A multi-scale reconstruction method for the anomaly detection in stochastic dynamic networks

Detecting anomalies in dynamic networks is essential for a range of real-world applications, such as social networks and cybersecurity. However, it encounters substantial challenges due to the diverse and ever-evolving nature of these anomalies. We present Attention-based Anomaly Detection In Dynamic Network (AADDN), an innovative end-to-end anomaly detection framework that utilizes attention mechanisms to capture the complex interactions between node attributes (individual characteristics) and structural features (collective patterns) across various time stamps. Unlike traditional methods that depend on heuristic rules with limited scope, AADDN employs a dual autoencoder architecture to learn comprehensive representations in the latent space, allowing the model to more effectively identify both individual and collective anomalies. By emphasizing the integrated learning of temporal, structural, and attribute information, our approach surpasses existing methods, showcasing superior anomaly detection capabilities in dynamic network environments.

This research addresses the limitations of traditional network models in capturing the complexity and dynamics of real-world social networks. Motivated by the need for a more comprehensive and flexible framework, the study introduces the Hybrid Modern Network Model (HMNM). The HMNM integrates foundational models like the Stochastic Block Model (SBM) and Preferential Attachment with advanced machine learning techniques, including Graph Neural Networks (GNNs), Reinforcement Learning (RL), Hierarchical Random Graphs (HRGs), Generative Adversarial Networks (GANs), and Variational Autoencoders (VAEs). The methods employed involve constructing initial network structures using SBM, simulating network growth through preferential Attachment, learning node embeddings with GNNs, dynamically optimizing network properties using RL, capturing hierarchical community structures with HRGs, controlling degree distributions using GANs, and uncovering latent patterns with VAEs. The empirical illustration of HMNM highlights its effectiveness in providing a more realistic, scalable, and comprehensive analysis of social networks compared to traditional models. Integrating diverse methodologies allows for accurately modeling of network structures, dynamic processes, and latent patterns. In conclusion, the HMNM offers significant advancements in network modeling, providing a robust and flexible framework for analyzing social networks. This model overcomes the limitations of traditional models and delivers deeper insights into the complexities and dynamics of social structures. Future research will optimize the HMNM and explore its applications across various domains. The R programming code used for the network simulations and visualizations is conceptual and demonstrates the HMNM framework. The results and metrics are illustrative placeholders, emphasizing the methodology rather than empirical validation.

Anomaly Detection in Dynamic Networks plays a critical role in various real-world applications such as cyberse-curity, e-commerce, and social media. Recent approaches based on graph neural networks have achieved fruitful results in static networks, and most of the researches focus on learning node embeddings to represent the large-scale complex networks, thereby facilitating downstream anomaly detection task. However, these methods require the whole network to extract intrinsic properties, so they are sensitive to the frequent changes of nodes and incapable of capturing the dynamism as realworld networks evolve over time. In this paper, we propose a novel framework DynAD for anomalous edge detection on time-evolving networks, which performs adaptive parameter learning in an end-to-end manner. In particular, DynAD first extracts fixed-size node embedding from each snapshot with temporal graph convolution and pooling operations. Then, it captures the temporal information of the graph sequence using Gated recurrent units (GRU) for anomaly detection, where an attention mechanism is employed to highlight the differences between the dynamic patterns. Experimental results on three real-world datasets illustrate that DynAD significantly outperforms the state-of-the-art baseline methods in anomaly detection.

Chapter 7 - Advanced approaches to multiagent coordination

The paper proposes an approach to security information processing in order to detect computer attacks and network anomalies based on big data technologies. The main contribution of the work is in the development, implementation and investigation of the proposed combined framework for processing security data using parallel computing environment and measuring the performance of the implemented system for detection of network attacks and anomalies. The research goal is to increase the performance of attack detection (under the given requirements for accuracy of solutions) compared to the traditional IDS application. The implemented approach is built using the open source systems Snort and Spark. The paper discusses the capabilities and performance assessment of parallel data processing in order to detect computer attacks and network anomalies, as well as key principles of working with big data. The presented main results of an experimental performance evaluation of the applied approach confirm its high efficiency for analyzing network traffic and security events.

Dynamic shortest path in stochastic dynamic networks: Ship routing problem

AI-Driven molecule generation and bioactivity prediction: A multi-model approach combining VAE, graph and language-based neural networks.

With the ubiquity of complex networks in domains as diverse as social network analysis, recommender systems and epidemiology, improvements in link predictions have a potential for far-reaching impact. In machine learning, a well-known approach to improve classification performance is to combine several methods in an ensemble. It is also well established that, diversity or complementarity of the classifiers to be combined, is a prerequisite for a potential performance improvement of the formed ensemble. In this work, we combine link prediction heuristics (e.g. Common Neighbour, Adamic-Adar etc.), with static graph neural networks, discrete dynamic graph neural networks, and continuous dynamic graph neural networks. We analyze the importance of each of the methods and how complementary they are with respect to each other. We also use greedy searches to select better subsets of methods to combine and train the ensemble in a roll-forward manner to make it adapt to changes in the dynamic network over time. In the conducted experiments on a number of challenging link prediction tasks, the ensemble from the greedy search and the roll-forward ensemble shows on average a 55% and 61% improvement respectively, over the best single method.

Key performance indicator (KPI) anomaly detection is the underlying core technology in Artificial Intelligence for IT operations (AIOps). It has an important impact on subsequent anomaly location and root cause analysis. Variational auto-encoder (VAE) is a symmetry network structure composed of encoder and decoder, which has attracted extensive attention because of its ability to capture complex KPI data features and better detection results. However, VAE is not well applied to the modeling of KPI time series data and it is often necessary to set the threshold to obtain more accurate results. In response to these problems, this paper proposes a novel hybrid method for KPI anomaly detection based on VAE and support vector data description (SVDD). This method consists of two modules: a VAE reconstructor and SVDD anomaly detector. In the VAE reconstruction module, firstly, bi-directional long short-term memory (BiLSTM) is used to replace the traditional feedforward neural network in VAE to capture the time correlation of sequences; then, batch normalization is used at the output of the encoder to prevent the disappearance of KL (Kullback–Leibler) divergence, which prevents ignoring latent variables to reconstruct data directly. Finally, exponentially weighted moving average (EWMA) is used to smooth the reconstruction error, which reduces false positives and false negatives during the detection process. In the SVDD anomaly detection module, smoothed reconstruction errors are introduced into the SVDD for training to determine the threshold of adaptively anomaly detection. Experimental results on the public dataset show that this method has a better detection effect than baseline methods.

Recurrent neural networks unlike feed-forward networks are able to process inputs with time context. The key role in this process is played by the dynamics of the network, which transforms input data to the recurrent layer states. Several authors have described and analyzed dynamics of small sized recurrent neural networks with two or three hidden units. In our work we introduce techniques that allow to visualize and analyze the dynamics of large recurrent neural networks with dozens units, reveal both stable and unstable points (attractors and saddle points), which are important to understand the principles of successful task processing. As a practical example of this approach, dynamics of the simple recurrent network trained by two different training algorithms on context-free language anbnwas studied.

Recent work has shown that graph neural networks (GNNs) are vulnerable to adversarial attacks on graph data. Common attack approaches are typically informed, i.e. they have access to information about node attributes such as labels and feature vectors. In this work, we study adversarial attacks that are uninformed, where an attacker only has access to the graph structure, but no information about node attributes. Here the attacker aims to exploit structural knowledge and assumptions, which GNN models make about graph data. In particular, literature has shown that structural node centrality and similarity have a strong influence on learning with GNNs. Therefore, we study the impact of centrality and similarity on adversarial attacks on GNNs. We demonstrate that attackers can exploit this information to decrease the performance of GNNs by focusing on injecting links between nodes of low similarity and, surprisingly, low centrality. We show that structure-based uninformed attacks can approach the performance of informed attacks, while being computationally more efficient. With our paper, we present a new attack strategy on GNNs that we refer to as Structack. Structack can successfully manipulate the performance of GNNs with very limited information while operating under tight computational constraints. Our work contributes towards building more robust machine learning approaches on graphs.

The link prediction problem is a time-evolving model in network science that has simultaneously abetted myriad applications and experienced extensive methodological improvement. Inferring the possibility of emerging links in dynamic social networks, also known as the dynamic link prediction task, is complex and challenging. In contrast to the link prediction in cross-sectional networks, dynamic link prediction methods need to cater to the actor-level temporal changes and associated evolutionary information regarding their micro- (i.e., link formation/deletion) and mesoscale (i.e., community formation) network structure. With the advent of abundant community detection algorithms, the research community has examined community-aware link prediction strategies in static networks. However, the same task in dynamic networks where, apart from the actors and links among them, their community pattern is also dynamic, is yet to be explored. Evolutionary community-aware information, including the associated link structure and temporal neighborhood changes, can effectively be mined to build dynamic similarity metrics for dynamic link prediction. This study aims to develop and integrate such dynamic features with machine learning algorithms for link prediction tasks in dynamic social networks. It also compares the performances of these features against well-known similarity metrics (i.e., ResourceAllocation) for static networks and a time series-based link prediction strategy in dynamic networks. These proposed features achieved high-performance scores, representing them as prospective candidates for both dynamic link prediction tasks and modeling the network growth.

Structure-aware deep clustering network based on contrastive learning

Anomaly detection is one of the basic issues in data processing that addresses different problems in healthcare sensory data. Technology has made it easier to collect large and highly variant time series data; however, complex predictive analysis models are required to ensure consistency and reliability. With the rise in the size and dimensionality of collected data, deep learning techniques, such as autoencoder (AE), recurrent neural networks (RNN), and long short-term memory (LSTM), have gained more attention and are recognized as state-of-the-art anomaly detection techniques. Recently, developments in transformer-based architecture have been proposed as an improved attention-based knowledge representation scheme. We present an unsupervised transformer-based method to evaluate and detect anomalies in electrocardiogram (ECG) signals. The model architecture comprises two parts: an embedding layer and a standard transformer encoder. We introduce, implement, test, and validate our model in two well-known datasets: ECG5000 and MIT-BIH Arrhythmia. Anomalies are detected based on loss function results between real and predicted ECG time series sequences. We found that the use of a transformer encoder as an alternative model for anomaly detection enables better performance in ECG time series data. The suggested model has a remarkable ability to detect anomalies in ECG signal and outperforms deep learning approaches found in the literature on both datasets. In the ECG5000 dataset, the model can detect anomalies with 99% accuracy, 99% F1-score, 99% AUC score, 98.1% recall, and 100% precision. In the MIT-BIH Arrhythmia dataset, the model achieved an accuracy of 89.5%, F1 score of 92.3%, AUC score of 93%, recall of 98.2%, and precision of 87.1%.

Growing heterogeneity and large-scale deployment of Internet of Things (IoT) networks have brought forth sensitive security challenges, mainly anomaly detection because of heterogeneity in data, limited resources and dynamic communication protocols.Conventional machine learning and rule-based detection systems are not scalable or adaptable and cannot deal with imbalanced data effectively, leading to high false positives and latency.To overcome these issues, this research introduces an effective deep learning (DL)-based anomaly detection approach for the IoT environment.This study proposed the Modified Harris Hawks Optimization based Convolutional Variational Temporal Fusion Network (MHHO-CVTF-Net), which integrates advanced neural network architectures and an enhanced feature selection mechanism.Initially, using the MHHO algorithm, an optimal subset of features was selected from the complex, high-dimensional IoT-23 dataset, reducing redundancy and improving model generalization.This selected feature set is then processed through the CVTF-Net architecture, which sequentially combines a one-dimensional Convolutional Neural Network (1D CNN), a Bidirectional Long Short-Term Memory (BiLSTM) network, a Variational Autoencoder (VAE) and a Temporal Fusion Transformer (TFT).The proposed MHHO-CVTF-Net achieved excellent performance metrics, with 99.98% overall accuracy in detecting multiple attack classes and benign class.To ensure statistical reliability, the model was evaluated using 10-fold cross-validation, with standard deviation and confidence intervals reported.Paired t-tests confirmed that MHHO-CVTF-Net achieved statistically significant improvements in detection performance over baseline models.The model's ability to detect zero-day attacks was validated through a leave-one-attack-type-out strategy, showing consistently high F1-scores across unseen attack classes.Furthermore, robustness against adversarial manipulation was verified using Fast Gradient Sign Method (FGSM)-based evasion attacks, where the model maintained great detection performance under small perturbations.External validation on the CICIDS 2018 and IoTID20 benchmark datasets, achieved accuracies of 99.85% and 99.95%, respectively, thereby confirming its robustness across diverse real-world attack scenarios.The study proves that the incorporation of advanced DL models using smart feature selection mechanisms can readily overcome the shortcomings of conventional systems and provide scalable and real-time solutions for protecting IoT networks.