图神经网络在异常检测中的应用综述

doi:10.3778/j.issn.1002-8331.2310-0234

摘要/Abstract

摘要： 图数据常用于表示不同个体之间复杂的关系，例如社交网络、金融网络和微服务网络等。图神经网络（GNN）是一种用于处理图数据的深度学习模型，它可以有效捕获图数据中的结构信息和特征信息。异常检测是指从海量数据中找出不符合预期的数据。传统异常检测方法在检测图数据时通常不考虑数据之间的关系，而使用GNN进行异常检测的模型可以利用图结构和图特征进行学习，从而提高异常检测的准确性和鲁棒性。从三个方面对GNN在异常检测中的应用进行综述。介绍了GNN的基本框架，分别探讨了GNN在静态图异常检测、动态图异常检测和时序数据异常检测的最新研究进展，深入分析了该领域未来的研究方向。

关键词: 图神经网络, 异常检测, 静态图, 动态图, 时序数据

Abstract: Graph data is commonly used to represent complex relationships between different individuals, such as social networks, financial networks, and microservice networks. Graph neural network (GNN) is a deep learning model used for processing graph data, which can effectively capture structural and feature information in graph data. Anomaly detection refers to identifying unexpected data from a massive amount of data. Traditional anomaly detection methods usually do not consider the relationships between data when detecting graph data, while models that use GNN for anomaly detection can learn from graph structures and features, thereby improving the accuracy and robustness of anomaly detection. This paper reviews the application of GNN in anomaly detection from three aspects. Firstly, the basic framework of GNN is introduced. Secondly, the latest research progress of GNN in static graph anomaly detection, dynamic graph anomaly detection, and time series data anomaly detection is discussed separately. Finally, an in-depth analysis is conducted on the future research directions in this field.

Key words: graph neural network, anomaly detection, static graph, dynamic graph, time series data

陈佳乐, 陈旭, 景永俊, 王叔洋. 图神经网络在异常检测中的应用综述[J]. 计算机工程与应用, 2024, 60(13): 51-65.

CHEN Jiale, CHEN Xu, JING Yongjun, WANG Shuyang. Survey of Application of Graph Neural Network in Anomaly Detection[J]. Computer Engineering and Applications, 2024, 60(13): 51-65.

参考文献

[1] GRUBBS F E. Procedures for detecting outlying observations in samples[J]. Technometrics, 1969, 11(1): 1-21.
[2] WANG W, CHEN Q, LIU T, et al. A distributed online learning approach to detect anomalies for virtualized network slicing[C]//Proceedings of the 2021 IEEE Global Communications Conference (GLOBECOM). Madrid, Spain: IEEE, 2021: 1-6.
[3] SAVAGE D, ZHANG X, YU X, et al. Anomaly detection in online social networks[J]. Social Networks, 2014, 39: 62-70.
[4] SINGLA A, BERTINO E. How deep learning is making information security more intelligent[J]. IEEE Security & Privacy, 2019, 17(3): 56-65.
[5] HODGE V, AUSTIN J. A survey of outlier detection methodologies[J]. Artificial Intelligence Review, 2004, 22(2): 85-126.
[6] PEROZZI B, AKOGLU L. Scalable anomaly ranking of attributed neighborhoods[C]//Proceedings of the 2016 SIAM International Conference on Data Mining. Society for Industrial and Applied Mathematics, 2016: 207-215.
[7] LI J, DANI H, HU X, et al. Radar: residual analysis for anomaly detection in attributed networks[C]//Proceedings of the Twenty-Sixth International Joint Conference on Artificial Intelligence, 2017: 2152-2158.
[8] PENG Z, LUO M, LI J, et al. ANOMALOUS: a joint modeling approach for anomaly detection on attributed networks[C]//Proceedings of the Twenty-Seventh International Joint Conference on Artificial Intelligence, 2018: 3513-3519.
[9] PANG G, SHEN C, CAO L, et al. Deep learning for anomaly detection: a review[J]. ACM Computing Surveys, 2022, 54(2): 1-38.
[10] JAVAID A, NIYAZ Q, SUN W, et al. A deep learning approach for network intrusion detection system[C]//Proceedings of the 9th EAI International Conference on Bio-inspired Information and Communications Technologies. New York: ACM, 2016.
[11] PENG H K, MARCULESCU R. Multi-scale compositionality: identifying the compositional structures of social dynamics using deep learning[J]. Plos One, 2015, 10(4): e0118309.
[12] L?NGKVIST M, KARLSSON L, LOUTFI A. A review of unsupervised feature learning and deep learning for time-series modeling[J]. Pattern Recognition Letters, 2014, 42: 11-24.
[13] MA X, WU J, XUE S, et al. A comprehensive survey on graph anomaly detection with deep learning[J]. IEEE Transactions on Knowledge and Data Engineering, 2023, 35(12): 12012-12038.
[14] TAM N T, WEIDLICH M, ZHENG B, et al. From anomaly detection to rumour detection using data streams of social platforms[J]. Proceedings of the VLDB Endowment, 2019, 12(9): 1016-1029.
[15] MIAO K, SHI X, ZHANG W A. Attack signal estimation for intrusion detection in industrial control system[J]. Computers & Security, 2020, 96: 101926.
[16] NGUYEN V H, SUGIYAMA K, NAKOV P, et al. FANG: leveraging social context for fake news detection using graph representation[C]//Proceedings of the 29th ACM International Conference on Information & Knowledge Management, 2020: 1165-1174.
[17] BRANCO B, ABREU P, GOMES A S, et al. Interleaved sequence RNNs for fraud detection[C]//Proceedings of the 26th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, 2020: 3101-3109.
[18] KIM H, LEE B S, SHIN W Y, et al. Graph anomaly detection with graph neural networks: current status and challenges[J]. IEEE Access, 2022, 10: 111820-111829.
[19] LEVY O, GOLDBERG Y. Neural word embedding as implicit matrix factorization[C]//Advances in Neural Information Processing Systems, 2014.
[20] MIKOLOV T, CHEN K, CORRADO G, et al. Efficient estimation of word representations in vector space[C]//Proceedings of the International Conference on Learning Representations, 2013.
[21] MONTI F, BOSCAINI D, MASCI J, et al. Geometric deep learning on graphs and manifolds using mixture model CNNs[C]//Proceedings of the 2017 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), Honolulu, 2017: 5425-5434.
[22] ZHENG L, LI Z, LI J, et al. AddGraph: anomaly detection in dynamic graph using attention-based temporal GCN[C]//Proceedings of the Twenty-Eighth International Joint Conference on Artificial Intelligence, Macao, China, 2019: 4419-4425.
[23] ZHAO H, WANG Y, DUAN J, et al. Multivariate time-series anomaly detection via graph attention network[C]//Proceedings of the 2020 IEEE International Conference on Data Mining (ICDM), Sorrento, Italy, 2020: 841-850.
[24] 陈波冯, 李靖东, 卢兴见, 等. 基于深度学习的图异常检测技术综述[J]. 计算机研究与发展, 2021, 58(7): 1436-1455.
CHEN B F, LI J D, LU X J, et al. Survey of deep learning based graph anomaly detection methods[J]. Journal of Computer Research and Development, 2021, 58(7): 1436-1455.
[25] PEROZZI B, AL-RFOU R, SKIENA S. DeepWalk: online learning of social representations[C]//Proceedings of the 20th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, 2014: 701-710.
[26] TANG J, QU M, WANG M, et al. LINE: large-scale information network embedding[C]//Proceedings of the 24th International Conference on World Wide Web, 2015: 1067-1077.
[27] GROVER A, LESKOVEC J. node2vec: scalable feature learning for networks[C]//Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining. San Francisco: ACM, 2016: 855-864.
[28] WANG D, CUI P, ZHU W. Structural deep network embedding[C]//Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining. San Francisco: ACM, 2016: 1225-1234.
[29] LEVIN K, LYZINSKI V. Laplacian eigenmaps from sparse, noisy similarity measurements[J]. IEEE Transactions on Signal Processing, 2017, 65(8): 1988-2003.
[30] RAKTHANMANON T, CAMPANA B, MUEEN A, et al. Searching and mining trillions of time series subsequences under dynamic time warping[C]//Proceedings of the 18th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, 2012: 262-270.
[31] GILMER J, SCHOENHOLZ S S, RILEY P F, et al. Neural message passing for quantum chemistry[C]//Proceedings of the International Machine Learning Society, 2017.
[32] KIPF T N, WELLING M. Semi-supervised classification with graph convolutional networks[C]//Proceedings of the International Conference on Learning Representations, 2017.
[33] HAMILTON W L, YING R, LESKOVEC J. Inductive representation learning on large graphs[C]//Neural Information Processing Systems, 2018.
[34] VELI?KOVI? P, CUCURULL G, CASANOVA A, et al. Graph attention networks[C]//Proceedings of the International Conference on Learning Representations, 2018.
[35] SCHLICHTKRULL M, KIPF T N, BLOEM P, et al. Modeling relational data with graph convolutional networks[C]//Proceedings of the Extended Semantic Web Conference, 2017.
[36] XU K, HU W, LESKOVEC J, et al. How powerful are graph neural networks?[C]//Proceedings of the International Conference on Learning Representations, 2019.
[37] WANG H, ZHOU C, CHEN X, et al. Graph stochastic neural networks for semi-supervised learning: supplemental material[C]//Neural Information Processing Systems, 2020.
[38] ZHU S, PAN S, ZHOU C, et al. Graph geometry interaction learning[C]//Proceedings of the International Conference on Learning Representations, 2020.
[39] DING K, LI J, BHANUSHALI R, et al. Deep anomaly detection on attributed networks[M]. Philadelphia, PA: Society for Industrial and Applied Mathematics, 2019.
[40] PENG Z, LUO M, LI J, et al. A deep multi-view framework for anomaly detection on attributed networks[J]. IEEE Transactions on Knowledge and Data Engineering, 2022, 34(6): 2539-2552.
[41] WANG J, WEN R, WU C, et al. FdGars: fraudster detection via graph convolutional networks in online app review system[C]//Proceedings of the 2019 World Wide Web Conference on Companion. San Francisco: ACM, 2019: 310-316.
[42] ZHENG Y, JIN M, LIU Y, et al. Generative and contrastive self-supervised learning for graph anomaly detection[J]. IEEE Transactions on Knowledge and Data Engineering, 2023, 35(12): 12220-12233.
[43] VELI?KOVI? P, FEDUS W, HAMILTON W L, et al. Deep graph infomax[C]//Proceedings of the International Conference on Learning Representations, 2018.
[44] LI Y, HUANG X, LI J, et al. SpecAE: spectral autoencoder for anomaly detection in attributed networks[C]//Proceedings of the 28th ACM International Conference on Information and Knowledge Management, Beijing, 2019: 2233-2236.
[45] LIU Y, JIN M, PAN S, et al. Graph self-supervised learning: a survey[J]. IEEE Transactions on Knowledge and Data Engineering, 2023, 35(6): 5879-5900.
[46] LIU Y, LI Z, PAN S, et al. Anomaly detection on attributed networks via contrastive self-supervised learning[J]. IEEE Transactions on Neural Networks and Learning Systems, 2022, 33(6): 2378-2392.
[47] JIN M, LIU Y, ZHENG Y, et al. ANEMONE: graph anomaly detection with multi-scale contrastive Learning[C]//Proceedings of the 30th ACM International Conference on Information & Knowledge Management, 2021: 3122-3126.
[48] HUANG Y, WANG L, ZHANG F, et al. Unsupervised graph outlier detection: problem revisit, new insight, and superior method[C]//Proceedings of the 2023 IEEE 39th International Conference on Data Engineering, Anaheim, 2023: 2565-2578.
[49] ZHAO T, JIANG T, SHAH N, et al. A synergistic approach for graph anomaly detection with pattern mining and feature learning[J]. IEEE Transactions on Neural Networks and Learning Systems, 2022, 33(6): 2393-2405.
[50] DUAN D, TONG L, LI Y, et al. AANE: anomaly aware network embedding for anomalous link detection[C]//Proceedings of the 2020 IEEE International Conference on Data Mining, Sorrento, 2020: 1002-1007.
[51] ZHANG G, LI Z, HUANG J, et al. eFraudCom: an e-commerce fraud detection system via competitive graph neural networks[J]. ACM Transactions on Information Systems, 2022, 40(3): 1-29.
[52] ZHANG Z, ZHAO L. Unsupervised deep subgraph anomaly detection[C]//Proceedings of the 2022 IEEE International Conference on Data Mining, Orlando, 2022: 753-762.
[53] WANG H, ZHOU C, WU J, et al. Deep structure learning for fraud detection[C]//Proceedings of the 2018 IEEE International Conference on Data Mining, Singapore, 2018: 567-576.
[54] HUANG L, ZHU Y, GAO Y, et al. Hybrid-order anomaly detection on attributed networks[J]. IEEE Transactions on Knowledge and Data Engineering, 2023, 35(12): 12249-12263.
[55] RUFF L, VANDERMEULEN R A, GORNITZ N, et al. Deep one-class classi?cation[C]//Proceedings of the International Conference on Machine Learning, 2018.
[56] QIU C, KLOFT M, MANDT S, et al. Raising the bar in graph-level anomaly detection[C]//Proceedings of the Thirty-First International Joint Conference on Artificial Intelligence, 2022: 2196-2203.
[57] YANG C, WEN H, HOOI B, et al. A multi-scale reconstruction method for the anomaly detection in stochastic dynamic networks[J]. Neurocomputing, 2023, 518: 482-495.
[58] CHENG D, WANG X, ZHANG Y, et al. Graph neural network for fraud detection via spatial-temporal attention[J]. IEEE Transactions on Knowledge and Data Engineering, 2022, 34(8): 3800-3813.
[59] FANG Y, ZHAO Z, XU Y, et al. Log anomaly detection based on hierarchical graph neural network and label contrastive coding[J]. Computers, Materials & Continua, 2023, 74(2): 4099-4118.
[60] ZHANG Z, LI Y, WANG W, et al. Malware detection with dynamic evolving graph convolutional networks[J]. International Journal of Intelligent Systems, 2022, 37(10): 7261-7280.
[61] CAI L, CHEN Z, LUO C, et al. Structural temporal graph neural networks for anomaly detection in dynamic graphs[C]//Proceedings of the International Conference on Information and Knowledge Management, 2020.
[62] ZHU D, MA Y, LIU Y. A flexible attentive temporal graph networks for anomaly detection in dynamic networks[C]//Proceedings of the 2020 IEEE 19th International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom), Guangzhou, China, 2020: 870-875.
[63] WANG B, HAYASHI T, OHSAWA Y. Hierarchical graph convolutional network for data evaluation of dynamic graphs[C]//Proceedings of the 2020 IEEE International Conference on Big Data (Big Data), 2020: 4475-4481.
[64] DENG A, HOOI B. Graph neural network-based anomaly detection in multivariate time series[C]//Proceedings of the AAAI Conference on Artificial Intelligence, 2021.
[65] AZIM E, WANG D, FU Y. Deep graph stream SVDD: anomaly detection in cyber-physical systems[C]//Proceedings of the Pacific-Asia Conference on Knowledge Discovery and Data Mining, 2023.
[66] CHEN Z, CHEN D, ZHANG X, et al. Learning graph structures with transformer for multivariate time series anomaly detection in IoT[J]. IEEE Internet of Things Journal, 2022, 9(12): 9179-9189.
[67] DING C, SUN S, ZHAO J. MST-GAT: a multimodal spatial-temporal graph attention network for time series anomaly detection[J]. Information Fusion, 2023, 89: 527-536.
[68] BAI S, KOLTER J Z, KOLTUN V. An empirical evaluation of generic convolutional and recurrent networks for sequence modeling[J]. arXiv:1803.01271, 2018.
[69] DAI E, CHEN J. Graph-augmented normalizing flows for anomaly detection of multiple time series[C]//Proceedings of the International Conference on Learning Representations, 2022.
[70] ZHOU L, ZENG Q, LI B. Hybrid anomaly detection via multihead dynamic graph attention networks for multivariate time series[J]. IEEE Access, 2022, 10: 40967-40978.
[71] GOODFELLOW I, POUGET-ABADIE J, MIRZA M, et al. Generative adversarial nets[C]//Neural Information Processing Systems, 2014.
[72] VASWANI A, SHAZEER N, PARMAR N, et al. Attention is all you need[C]//Neural Information Processing Systems, 2017.
[73] TANG L, LIU H. Relational learning via latent social dimensions[C]//Proceedings of the 15th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, 2009: 817-826.
[74] DOU Y, SHU K, XIA C, et al. User preference-aware fake news detection[C]//Proceedings of the 44th International ACM SIGIR Conference on Research and Development in Information Retrieval, 2021: 2051-2055.
[75] AHMED C M, PALLETI V R, MATHUR A P. WADI: a water distribution testbed for research in the design of secure cyber physical systems[C]//Proceedings of the 3rd International Workshop on Cyber-Physical Systems for Smart Water Networks, 2017: 25-28.
[76] MATHUR A P, TIPPENHAUER N O. SWaT: a water treatment testbed for research and training on ICS security[C]//Proceedings of the 2016 International Workshop on Cyber-physical Systems for Smart Water Networks, 2016: 31-36.
[77] HAN Y, DU Q, XU J, et al. LWS: a framework for log-based workload simulation in session-based SUT[J]. Journal of Systems and Software, 2023, 203: 111735.
[78] SEN P, NAMATA G, BILGIC M, et al. Collective classification in network data[J]. AI Magazine, 2008, 29(3): 93.
[79] BANDYOPADHYAY S, LOKESH N, VIVEK S V, et al. Outlier resistant unsupervised deep architectures for attributed network embedding[C]//Proceedings of the 13th International Conference on Web Search and Data Mining, Houston, 2020: 25-33.
[80] LIU S, HOOI B, FALOUTSOS C. HoloScope: topology-and-spike aware fraud detection[C]//Proceedings of the 2017 ACM on Conference on Information and Knowledge Management, Singapore, 2017: 1539-1548.
[81] CHEN S, QIAN J, CHEN H, et al. Anomaly subgraph mining in large-scale social networks[C]//Proceedings of the 2019 IEEE Intl Conf on Parallel & Distributed Processing with Applications, Big Data & Cloud Computing, Sustainable Computing & Communications, Social Computing & Networking (ISPA/BDCloud/SocialCom/SustainCom), Xiamen, 2019: 883-890.
[82] PEI Y, LYU F, VAN IPENBURG W, et al. Subgraph anomaly detection in financial transaction networks[C]//Proceedings of the First ACM International Conference on AI in Finance. New York: ACM, 2020: 1-8.
[83] ALSENTZER E, FINLAYSON S G, LI M M, et al. Subgraph neural networks[C]//Neural Information Processing Systems, 2020.
[84] KING I J, HUANG H H. Euler: detecting network lateral movement via scalable temporal link prediction[J]. ACM Transactions on Privacy and Security, 2023, 26(3): 1-36.
[85] HUANG Q, YU J, WU J, et al. Heterogeneous graph attention networks for early detection of rumors on twitter[C]//Proceedings of the 2020 International Joint Conference on Neural Networks, Glasgow, 2020: 1-8.
[86] LU Y J, LI C T. GCAN: graph-aware co-attention networks for explainable fake news detection on social media[C]//Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics, 2020: 505-514.