Few-shot Network Anomaly Detection via Cross-network Meta-learning

TL;DR

This paper introduces a novel graph neural network framework called Graph Deviation Networks (GDN) combined with cross-network meta-learning to effectively detect anomalies in networks with very limited labeled data, leveraging knowledge from multiple auxiliary networks.

Contribution

It proposes GDN, a new GNN model that uses few labeled anomalies, and a cross-network meta-learning algorithm to transfer knowledge across networks for anomaly detection.

Findings

Effective in few-shot and one-shot anomaly detection scenarios

Outperforms existing methods on multiple network datasets

Leverages auxiliary networks for improved detection accuracy

Abstract

Network anomaly detection aims to find network elements (e.g., nodes, edges, subgraphs) with significantly different behaviors from the vast majority. It has a profound impact in a variety of applications ranging from finance, healthcare to social network analysis. Due to the unbearable labeling cost, existing methods are predominately developed in an unsupervised manner. Nonetheless, the anomalies they identify may turn out to be data noises or uninteresting data instances due to the lack of prior knowledge on the anomalies of interest. Hence, it is critical to investigate and develop few-shot learning for network anomaly detection. In real-world scenarios, few labeled anomalies are also easy to be accessed on similar networks from the same domain as of the target network, while most of the existing works omit to leverage them and merely focus on a single network. Taking advantage of this potential, in this work, we tackle the problem of few-shot network anomaly detection by (1) proposing a new family of graph neural networks -- Graph Deviation Networks (GDN) that can leverage a small number of labeled anomalies for enforcing statistically significant deviations between abnormal and normal nodes on a network; and (2) equipping the proposed GDN with a new cross-network meta-learning algorithm to realize few-shot network anomaly detection by transferring meta-knowledge from multiple auxiliary networks. Extensive evaluations demonstrate the efficacy of the proposed approach on few-shot or even one-shot network anomaly detection.