A Flexible Attentive Temporal Graph Networks for Anomaly Detection in Dynamic Networks

Graph Neural Networks (GNNs), which generalize deep neural networks to graph-structured data, have drawn considerable attention and achieved state-of-the-art performance in numerous graph related tasks. However, existing GNN models mainly focus on designing graph convolution operations. The graph pooling (or downsampling) operations, that play an important role in learning hierarchical representations, are usually overlooked. In this paper, we proposed a novel multi-view graph pooling operator dubbed as MVPool, which ranks nodes across different views with different contextual graph information. Meanwhile, attention mechanism is utilized to promote the collaboration of different views for generating robust node rankings. Then the pooling operation adaptively selects a subset of nodes to form an induced subgraph based on the ranking list. To preserve the underlying graph topological information, we further introduce a structure learning mechanism to learn a refined graph structure for the pooled graph at each layer. The proposed MVPool operator is a general strategy that can be integrated into various graph neural network architectures. By combining MVPool operator with graph neural networks, we perform hierarchical representation learning for both node and graph level classification as well as clustering tasks. Experimental results on nine widely used benchmarks demonstrate the effectiveness of our proposed model.

The rapid expansion of blockchain technology has led to increased security challenges, particularly in detecting fraudulent transactions and malicious activities within decentralized networks. Traditional anomaly detection techniques, including rule-based heuristics and supervised learning models, struggle to adapt to the dynamic and complex nature of blockchain transactions. This paper introduces a graph neural network (GNN)-based anomaly detection framework designed to improve blockchain security by leveraging the inherent graph structure of transaction networks. The proposed approach models blockchain transactions as a directed graph, where nodes represent wallet addresses and edges correspond to transaction flows. By applying spatial and temporal graph learning techniques, the framework captures both network topology and transaction evolution over time, allowing for the identification of anomalous activities such as money laundering, phishing scams, and Ponzi schemes. The GNN model incorporates graph convolutional networks (GCN), graph attention networks (GAT), and gated recurrent units (GRU) to learn both spatial dependencies and sequential patterns within blockchain transactions. Experiments conducted on Bitcoin and Ethereum transaction datasets demonstrate that the GNN-based framework outperforms conventional fraud detection methods in terms of precision, recall, and false positive reduction. The model successfully detects fraudulent transactions with an F1-score of 0.92, showing its effectiveness in identifying emerging threats in blockchain networks. These results highlight the potential of deep learning-based anomaly detection in enhancing blockchain security, providing a scalable and adaptive solution for detecting fraud in decentralized financial ecosystems.

Graph Neural Networks (GNNs) have achieved promising results in numerous applications. To ensure accurate predictions, GNNs may exploit user data beyond the scope of consent, raising significant concerns regarding data usage and privacy. A critical task, therefore, is data usage privacy auditing, which aims to infer whether a data subject's information was improperly used during model training. While Membership Inference Attacks (MIA) are commonly used to audit data usage in fully supervised settings, most GNNs operate under a semi-supervised paradigm, where nodes fall into three distinct categories with varying degrees of involvement in training. This heterogeneity introduces a key challenge for applying traditional binary MIA methods. To address this, we study ternary data usage privacy auditing for semi-supervised GNNs in a black-box setting using a shadow training-based MIA framework. We identify that the main obstacle lies in the effects of message passing, which entangles node representations across categories. To tackle this, we propose MPMIA--a novel Message Passing-aware Membership Inference Attack--which leverages point-wise KL divergence to quantify and exploit the influence of message passing on node embeddings. Extensive experiments validate the effectiveness of MPMIA, showing clear improvements over baseline methods in accurately auditing data usage within semi-supervised GNNs.

Traditional fault prediction methods are difficult to meet the needs of modern communication networks because of the limitations of static model, dependence on a single data source and lack of real-time processing ability. Graph neural network (GNN) can effectively capture the complex relationship between network devices and improve the accuracy and efficiency of fault prediction by virtue of its topological awareness, dynamic modeling potential and multi-modal integration advantages. In this paper, a cross-modal fusion method based on multi-scale dynamic GNN (MSGNN-CM) is proposed. The communication network is modeled as a dynamic graph, and the local and global topological features are extracted through the convolution of multi-scale graphs. The time-series evolution of network state is captured by Gated Recurrent Unit (GRU), and the topology, time-series and alarm information are fused through attention mechanism, so as to realize node-level fault probability prediction and critical link risk identification. This method has the advantages of multi-scale perception, dynamic adaptability and multi-source collaborative integration, and can effectively cope with the dynamic changes and complexity of the network. The experiment uses six months' operation and maintenance data of three city base stations, involving 500 nodes and 2,100 edges. The characteristics of nodes include traffic, delay and CPU load, while the characteristics of edges include bandwidth utilization and packet loss rate. The results show that MSGNN-CM performs best in node-level fault prediction tasks, with F1-Score and AUC-ROC reaching 88.6% and 92.3% respectively, which are significantly better than traditional methods and existing GNN models. In addition, this method also performs well in link-level risk detection, with Precision@10 and Precision@20 reaching 53.8% and 45.2% respectively. The analysis of dynamic adaptability shows that choosing a suitable time window is very important to the performance of the model, and GRU mechanism has the ability to respond quickly to sudden events. Explanatory verification shows that the cross-modal attention mechanism can effectively identify key failure indicators and improve the transparency and practicability of the model.

Graph Neural Networks (GNNs) have become the state-of-the-art method for many applications on graph structured data. GNNs are a model for graph representation learning, which aims at learning to generate low dimensional node embeddings that encapsulate structural and feature-related information. GNNs are usually trained in an end-to-end fashion, leading to highly specialized node embeddings. While this approach achieves great results in the single-task setting, the generation of node embeddings that can be used to perform multiple tasks (with performance comparable to single-task models) is still an open problem. We propose the use of meta-learning to allow the training of a GNN model capable of producing multi-task node embeddings. In particular, we exploit the properties of optimization-based meta-learning to learn GNNs that can produce general node representations by learning parameters that can quickly (i.e. with a few steps of gradient descent) adapt to multiple tasks. Our experiments show that the embeddings produced by a model trained with our purposely designed meta-learning procedure can be used to perform multiple tasks with comparable or, surprisingly, even higher performance than both single-task and multi-task end-to-end models.

Anomaly detection in dynamic networks aims to find network elements (e.g., nodes, edges, subgraphs, change points) with significantly different behaviors from the vast majority, it can also devote to community detection and evolution and prediction tasks. Most existing methods focus on one specific task, that is, only detect anomalies of one type of element isolated, so they lose the ability to model the correlation and driving mechanism between different abnormal behavior. Considering that the anomaly detection of one type of element is helpful to other types of elements, i.e., the temporal evolution hidden the dynamic networks are driven by indivisible behavior patterns. So in this paper, we propose a unified Generation model to analyze the dynamic network for Exploring the Abnormal Behaviors of different Scales (GEABS). It can model the relation and catch different levels (node, community and network) of anomaly with a joint statistical network model and detect the community structure and its evolution. Specifically, we denote the parameters of node popularity, community membership to generate the dynamic network with stochastic block model (SBM), we also describe the varying of node and community by dynamic process. With a well-designed generative mechanism, it can detect the change point on network level, temporal evolution on community level and abnormal behavior on node level synchronously, besides, it also detects the community structure effectively. We also propose an effective optimization algorithm with variational inference. Experimental results show that the GEABS achieves better performance on abnormal behavior and community structure compared with baselines.

Since deep neural networks can learn data representation from training data automatically, deep learning methods are widely used in the network anomaly detection. However, challenges of deep learning-based anomaly detection methods still exist, the major of which is the training data scarcity problem. In this paper, we propose a novel network anomaly detection method (NAFT) using federated learning and transfer learning to overcome the data scarcity problem. In the first learning stage, a people or organization \(O_t\), who intends to conduct a detection model for a specific attack, can join in the federated learning with a similar training task to learn basic knowledge from other participants’ training data. In the second learning stage, \(O_t\) uses the transfer learning method to reconstruct and re-train the model to further improve the detection performance on the specific task. Experiments conducted on the UNSW-NB15 dataset show that the proposed method can achieve a better anomaly detection performance than other baseline methods when training data is scarce.

TodyNet: Temporal dynamic graph neural network for multivariate time series classification

In industry, sensor-based monitoring of equipment or environment has become a necessity. Instead of using a single sensor, multi-sensor system is used to fully detect abnormalities in complex scenarios. Recently, physical models, signal processing technology, and various machine learning models have improved the performance. However, these methods either do not consider the potential correlation between features or do not take advantage of the sequential changes of correlation while constructing an anomaly detection model. This paper firstly analyzes the correlation characteristic of a multi-sensor system, which shows a lot of clues to the anomaly/fault propagation. Then, a multi-sensor anomaly detection method, which finds and uses the correlation between features contained in the multidimensional time-series data, is proposed. The method converts the multidimensional time-series data into temporal correlation graphs according to time window. By transforming time-series data into graph structure, the task of anomaly detection is considered as a graph classification problem. Moreover, based on the stability and dynamics of the correlation between features, a structure-sensitive graph neural network is used to establish the anomaly detection model, which is used to discover anomalies from multi-sensor system. Experiments on three real-world industrial multi-sensor systems with anomalies indicate that the method obtained better performance than baseline methods, with the mean value of F1 score reaching more than 0.90 and the mean value of AUC score reaching more than 0.95. That is, the method can effectively detect anomalies of multidimensional time series.

Graph Neural Networks (GNNs) are known to be prone to adversarial attacks, among which backdoor attack is a major security threat. By injecting backdoor triggers into a graph and assigning a target class label to nodes attached to the triggers, the attacker can mislead the GNN model trained on the poisoned graph to classify test nodes attached with a trigger to the target class. To defend against backdoor attacks, existing defense methods rely on anomaly detection in feature distribution or label transformation. However, these approaches are incapable of detecting in-distribution triggers or clean-label attacks that do not alter the class label of target nodes. To tackle these threats, we empirically analyze triggers from a multidimensional aspect, and our analysis shows that there are clear distinctions between trigger nodes and normal ones in terms of node feature values, node embeddings, and class prediction probabilities. Based on these findings, we propose a Multidimensional Anomaly Detection framework (MAD) that can effectively minimize the impact of triggers by pruning away anomalous nodes and edges. Extensive experiments show that at the cost of slight loss in clean classification accuracy, MAD achieves considerably lower attack success rate as compared to state-of-the-art backdoor defense methods.

Graph Neural Networks (GNNs) are known to be prone to adversarial attacks, among which backdoor attack is a major security threat. By injecting backdoor triggers into a graph and assigning a target class label to nodes attached to the triggers, the attacker can mislead the GNN model trained on the poisoned graph to classify test nodes attached with a trigger to the target class. To defend against backdoor attacks, existing defense methods rely on anomaly detection in feature distribution or label transformation. However, these approaches are incapable of detecting in-distribution triggers or clean-label attacks that do not alter the class label of target nodes. To tackle these threats, we empirically analyze triggers from a multidimensional aspect, and our analysis shows that there are clear distinctions between trigger nodes and normal ones in terms of node feature values, node embeddings, and class prediction probabilities. Based on these findings, we propose a Multidimensional Anomaly Detection framework (MAD) that can effectively minimize the impact of triggers by pruning away anomalous nodes and edges. Extensive experiments show that at the cost of slight loss in clean classification accuracy, MAD achieves considerably lower attack success rate as compared to state-of-the-art backdoor defense methods.

Community structure is one of the fundamental characteristics of complex networks. Many methods have been proposed for community detection. However, most of these methods are designed for static networks and are not suitable for dynamic networks that evolve over time. Recently, the evolutionary clustering framework was proposed for clustering dynamic data, and it can also be used for community detection in dynamic networks. In this paper, a multi-similarity spectral (MSSC) method is proposed as an improvement to the former evolutionary clustering method. To detect the community structure in dynamic networks, our method considers the different similarity metrics of networks. First, multiple similarity matrices are constructed for each snapshot of dynamic networks. Then, a dynamic co-training algorithm is proposed by bootstrapping the clustering of different similarity measures. Compared with a number of baseline models, the experimental results show that the proposed MSSC method has better performance on some widely used synthetic and real-world datasets with ground-truth community structure that change over time.

Multiobjective biogeography based optimization algorithm with decomposition for community detection in dynamic networks

Social networks are becoming more prevalent all across the globe. With all of its advantages, criminality and fraudulent conduct in this medium are on the rise. As a result, there is an urgent need to detect abnormalities in these networks before they do substantial harm. Traditional Non-Deep Learning (NDL) approaches fails to perform effectively when the size and scope of real-world social networks increase. As a result, DL techniques for anomaly detection in social networks are required. Several studies have been conducted using DL on node and edge anomaly detection. However, in the current scenario, subgraph anomaly detection utilizing Deep Learning (DL) is still in its nascent stages. This paper proposes a method called Clustering-based Deep Autoencoders (CDA) to detect subgraph anomalies in static attributed social networks. It converts the input graph into node embeddings using an encoder, clusters these nodes into communities or subgraphs, and then finds anomalies among these subgraph embeddings. The model is tested on seven open-access social network datasets, and the findings indicate that the proposed model detects the most anomalies. In the future, it is also recommended that the present experiment be aimed at dynamic social networks.

In recent years, the identification of abnormalities in attributed networks has become essential for applications including social media analysis, cybersecurity, and financial fraud detection. Unsupervised graph anomaly detection techniques seek to recognize infrequent and anomalous patterns in graph-structured data without the necessity of labelled instances. Conventional methods employing Graph Neural Networks (GNNs) frequently encounter difficulties, especially due to the transmission of noisy edges and the intrinsic intricacy of node interrelations. To overcome these restrictions, we introduce ANOGAT-Sparse-TL, an innovative hybrid framework that integrates graph sparsification and Graph Attention Networks (GAT) with autoencoder-based reconstruction for anomaly detection in attributed networks. The sparsification procedure removes extraneous edges and highlights significant node connections, thereby enhancing computational efficiency and improving anomaly detection efficacy. By including GAT, our model carefully allocates significance to pertinent neighboring nodes, yielding enhanced node embeddings. The autoencoder subsequently reconstructs these embeddings to detect abnormalities via reconstruction errors. Incorporating Tversky Loss in the reconstruction process further improves the robustness of the model by effectively addressing the imbalance between normal and anomalous data, prioritizing the detection of rare anomalies. This optimized loss function allows ANOGAT-Sparse-TL to focus on hard-to-reconstruct instances, which are typically indicative of anomalies, and reduces the impact of noisy data on the model's performance. ANOGAT-Sparse-TL effectively integrates attribute-based and structural anomalies, yielding comprehensive anomaly ratings. Comprehensive studies on the four real-world datasets indicate that our strategy surpasses current state-of-the-art methodologies, with enhanced performance. Moreover, the scalability of our methodology guarantees its relevance to extensive real-world networks, rendering it an adaptable option for diverse graph anomaly detection activities. ANOGAT-Sparse-TL, despite its complexity, maintains computational efficiency and provides substantial improvements in anomaly detection inside attributed networks. Future research may concentrate on enhancing interpretability and broadening generalizability to various network architectures.