Abstract: Traditional anomaly detection method most is based on content features, with the increase of attack technology, this kind of method is easy to be circumvented. Therefore, graph mining technology has become a hot topic in academic research both at home and abroad. In order to improve the accuracy of anomaly detection, a dynamic graph anomaly detection algorithm based on long-short term memory network is proposed. First, by analyzing the change characteristics of dynamic graph, it extracts two kinds of characteristics of Egonet：graph structure distance and edit distance, which efficiently express the structural change of dynamic graph. Secondly, the model is trained by the time series classification algorithm based on LSTM. Finally, the captured network flow is used to detect intrusion, and test the dynamic graph topology of more than 60 thousand nodes and 3 million edges. The final experimental results show that the algorithm has a higher accuracy and recall, and can effectively detect network intrusion events.

Key words: anomaly detection, graph mining, time series, Long Short-Term Memory（LSTM）

摘要： 传统异常检测模型往往基于内容特征，随着攻击手段的提高，该方法易于被绕过，因此图挖掘技术逐渐成为了国内外学术研究的热点。为了提高异常检测的准确率，提出了一种基于长短时记忆网络的动态图模型异常检测算法。首先通过对动态图的变化特征进行分析，总结了Egonet图结构距离和编辑距离两类特征，高效地表示动态图结构的变化情况。其次，通过基于LSTM的时间序列分类算法，进行模型的训练。最后对抓取的网络数据流进行入侵检测，对超过6万节点和300万条边的拓扑图进行测试。最终实验结果表明，该算法具有更高的准确率和召回率，可以有效地检测出网络入侵事件。

关键词: 异常检测, 图挖掘, 时间序列, 长短时记忆（LSTM）