is based on content features, with the increase of attack technology, this kind of method is easy to be circumvented. Therefore, graph mining technology has become a hot topic in academic research both at home and abroad. In order to improve the accuracy of anomaly detection, a dynamic graph anomaly detection algorithm based on long-short term memory network is proposed. First, by analyzing the change characteristics of dynamic graph, it extracts two kinds of characteristics of Egonet：graph structure distance and edit distance, which efficiently express the structural change of dynamic graph. Secondly, the model is trained by the time series classification algorithm based on LSTM. Finally, the captured network flow is used to detect intrusion, and test the dynamic graph topology of more than 60 thousand nodes and 3 million edges. The final experimental results show that the algorithm has a higher accuracy and recall, and can effectively detect network intrusion events.

Key words: anomaly detection, graph mining, time series, Long Short-Term Memory（LSTM）